I didn't wake up after the end of Media Center -- for streaming, do I need new TV?

[Fallen Kell]

But they're not actually recording before the wake word. I would think you'd know that.

These devices wait to hear a waveform that matches their wake word before they spring into action. Until that happens, they're not capturing anything for posterity. You just have to ask the police for proof. There have been a couple of cases where law enforcement demanded Echo voice data from Amazon, assuming they would have a recording of a possible murder... only to be disappointed as it turned out the speakers don't, in fact, record everything all the time.

The issue, as you noted, is that voice assistants occasionally mistake sounds for the wake word and capture unintended snippets. I'm glad companies offered more control over what happens with the data they review (Apple seems to be the best about it, since you can opt out entirely on setup), but I'll admit it's a mixed bag even if I know the recordings are anonymized and random. Ditto any visual information sent to improve AI; I don't think it's done in a way that can be seriously abused, but it's still the case that someone else might look at clips of your security cam or video doorbell footage.

However, I can't find instances where staff accessed specific users' Alexa/Assistant/Siri recordings... do you have links for that? I can see that Google fired someone in 2010 for listening to VoIP data, but that's clearly very different. The other reports I've seen haven't included voice assistant data.

The point is not that there's no potential for abuse; of course there is. It's that there's no evidence to support the dystopian fears some have. Amazon, Apple and Google are not recording everything you say, cackling with glee as they use your living room conversations to target ads and give free rein to stalkers. They aren't that malicious, and the technical requirements for doing this would very likely be impractical (massive amounts of storage and computational power to screen 24/7 recordings for hundreds of millions of people). As I like to put it: the truth is often far more boring than we want it to be.

Ok, so you really think companies who's main line of business is collecting data on people to then sell targeted ads to them is not going to collect data that you authorized them to collect so that they can look at it to better target ads to those people?

Amazon Echo’s privacy issues go way beyond voice recordings

Hey Alexa, who are you sharing my data with?

theconversation.com

https://www.washingtonpost.com/technology/2019/05/06/alexa-has-been-eavesdropping-you-this-whole-time/

Study Reveals Extent of Privacy Vulnerabilities With Amazon’s Alexa

Issues range from misleading privacy policies to post-approval changes in code.

news.ncsu.edu

Amazon fires more employees after breaching customer's privacy

Amazon has had to fire more employees for breaching customer's privacy. This time an employee gave your personal information to a third party.

www.komando.com

300 Apple employees fired for listening to Siri’s private recordings

Apple has terminated 300 employees in Ireland, for listening to more than a 1000 of its digitial assistant, Siri’s, audio recordings of people’s conversations, and even intimate moments. The Company recently issued an apology for its digital assistant sharing parts of its recordings with quality...

www.hrkatha.com

Siri voice recordings: Apple fires ‘hundreds’ of contractors over eavesdropping

Third-party workers were sent audio files containing ‘confidential information’

www.theweek.co.uk

Google fired 80 employees for abusing user data and spying on people, with some even sharing personal information outside the company, a new report says

Dozens of Google employees were fired between 2018 and 2020 for using internal tools to view personal user data, Vice's Motherboard reports.

www.businessinsider.com

Now these are just examples of people being fired for accessing the data or using it to stalk people who were caught by the internal monitors. Some of the above goes into the broad extent that the data is being shared and used by contractors. And some of the above shows how easy it is for someone to add a third-party connection to these devices that gives them access to the data. Many of these are doing EXACTLY what you say they are not doing, using these recording to listen into the living room conversations to better target ads. The technical requirements have been vastly dropping for doing this. Heck some of the companies tried to open up about what is being kept and gives you access to listen to the recordings, and you will be amazed with how much is there, and all of it can be used to target ads and train the algorithms.

 

[Commodus]

What do you think exists in that massive Data-Center in Utah, chump?

An NSA data collection center that still doesn't include non-stop recordings from smart home devices.

 

[mindless1]

I couldn't tell you if google is good at targeting ads from my searches, because I block practically all of them, but if I didn't... seems like a targeted ad would at least be something more interesting to me than something random or trending, or overpriced because the company spent boatloads on their advertising budget.

I take that back, I do still see the google placed search hit, ad text/links, but it's practically always what I was searching for anyway, like search for name of store I intended to browse to.

 

[Commodus]

Ok, so you really think companies who's main line of business is collecting data on people to then sell targeted ads to them is not going to collect data that you authorized them to collect so that they can look at it to better target ads to those people?

*snip for concision*

Now these are just examples of people being fired for accessing the data or using it to stalk people who were caught by the internal monitors. Some of the above goes into the broad extent that the data is being shared and used by contractors. And some of the above shows how easy it is for someone to add a third-party connection to these devices that gives them access to the data. Many of these are doing EXACTLY what you say they are not doing, using these recording to listen into the living room conversations to better target ads. The technical requirements have been vastly dropping for doing this. Heck some of the companies tried to open up about what is being kept and gives you access to listen to the recordings, and you will be amazed with how much is there, and all of it can be used to target ads and train the algorithms.

Never said that. I'm just saying that the claim of "they're recording everything you say, all the time" isn't supported by evidence, and that it's a serious stretch to think the companies are so sinister that they want to listen to your entire hi-how-was-work conversation in the off chance they can target some extra ads.

And it's positions like that which hurt the chances for a nuanced discussion about very real privacy problems. It should be possible to raise concerns about the privacy of voice clips without insisting that Amazon or Google is recording everyone 24/7. We should be pushing for stricter limits on employee access to data without painting the entire company as a bunch of cartoonish villains who'd sell their parents if it meant more ad revenue. We can't tackle the actual issues if we keep focusing on our worst fears.

 

[Red Squirrel]

It's very hard to buy a non smart TV now days, so I would try to make that TV last. I have a Samsung that's around 10 years old and it only has basic smart features, but it still works if not plugged into a network. I don't know about newer ones. It seems most products now days want you to make an account, use an app and other BS like that just to get to use it. So I would assume some smart TVs do this too, and you only find out once you open it and go to use it.

 

[mindless1]

^ My oldest LCD TV is a Samsung, as is my newest.

Yes I made (or really, already had because of my phone) a Samsung account, and it wanted me to use an app but it's really not necessary, but it blew me away when I saw how many free stream *channels*, integrated into the remote (I mean just press channel # or up/down channel buttons, no BS wading through menus to get to content) so it's not a PITA to use that.

Samsung's built in TV app, if I really had to, I could get away with just having the samsung free channels plus OTA plus internet sources, and internet obviously needed anyway for the samsung free streaming, or just Life In General.

Tizen OS though, I had no desire to add andriod apps, but Tizen has been rock solid stable while my last Android TV, far from it.

 

[BonzaiDuck]

Just dropping in here after starting this thread a year ago and replying once or twice.

This was a very interesting discussion about security in the "beam-me-up-Scotty!" cell-phone and mobile device age.

As I've posted in recent March-April 2023 threads, my LG Smart TV died. It's brain took over and did things, like raising the tv speaker volume all on its own. I just managed to get the carcass out the door and within 10 feet of my pickup truck to recycle it next saturday.

As I mentioned in the other recent threads, I'm going to recycle my ONKYO TX-NR616 AVR after the Sony replacement arrives Tuesday (4-11-23). I've tentatively subscribed to You Tube TV (and You Tube . . . and You Tube Music, apparently) but still in the 21-day free trial period.

I think the remark of another member that "corporations don't have time or money" to grab all your data and use it extensively is true. I don't use facebook or twitter, after my initial 2006 experience with facebook over the next few following years. And, frankly, I think social media is pretty insane, but it's also a security risk -- or it was. What good is twitter -- for making 140-word snap remarks? When I came on-board the computer-age in 1983, we wanted to make refined database searches effortlessly; we wanted to perform Box-Jenkins Time-Series analysis and other sophisticated statistical analyses.

So -- everything I have at risk per security threats is protected. The router has a hardware firewall; each computer has a firewall; I have Defender on all the computers and MalwareBytes on top of it, and MalwareBytes on my android tablets and phone. That leaves the HT equipment -- TV and the new Sony Receiver.

The problem with my Bravia "Google TV/Android" X85K is that there's no "Spectrum TV" app at the play store for it. I therefore need ROKU. OR -- I need to drop spectrum and use You Tube TV. Since we dropped Sling two months ago, that's $40 toward the subscriptiion price of You Tube. If I find some more cuts I can make, I may keep both You Tube and Spectrum.

But I sure as hell got a great deal on the Sony 5.1 AVR receiver, as I reported in another recent thread.

Final pronouncement: All this streaming availability is nice. No settop boxes, no need for cable unless you get your internet through the cable provider. But I began this HTPC journey long ago, and built it in DIY projects that all fit together and worked. Now, I'm not enthused about "DVR to the Cloud". I hate Spotify and Sirius subscription services. Well -- I don't hate them -- but they're leaks in the wallet. I want to think that I "possess" my music and that I "possess" my DVR captures. F___ Jack Valenti. People were recording TV to VCR for two or more decades, and now we have to believe that you must only have recordings that are managed by the provider. Screw that!

By the way. Many thanks to Tech Junky for linking that "Suppose.TV" site. It would seem to be a good way to search for streaming subscriptions that minimize subscription costs and maximize desired content. That's cool.

 

[Fallen Kell]

If you are worried about your internal network security, and you have decent network gear, I would suggest setting up a separate VLAN for your IoT devices (like your TV and receiver, etc., basically the things that have network connectivity but don't get frequent updates to patch security flaws.... as others have said, "the 'S' in 'IoT' is for security (there isn't any)"). This way the only things the IoT devices can see are the other IoT devices and route to the internet, protecting the rest of your environment since those devices can't reach the rest of your equipment.

 

[BonzaiDuck]

If you are worried about your internal network security, and you have decent network gear, I would suggest setting up a separate VLAN for your IoT devices (like your TV and receiver, etc., basically the things that have network connectivity but don't get frequent updates to patch security flaws.... as others have said, "the 'S' in 'IoT' is for security (there isn't any)"). This way the only things the IoT devices can see are the other IoT devices and route to the internet, protecting the rest of your environment since those devices can't reach the rest of your equipment.

If you have more advice, I encourage it.

I've got virus and firewall protection on all my PCs, tablets and cell-phone also protected. I need to look into VPN and what you are calling VLAN. It will require some effort of focus and patience as I come up to speed.

The TV, through my KODI app, is now accessing my server for DVR'd movies and other content. That's a weak spot in my Digital Fortress. And if I didn't say explicitly, I don't know of any protections for the TV's network access.

 

[Fallen Kell]

Even with most home routers, you can probably at least provide some level of protection to your TV. Some of this will depend on your gear, but for any router that supports IP tables, you can create a rule to prevent new remote connections from going to your TV from outside your network. Something like (assuming you have a default drop):

iptables -A INPUT -d <TV's IP address> -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -s <TV's IP address> -m state --state NEW,ESTABLISHED -j ACCEPT

The above basically says only allow an established connection to the TV, meaning the TV had to be the source of the initial connection. It won't fix everything, but it does prevent external connections from scanning and finding the TV and attempting to connect to the TV with normal methods. There are still some ways using UDP and reverse path packets (i.e. a custom built packet that will have the router send it back to it's "source" with the source spoofed to be the remote device they want it to reach). There are some other ways to help mitigate those, but they get more complex.

In anycase, the above is usually decent protection. It should still let you use the TV to reach youtube, amazon, netflix, etc... (allowing NEW connections on the outgoing traffic, but only ESTABLISHED on the incoming traffic). You can get more granular with whitelists/blacklists, but they take time to develop for each use case.