51–60 of 64 posts
> Amazon or Google review the security of the voice app before it is published. We change the functionality after this review, which does not prompt a second round review How is this not a massive red flag?
Do these devices record all the time or only after the trigger word (they would need to be always listening for the trigger word) until the end of the statement?
The device has to record all the time in order to "listen" for the wake word. It's got a small couple-second buffer (enough to store "Amazon" or "Computer" or "Alexa" or "Echo") where it takes what it hears and compares it with its internal model for a match. If there's no match, the buffer is overwritten with the next bit of noise. Once the device gets a wake word match, it transmits the statement that follows to ho…
If Amazon's Ring is partnering with LE[1], and from what I understand, in some circumstances providing access to customer-produced data even when customers refuse requests, it doesn't seem too unreasonable to have suspicions. 1. https://www.vice.com/en_us/article/43kga3/amazon-is-coaching... 2. https://www.eff.org/deeplinks/2019/08/five-concerns-about-am... Edit to append link and quote: Quote: However, he noted, the…
Earlier quoted context omitted.
True, but none of the players that be will add one voluntarily.
The Google Home mini and Google Home Max have physical sliding mic mute toggles. The original Google Home has a physical momentary mic mute switch (click to disable, click to enable). The Amazon Echo also has a similar mic mute switch.
Earlier quoted context omitted.
I don't know for sure about Google, but with Alexa skills are simply implemented as a web service. There is no way for Amazon to know that you've deployed new code on your web service. There are a lot of limits to what you can change though, the prompts / intents are specified in a manifest you have to upload. But what the device does for an existing intent, and the responses it sends, can be changed without their kn…
I just can't believe that people actually pay to have these things in their houses. Or maybe, sadly, I can.
Earlier quoted context omitted.
I don't know for sure about Google, but with Alexa skills are simply implemented as a web service. There is no way for Amazon to know that you've deployed new code on your web service. There are a lot of limits to what you can change though, the prompts / intents are specified in a manifest you have to upload. But what the device does for an existing intent, and the responses it sends, can be changed without their kn…
I just can't believe that people actually pay to have these things in their houses. Or maybe, sadly, I can.
All hardware with a microphone (or speaker since it too can be used as a mic) needs a hardware switch to disable ... Which will only land once open hardware Linux mobiles take off in next year or two ... Until then I just assume nothing is private
Earlier quoted context omitted.
The device has to record all the time in order to "listen" for the wake word. It's got a small couple-second buffer (enough to store "Amazon" or "Computer" or "Alexa" or "Echo") where it takes what it hears and compares it with its internal model for a match. If there's no match, the buffer is overwritten with the next bit of noise. Once the device gets a wake word match, it transmits the statement that follows to ho…
From what I understand, it's slightly worse - the local matching is quite promiscuous in that it will be likely to trigger on false positives and then forward it to the remote backend where the actual match is confirmed, where sent data includes the entire buffer including a couple of seconds before and after.
> It is possible to ask for sensitive data such as the user’s password from any voice app. Newsflash: computing device with the capability for user interaction can request information that you might not want to give it. In other words, how is this situation different from any software running on any other type of computing device?
It's not really any different -- changing server behavior after app review is possible for any server-based app. The one thing they exploited that is unique, though, is that when a user talks to a smart device, they generally don't know at any given time if their commands are going to Google/Amazon or are being passed to Google/Amazon and the third-party developer. As far as many users are concerned, they're talking…
Developers (on Alexa, at least) can optionally do this now with SSML, but making it a requirement would be an audio cue to users that the “actor” has changed — without adding any delay to the interaction.
Earlier quoted context omitted.
That seems like a strange workaround. Wouldn't the burden of proof to subpoena to Amazon be the same as a warrant to the user?
Amazon owns the video, not the user, so you only need a warrant if they demand one. They’re also free to not require one.
I mean, something like this should be viewed in the context of comparable IRL vendors. If I rent a 3rd-party storage unit from U-Haul or similar, a warrant is generally required.
(one exception I found was a case where police, on-site, witnessed a drug deal. They then used the defendant's key to open their unit without a warrant. It was judged lawful, that finding drugs and keycard on the defendant was sufficient probably cause. That makes sense, given that if police witness you in front of your house, or car, etc selling drugs, that would be sufficient as well to search.) [0]
https://www.govinfo.gov/content/pkg/USCOURTS-ilnd-1_14-cr-00...