Alexa AI - all your Echo data are ours

[j.p.s]

Originally Posted by DiapDealer

Always waiting for a command <> always sending. It's pretty simple.

The notion that Echo devices are an always-on, direct conduit to Amazon for anything said within earshot is quite silly (and just a tad tinfoil-hat-wearing).

Maybe not always and maybe not as much as in the past, but there is this from around 6 years ago. Some of the listeners were disturbed by what they heard.

https://time.com/5568815/amazon-work...sten-to-alexa/

[DiapDealer]

That same article explains how those "snatches" of audio are primarily garnered because of words that sound like the wake word the user has chosen. I've still not heard any convincing evidence of an Echo device just randomly "listening" (let alone transmitting) without at least believing a wake word had been spoken.

I expect everything I say after "Alexa"..." to be used by Amazon (algorithms or humans) to improve the service. I wouldn't own one if I wasn't OK with that.

[haertig]

A lot of people don't understand how Alexa works and are spreading fear based on their (usually incorrect) assumptions.

Alexa does not send anything up to Amazon until AFTER the device is "woken up". By default that is when someone says "Alexa". The device is listening for it's wake word all the time, but it is only listening locally. Meaning it's the device itself that recognizes the wake word. It does not send everything it hears up to the internet for something on the internet to detect the wake word. You can prove this by turning off your internet connection - unplugging the Ethernet cable that connects your modem/router to the internet will do it. Or powering down your router. Then say something like "Alexa, what is the temperature?" Sure enough, your device will wake up (because it detected the wake word locally), but instead of telling you the temperature, it will tell you that it doesn't understand, can't connect to the internet, or some other error message. Congratulations! You just proved that the device detects the wake word locally, just like Amazon said it does, in case you don't believe what Amazon says.

Now, can the device wake up on it's own without you saying the wake word? Sometimes. Say you have a TV going in the background and someone on the show says "Alexa". Yep, your device will wake up even though it was just the stupid TV set saying the wake word. I imagine the same thing would happen if you have a talkative parrot as a pet and the bird likes to say "Alexa". I have had a couple of cases where I said something similar to "Alexa" and the device mistook what I said as the wake word. This is infrequent. It happens maybe once every three months for me. Also, I have had one or two occurrences over several years of Alexa waking up in a dead silent household and start talking on her own - usually saying something like "I don't understand". This is very very rare, but it has happened to me. So yes, Alexa can and does accidentally wake up on very infrequent occasions. You know that Alexa has woken up and is listening and sending things over the internet because there is a blue ring that lights up on the Echo device. This blue light will come on after the wake word is recognized, indication that everything you say hence force will be sent up to Amazon over the internet. After a few seconds of (your) silence, the device stops sending stuff to the internet and the blue light turns off. If you never want the device to listen you can push a button to lock the microphone out. That renders the device useless, but hey, you can do that if you want. Push the button again to unlock the microphone.

Once the device has woken up, default behavior is to send your voice recording to Amazon over the internet for analysis and to generate a response. If you do not want your voice recording to go up to Amazon you can change the Alexa configuration (via the Alexa app) to "Not save voice recordings". What happens in this case is that your voice command is interpreted locally, on the device, and a text transcript of what you said is sent up to Amazon for analysis and response. At least this is what Amazon appears to say happens. I find it a little hard to believe that the cheap Echo devices can interpret and transcribe to text locally, but supposedly that is exactly what they do (optionally, if you say "Don't save voice recordings").

You can use the Alexa app to see the history of what you have done. By default, each entry shows what you asked/said, how Alexa responded, and includes a voice recording that you can listen to. Yes, you hear yourself speaking in the voice recording. In the case of "Do not save voice recordings" you will not have a voice recording to listen to - it's simply missing - but you can still READ what you said in the text transcript that is included in the entry. There is a setting in the Alexa app where you can tell it how long to save voice recordings. With the ultimate being "Do no save voice recordings at all". But even with this ultimate setting, Amazon still saves the text transcript. You can delete these saved transcripts manually, but it's a pain in the butt.

Alexa works just fine without being "trained" with your voice. But if you want, you can indeed train it. So if husband asked Alexa to "play my favorite playlist" it will play a different playlist than if wife said to "play my favorite playlist". This feature is called "Voice ID". Alexa not only recognizes what was said, she also recognizes who said it. This feature - the Voice ID - is what will stop working on March 28 if you do not allow Amazon to save voice recordings. In other words, after the 28th Alexa will only recognize what was said, but not who said it, UNLESS you allow Amazon to save voice recordings. In the past, if you tried to use a Voice ID feature with "Do not save voice recordings", it may or may not have worked. Usually "not". Amazon is changing that now, and instead of "may not work" it becomes "will not work". Evidently Alexa will no longer even try to match a voice to a person unless you allow Amazon to save recordings. In the past, Alexa would try ... but usually fail. So that's what's going to happen on the 28th. Nowhere near as big of a deal as some people are trying to make it.

Alexa has always sent things up over the internet. That's the only way Amazon can parse complex human language. Your privacy may indeed be compromised if Amazon saves voice recordings. But it is also compromised if Amazon saves text transcripts instead of voice recordings! Which they do! If this bothers you, do not use a voice assistant. And for that matter, do not use a smart TV, do not ride in a new car, or even allow guests into your house if they have smart phones with voice assistants (all smart phones do). All these things have the capability to record you and send a recording up to the internet. It doesn't even have to be in your house. Do not even casually speak to another person if that person has a smart phone on them. This pretty much means you cannot talk to anybody. But if you're going to ban voice assistant devices from your home because of privacy/security concerns, you are being a total hypocrite (or just ignorant) if you speak anywhere near someone with a smart phone in their pocket. Because that smart phone has a voice assistant in it, and you have no idea how the person you are talking to has configured it. They probably didn't even configure it at all - they just left it at default settings which are pretty much wide open. Chances are, they didn't even know you could configure it, or even worse - that it was even present on their smart phone in the first place.

One more thing to note - the Echo devices that implement Alexa have incredible hearing. I have six of them in my house, in different rooms, upstairs and downstairs. When we have an internet outage, and I will ask Alexa something in a normal quiet voice, all of these devices spread out over the house in different rooms and on different levels will start responding and saying the internet is out. Because the internet is how the group of them decide which one you were trying to talk to. I guess they compare the volume level they each heard to determine which one is the one you were trying to speak to. With no internet to allow this coordination, they all respond as individual entities. And the fact that just about the entire group responds during an internet outage shows you just how acute their hearing is.

One thing I would never do is hook up a security device to Alexa. You can actually get door locks that respond to Alexa voice control. That sounds really high tech, until somebody walks by your open front window and yells "Alexa, unlock front door". Yep, voice assistants can be a privacy/security nightmare. Unfortunately, you can't escape this nightmare simply by banning these devices from your home and then sitting there smugly saying "I'm good". You aren't. You are surrounded by listening devices throughout your day. Not just yours - other people's as well.

[Graham44]

Originally Posted by haertig

And for that matter, do not use a smart TV, do not ride in a new car, or even allow guests into your house if they have smart phones with voice assistants (all smart phones do). All these things have the capability to record you and send a recording up to the internet. It doesn't even have to be in your house. Do not even casually speak to another person if that person has a smart phone on them. This pretty much means you cannot talk to anybody. But if you're going to ban voice assistant devices from your home because of privacy/security concerns, you are being a total hypocrite (or just ignorant) if you speak anywhere near someone with a smart phone in their pocket. Because that smart phone has a voice assistant in it, and you have no idea how the person you are talking to has configured it. They probably didn't even configure it at all - they just left it at default settings which are pretty much wide open. Chances are, they didn't even know you could configure it, or even worse - that it was even present on their smart phone in the first place.

Unfortunately, you can't escape this nightmare simply by banning these devices from your home and then sitting there smugly saying "I'm good". You aren't. You are surrounded by listening devices throughout your day. Not just yours - other people's as well.

Oh I am definitely of the tin foil hat brigade and I'm not afraid to say that, big corp has proven time and again throughout the last what 100 years they can't be trusted so it would seem prudent to at least try and protect yourself from their snooping, but then again maybe not if it doesn't bother you, that's a decision everyone makes individually.

Saying someone is a hypocrite banning listening devices in their own home just because other people might have them on their person when you are out and about is just silly, A) this would mean whatever it picks up is something you are saying in public so therefore you can't reasonably expect privacy and B) You don't get to choose whether other people have these devices or not, when out in public you just assume they are around, C) It's not your device so you haven't signed up to anything so that device doesn't know who you are.

It's an interesting time at the moment, 20 - 30 years ago people would question regularly why businesses wanted information, if you went into a store and signed up for something it wasn't uncommon for people to say why do you need this or that information, or it would say on the form this information is optional (there's always been those that have been happy to give out their information willy nilly of course) but now it seems people are tripping over each other to throw that information at some of the biggest and least trustworthy corporations on the planet, because a little black box with a shiny light asks them too.

As I said if that makes me a tinfoil hat wearer I don't mind and if what I think is wrong then no ham done, but if I there's any truth to what I (and lots of others) suspect then that could be a huge problem for lots of people.

Just to complete my tin foil hat persona in peoples eyes; I don't own or have in the house; a smart phone, smart watch, smart speaker or smart tv don't use Google, Amazon or Apple, have an older car with no AI or tech (apart from a CD player) and I use Linux with robust anti tracking implemented

[haertig]

Originally Posted by Graham44

...whatever it picks up is something you are saying in public so therefore you can't reasonably expect privacy...

If I am talking to someone alone, separate from others, even if it is in a publicly accessible area - say a city park for example - I certainly expect that conversation to be private. Don't you?

Years ago, I had banned Alexa from my home. Same thinking as you and others. But then I started thinking a little harder - what do I say around my house that is sensitive? I don't go about spouting off my social security number, logins and passwords, and stuff like that. And I thought more about what exactly would be transferred over the internet. And I came to the conclusion that no, Alexa is not listening and transmitting all the time. It is paranoid to believe that. Yes, she will transmit over the internet when you wake up the device and ask it something. But most people would know not to wake up the device and tell it their social security number. Just like those same people would know not to type in and do a Google search on their social security number. When interacting with Alexa and having conversations transmitted over the internet (in voice or transcribed form), the majority of people are probably asking about the weather, the time, setting wake up alarms, asking how long to cook a pot roast, and mundane things like that. If you're planning on talking with Alexa about more sensitive stuff than that, I agree, you might want to re-think getting an Alexa device.

Anyway, that's my personal decision. And this decision to finally own Alexa devices was made after many years of banning them myself. I was exactly where you are now at one time in the past. I don't know if where I am now is better or worse than back then, but it's where I am now. I guess Amazon just gets to know that I wasn't aware of how long to cook a pot roast in my Instant Pot a few days ago. I hope them now knowing that I had to ask that question benefits them in some way. The answer is 22.5 minutes per pound, set at high pressure, BTW. Alexa told me that is what the Instant Pot company recommends for large cuts of beef. (IMHO, I have now exposed my lack of knowledge on pressure cooker pot roast cooking to a wider audience in this MobileRead post than Alexa will ever do.)

I don't discount people wanting to protect their privacy. I am the same. But the often stated warning that "Alexa is listening all the time and transmitting everything over the internet" is just a false attempt to spread FUD. Although the people spreading it are probably not malicious and are most likely where they are because they fell for the FUD themselves. Like I said, I was there at one time myself, so I understand the thinking 100%.

[JSWolf]

Originally Posted by Uncle Robin

That was the inspiration for my choice of title, then I decided to delight any old-school pedants instead.

But you have a grammatical error in the title. It should read Alexa AI - all your Echo data is ours.

[JSWolf]

Don;t forget the South Park Alexa episode.

https://www.theverge.com/2017/9/16/1...xa-google-home

[JSWolf]

Originally Posted by haertig

I don't discount people wanting to protect their privacy.

If you want a sense of privacy, get off the Internet. But in reality, there is no such thing as true privacy. IMHO, people wanting privacy means they are paranoid and/or have something to hide.

[haertig]

Anyone here use Gmail? Or probably any of the other "free" email providers? If you do, you should probably refrain from bringing up privacy concerns to other people.

Yeah, I use Gmail for some things. Not my personal email account though. For example, I use a Gmail account when I sign up for forums (like this one) that require an email address. I also use Gmail when I purchase something online and have to give the retailer an email address. So there are indeed valid uses for privacy-killing free email addresses. One of those uses is to be a spam-sucker account that you don't have to worry much about giving out to potential spammers. I do look for and read/respond to certain emails that come into this Gmail account (the ones that I am expecting to receive). But most of the crap that eventually accumulates is ignored (actually, immediately sent to the trash by filters, before I even see it with my own eyes).

[JSWolf]

Originally Posted by haertig

Anyone here use Gmail? Or probably any of the other "free" email providers? If you do, you should probably refrain from bringing up privacy concerns to other people.

Yeah, I use Gmail for some things. Not my personal email account though. For example, I use a Gmail account when I sign up for forums (like this one) that require an email address. I also use Gmail when I purchase something online and have to give the retailer an email address. So there are indeed valid uses for privacy-killing free email addresses. One of those uses is to be a spam-sucker account that you don't have to worry much about giving out to potential spammers. I do look for and read/respond to certain emails that come into this Gmail account (the ones that I am expecting to receive). But most of the crap that eventually accumulates is ignored (actually, immediately sent to the trash by filters, before I even see it with my own eyes).

Gmail is one of the best email servers for spam. I does an excellent job of catching spam and not valid email. I would say it's more then 99% accurate but not 100%. I moved to Gmail a good while ago so I would never again have to sort out the problem of changing an email address. I do use Gmail and I've never had a problem with it. I also use outlook (email server).

If you want privacy, the Internet is not where you get it. How do you know your ISP email is private?

[haertig]

Originally Posted by JSWolf

How do you know your ISP email is private?

I don't. Which is why I never send anything even remotely sensitive or that I want kept private via email, or via a text message either, for that matter.

However, Gmail has admitted to scanning users email as a routine practice to harvest keywords for advertising use, while my ISP has not admitted to this practice. So there's that. But I agree, this doesn't prove that my ISP is not scanning emails. I know that Gmail IS scanning emails - they have said so themselves - so my email account there is relegated to the spam-sucker category.

Ironically, I do have encrypted email set up using a different Gmail account (but not many people to communicate with in an encrypted manner, unfortunately). However, I use end-to-end encryption that is totally out of Google's control. All encryption/decryption is done on the user end. By the time Google sees any emails they are already encrypted. Google of course knows WHO I send encrypted emails to and who sends them to me, because the email headers aren't encrypted (other than the Subject line). Unencrypted headers are necessary for the email to be delivered in the first place. But Google can't access the contents of those emails. I could use proxies and TOR for additional privacy but I don't consider that necessary for my needs. Google already knows the people I send encrypted emails to - they are the same people I send normal unencrypted emails to.

[Graham44]

Originally Posted by haertig

Anyone here use Gmail? Or probably any of the other "free" email providers? If you do, you should probably refrain from bringing up privacy concerns to other people.

Yeah, I use Gmail for some things. Not my personal email account though. For example, I use a Gmail account when I sign up for forums (like this one) that require an email address. I also use Gmail when I purchase something online and have to give the retailer an email address. So there are indeed valid uses for privacy-killing free email addresses. One of those uses is to be a spam-sucker account that you don't have to worry much about giving out to potential spammers. I do look for and read/respond to certain emails that come into this Gmail account (the ones that I am expecting to receive). But most of the crap that eventually accumulates is ignored (actually, immediately sent to the trash by filters, before I even see it with my own eyes).

I use Posteo, a German email provider, I swapped to them when I de-Googled myself. They seem pretty good. They aren't free but it's only a euro a month and they give you various ways to pay - bank transfer, cash!, paypal, credit card or voucher. They are an email provider focused on maximum privacy for their users. If anyone is looking for an alternative email provider I would recommend checking them out.

[Graham44]

Originally Posted by haertig

If I am talking to someone alone, separate from others, even if it is in a publicly accessible area - say a city park for example - I certainly expect that conversation to be private. Don't you?

I can see what you are saying, it's a conversation between two people not a group, but no I wouldn't have a private conversation or expect it to be in this sort of setting as anyone has the right to be within earshot of what you are saying (if using a normal volume of conversation)

I do expect privacy in my own home though and I don't hide the fact I do not trust big tech or their gadgets but equally I admit I could well be wrong in this thinking which is why I respect the fact that people like to have this sort of tech and use it and who believe it respects your privacy, they could well be right and I could be wrong, I just don't see any advantage, for me, in introducing something to where I live that I don't trust

[rcentros]

Originally Posted by Graham44

Oh I am definitely of the tin foil hat brigade and I'm not afraid to say that, big corp has proven time and again throughout the last what 100 years they can't be trusted so it would seem prudent to at least try and protect yourself from their snooping, but then again maybe not if it doesn't bother you, that's a decision everyone makes individually.

I'm with you on this. I'm not hiding anything, I just figure it's none of their damn business. If they want to use my data to make money, and I agree to give them permission to do this, pay me for it. I won't allow Alexa or the Google version or any of them in my house.

[theducks]

Originally Posted by rcentros

I'm with you on this. I'm not hiding anything, I just figure it's none of their damn business. If they want to use my data to make money, and I agree to give them permission to do this, pay me for it. I won't allow Alexa or the Google version or any of them in my house.

Technically you gave them permission when you agreed to the TOU.
Which was my gripe with folk who use those apps and I did not agree to their TOU.

Look at how many small businesses have a Gmail address