Alexa AI - all your Echo data are ours

[Quoth]

Originally Posted by salamanderjuice

Yes. For the wake word. Which it does offline and locally. And then after the wake word it listens until you're done and sends that off to the server for processing.

You've seen an independent audit of the code or monitored the traffic?

[salamanderjuice]

Originally Posted by Quoth

You've seen an independent audit of the code or monitored the traffic?

You can tell the wake word is processed locally because it still works with no network connection. You just get told it has trouble connecting. You can also see recent requests and recordings sent to the server in the app.

If you're so paranoid that it's secretly listening, do you not apply the same logic to all your mic equipped devices that run a shred of proprietary code? Did you audit the code or monitor the traffic of your NXTPAPER 14 to ensure it's not sending 24/7 recordings of everything it hears to some server in China? And even if you did monitor the traffic how can you be truly sure that your devices aren't just hiding it all from you? After all, did you audit their network firmware?

[Quoth]

There is a difference: It's been proved that Amazon collects Alexa audio even without the wake word. It's designed to do it.

If I thought any Andriod tablet was listening and sending the audio, I'd fit a switch on the mic or remove it. There have been TVs that listen and feed. No evidence that Android generally is doing it, though Google is collectlng plenty of data.

In general, unlesss you are Chinese, or a special target, the big USA corporations are far worse than China at "spying" on you.

I can see no utility at all to an Amazon Echo or similar device. The Stazi would have loved them. Yet people pay for them.

Also my so called "Smart" TVs have no WiFi Password nor ethernet. I turn off wifi on any device when I don't need it (and my Router confirms it truns on / off).

There is a huge difference between stuff that where it's even admitted it sends everything to servers (Alexa, smart TVs etc) and a regular phone/tablet.

There are issues with Windows, Mac OS, iOS, Android, but an Echo is specifically designed to need Amazon's servers and send what it "hears" to them. Similarly I'd not have Meta's Portal Tablet.

[salamanderjuice]

Originally Posted by Quoth

There is a difference: It's been proved that Amazon collects Alexa audio even without the wake word. It's designed to do it.

If I thought any Andriod tablet was listening and sending the audio, I'd fit a switch on the mic or remove it. There have been TVs that listen and feed. No evidence that Android generally is doing it, though Google is collectlng plenty of data.

In general, unlesss you are Chinese, or a special target, the big USA corporations are far worse than China at "spying" on you.

I can see no utility at all to an Amazon Echo or similar device. The Stazi would have loved them. Yet people pay for them.

Also my so called "Smart" TVs have no WiFi Password nor ethernet. I turn off wifi on any device when I don't need it (and my Router confirms it truns on / off).

There is a huge difference between stuff that where it's even admitted it sends everything to servers (Alexa, smart TVs etc) and a regular phone/tablet.

There are issues with Windows, Mac OS, iOS, Android, but an Echo is specifically designed to need Amazon's servers and send what it "hears" to them. Similarly I'd not have Meta's Portal Tablet.

Pretty much every tablet and smartphone has some assistant out of the box that's essentially the same as Alexa. Google Assistant, Siri, Bixby, etc.

I doubt you've audited TCL's additions to Android, so how do you know it's not listening?

And no it hasn't been proved that echoes are always listening. Occasionally there are false positives and they catch non-command related things. Can happen on phones/tablets too.

[theducks]

NIT
If it isn't always listening, then how does it process the command word??

What can these devices still do when there is no connection? (besides complain about NC).
This assumes (by me) that they don't store and forward at a later time some 'trapped' keyword data.

I can't believe there are not ways to fake 'not listening' (or looking thru your camera on equipped devices). Then there is the cases of rogue employees including (unsanctioned) backdoors for entertainment purposes
Not all exploits are sanctioned by the company. You should still take care.

(my WEBCAM has a lens cap, that was included in the package. The Mic is still there)

[salamanderjuice]

Originally Posted by theducks

NIT
If it isn't always listening, then how does it process the command word??

What can these devices still do when there is no connection? (besides complain about NC).
This assumes (by me) that they don't store and forward at a later time some 'trapped' keyword data.

I can't believe there are not ways to fake 'not listening' (or looking thru your camera on equipped devices). Then there is the cases of rogue employees including (unsanctioned) backdoors for entertainment purposes
Not all exploits are sanctioned by the company. You should still take care.

(my WEBCAM has a lens cap, that was included in the package. The Mic is still there)

It listens for the wake word. That's all it does. And it does it locally. It's looking for a sound wave that sounds sort of like "Alexa". After it hears the wake word it records what it hears and sends that off for processing. It's not recording everything all the time.

Could they fake "not listening"? Of course, but that's true of every single mic equipped device that runs code you can't inspect talking to devices running code you can't inspect. There's no reason IMO to trust a smartphone or tablet over an Echo, Google Home or Home Pod. If you think internet enabled mic equipped thing is recording, then why not ALL the internet enabled mic equipped things?

They don't store past commands either from when they have no network.

[Quoth]

Originally Posted by salamanderjuice

Pretty much every tablet and smartphone has some assistant out of the box that's essentially the same as Alexa. Google Assistant, Siri, Bixby, etc.

I disable / remove those.

Originally Posted by salamanderjuice

I doubt you've audited TCL's additions to Android, so how do you know it's not listening?

Whataboutism.

[Graham44]

Originally Posted by salamanderjuice

Could they fake "not listening"? Of course, but that's true of every single mic equipped device that runs code you can't inspect talking to devices running code you can't inspect. There's no reason IMO to trust a smartphone or tablet over an Echo, Google Home or Home Pod. If you think internet enabled mic equipped thing is recording, then why not ALL the internet enabled mic equipped things?

This is quite true, I suppose anything with a mic could be listening when you don't know it is, but the biggest difference between other tech (tablets, laptops etc) and ''smart'' speakers is the smart speakers are designed to be left on/ on standby all the time, or rather they've been marketed that way, whereas tablets etc are powered off, you could even unplug a desktop or take the battery out of a laptop if you so wished. A smart speaker would be pretty obsolete if you had to walk over and plug it in every time you wanted to use it, it would effectively remove it's only USP.

People say why do you think they would want to listen all the time? - Data gathering, why would people think they don't listen all the time?

But if you (the universal you, not any individual on here) has decided that all the evidence etc points to these companies not spying and therefore is happy to use a smart speaker there's nothing wrong with that, equally if you have come to the opposite conclusion and wouldn't allow a smart speaker etc within a 100 feet of your home (me included) thats fine also

[salamanderjuice]

Originally Posted by Graham44

This is quite true, I suppose anything with a mic could be listening when you don't know it is, but the biggest difference between other tech (tablets, laptops etc) and ''smart'' speakers is the smart speakers are designed to be left on/ on standby all the time, or rather they've been marketed that way, whereas tablets etc are powered off, you could even unplug a desktop or take the battery out of a laptop if you so wished. A smart speaker would be pretty obsolete if you had to walk over and plug it in every time you wanted to use it, it would effectively remove it's only USP.

People say why do you think they would want to listen all the time? - Data gathering, why would people think they don't listen all the time?

But if you (the universal you, not any individual on here) has decided that all the evidence etc points to these companies not spying and therefore is happy to use a smart speaker there's nothing wrong with that, equally if you have come to the opposite conclusion and wouldn't allow a smart speaker etc within a 100 feet of your home (me included) thats fine also

When was the last time you powered off your phone, tablet, or laptop for an extended period of time? Even defining "off" is pretty hard. Modern apple laptops for example use a haptic trackpad. They have no buttons but instead use a vibration motor to fake the feel of a click. This works when it's been shut down from the menu so you can turn it back on by clicking. Is it really off then if it's keeping the vibration motor alive? If they can keep a motor alive, why not a mic? With a phone or tablet detecting "off" is even more difficult. Most these days don't have a user removable battery so how can you really be sure it's off?

The reason not to be listening all the time is trust. Who would trust a company listening all the time?

I just don't understand how someone can claim an entire class of device is essentially a bug but then ignore devices (from the same manufacturers even!) that can do all the same things + more.

[DiapDealer]

Originally Posted by Quoth

It's been proved that Amazon collects Alexa audio even without the wake word.

When? Where? It records when it mistakenly THINKS it's heard the wake word. But I've not seen any convincing evidence that it randomly records without the wake word (or something it mistakes for the wake word). I've seen a lot of supposition and conjecture, but nothing I'd consider evidence.

[Graham44]

Originally Posted by salamanderjuice

When was the last time you powered off your phone, tablet, or laptop for an extended period of time? Even defining "off" is pretty hard. Modern apple laptops for example use a haptic trackpad. They have no buttons but instead use a vibration motor to fake the feel of a click. This works when it's been shut down from the menu so you can turn it back on by clicking. Is it really off then if it's keeping the vibration motor alive? If they can keep a motor alive, why not a mic? With a phone or tablet detecting "off" is even more difficult. Most these days don't have a user removable battery so how can you really be sure it's off?
.

For me personally, all the time, if I'm not using my desktop it's physically unplugged from the power outlet (and is running Linux Mint), my laptop still uses a physical button to switch it off (plus it also runs Linux Mint, I had an Android tablet but when I decided to stop using Google because of privacy I 'decommissioned' it using a hammer* ) and my phone is not a smart phone so has no apps and no affiliation to any big tech, just my phone operator (and if I wished I could remove the battery as well) It may seem a bit over the top to some the precautions I take (and maybe it is) but I feel for my usage and my believes around big tech etc it's not much hassle for me, and I hope it adds a bit more security for me. Obviously because of my feelings around smart speakers I don't have one, couldn't anyway as I dont have a Google, Amazon or Apple account. But this is just the route I've decided to take, which makes me happy.

* Android tablets have this stupid thing whereas if you delete your Google account before wiping your data from your tablet you then can't do a factory re-set, or at least I couldn't on the Samsung one I had, it asks for your Google password to re-set which you can't provide if you've already deleted your account - my fault really I should have double checked that

[Graham44]

An interesting read -

https://protonvpn.com/blog/alexa-spying/

[haertig]

Originally Posted by Graham44

...if I'm not using my desktop it's physically unplugged from the power outlet...

Since you eventually power the computer up and use it, this probably isn't doing much to protect your privacy/security. But it is a good thing to do to protect your computer from power surges and other electrical issues (when it's not in use). Make sure to also unplug cables that connect the computer to other equipment - network cables, USB cables going to printers, external hard drives (that have their own power plug), audio cables going to powered speakers, etc.

I don't go to these extremes myself, but if I did, I'd consider using a laptop plugged into a docking station so everything - power, external monitor, external keyboard, peripherals - could be disconnected/reconnected quickly and easily.

[Graham44]

Originally Posted by haertig

Since you eventually power the computer up and use it, this probably isn't doing much to protect your privacy/security. But it is a good thing to do to protect your computer from power surges and other electrical issues (when it's not in use). Make sure to also unplug cables that connect the computer to other equipment - network cables, USB cables going to printers, external hard drives (that have their own power plug), audio cables going to powered speakers, etc.

I don't go to these extremes myself, but if I did, I'd consider using a laptop plugged into a docking station so everything - power, external monitor, external keyboard, peripherals - could be disconnected/reconnected quickly and easily.

Some good suggestions I did forget to say the desktop is very rarely connected to the internet (it has no internal wifi so uses a dongle which is unplugged) as it's only purpose is to run my Calibre library (I briefly connect it when importing books that are DRM protected)

Of course the very fact I'm using Linux adds a layer of identity protection in itself, plus I don't use any services that are known for excessive data collection, I also use Librewolf web browser and Ublock origin to protect against cookies etc, I should probably look at using a VPN as well, but I don't really know how these work so I need to read up on this.

[haertig]

Originally Posted by Graham44

Some good suggestions I did forget to say the desktop is very rarely connected to the internet (it has no internal wifi so uses a dongle which is unplugged) as it's only purpose is to run my Calibre library (I briefly connect it when importing books that are DRM protected)

For that use, you might even want to consider booting from a thumbdrive. Either MX Linux or AntiX have great capabilities for thumbdrive boot. Make sure the thumbdrive is USB 3 and plugged into a USB 3 port on your computer. On boot, choose the option to load the entire OS into RAM. You can then remove the thumbdrive after boot and run totally out of RAM. One, this runs faster than snot, and two, you don't have to worry about any malware because everything is only in RAM. As soon as you power down, everything is gone. If you want to save something you can always leave the thumbdrive in place or connect a different storage peripheral and mount that temporarily. Or email the files to yourself, or copy them to a cloud drive, or whatever. You can "install" additional programs after boot and these are "installed" into RAM only.

You can boot from a "clean" OS on the thumbdrive, install the programs that you always want available - Calibre and whatever else - then write these back to the thumbdrive. MX and AntiX call this "remastering". From then on your thumbdrive boot will include all these extra programs that you added.

Another good use for this, especially for people that are security conscious, is to boot to RAM, install a new potentially suspect program, give it a quick run through, then examine the "layer" of RAM on "top" of the initial OS boot (these thumbdrive boots use a "layered filesystem"). You can easily see everything that has happened on your computer - things added, deleted or changed - since boot by looking at the appropriate layer only.

Booting totally into RAM is also mandatory, IMHO, if you are venturing onto the Dark Web. There is lots of good and legit stuff on the Dark Web even though most people think it's all bad and criminal. But you do have to be aware that all normal safeguards are off in that world, and control your behavior appropriately. One part of appropriate behavior is to do everything only in RAM so it all disappears when you reboot.