Amazon echo will upload everything

[novaphile]

"Give me six lines written by the most honest of men and I will find in them something with which to hang him."
With the current administration in the US, I want to give them as little ammunition as possible.

Am I too suspicious?

I always read that as:

"Give me six lines in someone's own hand, and I'll be able to forge their writing to incriminate them."

 

[theprestige]

"Give me six lines written by the most honest of men and I will find in them something with which to hang him."
With the current administration in the US, I want to give them as little ammunition as possible.

If things were as bad as you imagine, the boogeyman you're afraid of wouldn't need any ammunition at all.

Again, petabytes of data. Who's going to mine it to your detriment? What form would that detriment take?

 

[plague311]

If things were as bad as you imagine, the boogeyman you're afraid of wouldn't need any ammunition at all.

Again, petabytes of data. Who's going to mine it to your detriment? What form would that detriment take?

If they can't use it, and aren't mining anything from it, then why the ◊◊◊◊ do they need it?

 

[Darat]

If they can't use it, and aren't mining anything from it, then why the ◊◊◊◊ do they need it?

Because the current AI systems run on very high end hardware, often hundreds of graphic cards, so to use them at home your queries etc have to be uploaded to the AI’s hardware.

 

[theprestige]

If they can't use it, and aren't mining anything from it, then why the ◊◊◊◊ do they need it?

What "they" are you talking about? What use do you have in mind?

One of the "they" I'm talking about is Amazon. I assume they have a use for it, as a training corpus for their AI. I also don't see that as a detrimental or potentially detrimental use.

I think people worried that they're revealing private information that Amazon will use against them are jumping at shadows.

And I think that people worried that someone else will access these petabytes of audio data clandestinely, and mine it for harmful information, are also jumping at shadows.

Specifically, I think Blue Mountain indulges in absurd catastrophization, with their concern the Trump Administration will somehow get access to this data, and mine it to drum up a false accusation against someone.

 

[alfaniner]

What "they" are you talking about? What use do you have in mind?

One of the "they" I'm talking about is Amazon. I assume they have a use for it, as a training corpus for their AI. I also don't see that as a detrimental or potentially detrimental use.

I think people worried that they're revealing private information that Amazon will use against them are jumping at shadows.

And I think that people worried that someone else will access these petabytes of audio data clandestinely, and mine it for harmful information, are also jumping at shadows.

Specifically, I think Blue Mountain indulges in absurd catastrophization, with their concern the Trump Administration will somehow get access to this data, and mine it to drum up a false accusation against someone.

I think that is absolutely a valid concern. It is exactly the type of thing they would attempt if they had the opportunity, perhaps even legally. I wouldn't be surprised if they make a run at getting all of 23andMe's DNA data as well.

 

[theprestige]

I think that is absolutely a valid concern. It is exactly the type of thing they would attempt if they had the opportunity, perhaps even legally. I wouldn't be surprised if they make a run at getting all of 23andMe's DNA data as well.

Please be clear about what "they" you mean.

 

[alfaniner]

Please be clear about what "they" you mean.

Specifically the They I highlighted in your very quote, ffs.

 

[jeremyp]

I don't depend on mine but why should I stop using these stupid little devices that I find very helpful and useful day in, day out?

I'm more than happy that I may actually get the devices to live up to their marketed potential, I've found it very frustrating that the manufacturers have taken so long to start using the massive breakthroughs in AI we've experienced over the last few years.

Now if I had an option to use devices that could do all processing locally I would prefer that, but that would mean the devices would need to be a couple of grand each or have something like a local processing unit that costs a couple of grand and dumber devices that are connected to it.

To get the functionality I would like to see requires cloud processing at the moment.

I think you and ThePrestige are missing the point. It's absolutely fine that you want the functionality that comes with "AI" processing. There's no problem at all with that. Knock yourselves out.

However, some people do not want the AI nonsense and do not want all of the audio from their house uploaded to Amazon. There is apparently an option in Amazon Echo to accommodate these people. However, Amazon has remotely changed the software so that these people's choices are being ignored. This is not cool.

 

[plague311]

What "they" are you talking about? What use do you have in mind?

One of the "they" I'm talking about is Amazon. I assume they have a use for it, as a training corpus for their AI. I also don't see that as a detrimental or potentially detrimental use.

I was also talking about Amazon. I also knew what they were using it for as I specifically said it in my post. While you might not see it as detrimental, potential or otherwise, that isn't a view shared by everyone. Shocking, isn't it? People disagree with you.

I think people worried that they're revealing private information that Amazon will use against them are jumping at shadows.

Why? Based on what? Define "use against them", because that's not what I was implying at all, although that doesn't mean it's out of the realm of possibilities.

And I think that people worried that someone else will access these petabytes of audio data clandestinely, and mine it for harmful information, are also jumping at shadows.

Yeah, who would have ever thought that a hacker would acquire vast, vast amounts of information and then mine through it to find usable information? Or better yet, just release it to the public to see what comes out of it. That ◊◊◊◊ happens all of the time. Hell, Amazon itself was just ◊◊◊◊◊◊◊ hacked within the last 6 months. If you think it's "jumping at shadows" then I hope other people don't follow you for personal digital security advice.

Specifically, I think Blue Mountain indulges in absurd catastrophization, with their concern the Trump Administration will somehow get access to this data, and mine it to drum up a false accusation against someone.

Why wouldn't they? Musk has a history of bowing to foreign governments, why wouldn't Bezo's do the same? He's already helped fund his inauguration while the WaPo is hemorrhaging subscribers because of Bezo's new direction of kissing Trump's ass.

Give me one solid reason why this wouldn't or couldn't happen? What's stopping it? Is there some legal standard as to why?

 

[theprestige]

Specifically the They I highlighted in your very quote, ffs.

The Trump administration doesn't need to gain access to petabytes of Amazon's audio data, and mine it, to drum up false accusations against people. If that's what they wanted to do, they'd just do it out of whole cloth. Much easier.

Or they'd just do it through ECHELON. Also much easier. So yeah, let's see if they do it with systems and data they actually have legal authority over, before we start panicking that they might do it with Amazon's data.

 

[Gord_in_Toronto]

does alexa listen all the time

I think you and ThePrestige are missing the point. It's absolutely fine that you want the functionality that comes with "AI" processing. There's no problem at all with that. Knock yourselves out.

However, some people do not want the AI nonsense and do not want all of the audio from their house uploaded to Amazon. There is apparently an option in Amazon Echo to accommodate these people. However, Amazon has remotely changed the software so that these people's choices are being ignored. This is not cool.

Do you have any evidence that Alexa is collecting audio when it is "Off"?

From what I understand^TM it is trivially easy for someone with a modicum of knowledge to sniff the traffic outgoing from an internet connection. For details just do your own Google for "managed switch" and Wireshark.

If Alexa was snooping, I would expect to see a report or two. Thus my request.

 

[plague311]

does alexa listen all the time

If it doesn't then it's kind of ◊◊◊◊◊◊◊ useless, isn't it? The device listens to everything until it's specifically addressed and then given an action to take.

Do you have any evidence that Alexa is collecting audio when it is "Off"?

Do you mean "asleep" because if you're going to shut it off that makes it rather useless.

From what I understand^TM it is trivially easy for someone with a modicum of knowledge to sniff the traffic outgoing from an internet connection. For details just do your own Google for "managed switch" and Wireshark.

Well, it's not. A standard "managed switch" only monitors where traffic is going from hop to hop and doesn't even know, or care, where traffic is going when it leaves that specific switch. It doesn't have to know since it's not relevant to a switch's job. A switch receives a packet, looks at it's routing information and sends it to the next hop. It might keep basic info like destination address if it's layer 3, but most of the time that's not the case. That's also not to mention that the majority of households don't have managed switches since they cost significantly more and the bulk of the population has no idea how to configure them.

If you think wireshark is "trivially easy for someone with a modicum of knowledge" then I'd suggest finding a laymen to use it and tell me how it goes. The ISO and TCP\IP stacks aren't exactly common knowledge or easy to pick up on for the standard user.

If Alexa was snooping, I would expect to see a report or two. Thus my request.

Amazon's official statement is that the Alexa is always listening but only for it's "wake word". It doesn't record anything else until after it hears the wake word, if people find that reassuring I guess. It doesn't to me, but if people are ok with it then they should use them.

 

[Gord_in_Toronto]

If it doesn't then it's kind of ◊◊◊◊◊◊◊ useless, isn't it? The device listens to everything until it's specifically addressed and then given an action to take.


Do you mean "asleep" because if you're going to shut it off that makes it rather useless.


Well, it's not. A standard "managed switch" only monitors where traffic is going from hop to hop and doesn't even know, or care, where traffic is going when it leaves that specific switch. It doesn't have to know since it's not relevant to a switch's job. A switch receives a packet, looks at it's routing information and sends it to the next hop. It might keep basic info like destination address if it's layer 3, but most of the time that's not the case. That's also not to mention that the majority of households don't have managed switches since they cost significantly more and the bulk of the population has no idea how to configure them.

If you think wireshark is "trivially easy for someone with a modicum of knowledge" then I'd suggest finding a laymen to use it and tell me how it goes. The ISO and TCP\IP stacks aren't exactly common knowledge or easy to pick up on for the standard user.


Amazon's official statement is that the Alexa is always listening but only for it's "wake word". It doesn't record anything else until after it hears the wake word, if people find that reassuring I guess. It doesn't to me, but if people are ok with it then they should use them.

Whatever you say. I do not claim to be any sort of expert in the collection and analysis of internet data. But there are people who are.

It is possible to continuously monitor the traffic from an Alexa device. Nothing I have seen anywhere says that Aexa is sending any data until it is woken up. Then data is sent. After Alexa finishes responding it stops sending data.

Show me where I am wrong.

Show me anywhere anyone in the security business has shown otherwise. This would be a big security issue if it were true.

 

[plague311]

Whatever you say. I do not claim to be any sort of expert in the collection and analysis of internet data. But there are people who are.

It is possible to continuously monitor the traffic from an Alexa device. Nothing I have seen anywhere says that Aexa is sending any data until it is woken up. Then data is sent. After Alexa finishes responding it stops sending data.

Show me where I am wrong.

Show me anywhere anyone in the security business has shown otherwise. This would be a big security issue if it were true.

I'm not making the claim that it is so I'm not sure what you're asking me for. The change Amazon is making hasn't even gone into effect as of yet.

I also don't have any always-on listening devices in my house or I would wireshark up to them because I know for a fact that Alexa sends data more than only when it's activated. Every device does. Especially IoT devices. They, without prompt, download firmware for instance. Even with wireshark you can't tell what information they're sending, only that they're sending information. You can't see what the packets contain.

 

[Darat]

And they are also doing two way traffic, my Alexa device will play a ping sound when I have a notification from Amazon.

ETA: and this where I’d like to see the latest AI agents get to work, I’d like it to tell me unprompted when I am getting ready to go out (because I’ve told Alexa to stop playing the radio as I’m going out so it knows I am going out, be even better if it detected my tile tag attached to the car keys was moving so it would ask me if I am going out and do I want to stop the radio playing..) that the delivery driver is about 10 minutes away with my delivery if I want to wait or do you want to tell the delivery to use the safe space for the delivery. Plus also remind me that I’ve put a reminder in to call my mother at 4. And so on.

 

[Blue Mountain]

Whatever you say. I do not claim to be any sort of expert in the collection and analysis of internet data. But there are people who are.

It is possible to continuously monitor the traffic from an Alexa device. Nothing I have seen anywhere says that Aexa is sending any data until it is woken up. Then data is sent. After Alexa finishes responding it stops sending data.

Show me where I am wrong.

Show me anywhere anyone in the security business has shown otherwise. This would be a big security issue if it were true.

As Gord noted, is possible to continuously monitor traffic on a network. But in practice, encryption renders packet sniffing much less useful. You can see who is talking but not what they're saying. I don't have an Alexa, but if the device isn't encrypting the traffic over the internet between it and Amazon then it would be a sloppy design indeed.

While I'm by no means an expert on TLS (Transport Layer Security) I do have a decent understanding of how it works. The protocol is designed such that without the session keys one simply cannot decrypt the traffic. And recovering session keys is next to impossible due to the design of the Diffie-Hellman key exchange protocol.

It is possible to set up a man-in-the-middle (MITM) server that sends fake credentials to the target and thus gain control over the encrypted stream. I've done it myself. But not even this is not guaranteed to work, because one has to convince the target device to trust and then use the fake credentials. I can get my web browser to trust a fake certificate, because ultimately I have control over the list of certificates it trusts. But that level of control isn't available to casual users of the Alexa or any other Internet of Things device running a reasonably secure operating system.

In summary, I'm assuming the Alexa device encrypts all traffic between it and Amazon. Modern internet cryptography makes it well nigh impossible to decrypt that traffic. Monitoring the data stream will tell you that the Alexa is talking back and forth to Amazon and probably several other endpoints as well, and even that level of information can be used to make inferences as to what the device is up to. But they might as well be speaking in ancient Hittite for you won't understand a word of it.

 

[plague311]

In summary, I'm assuming the Alexa device encrypts all traffic between it and Amazon. Modern internet cryptography makes it well nigh impossible to decrypt that traffic. Monitoring the data stream will tell you that the Alexa is talking back and forth to Amazon and probably several other endpoints as well, and even that level of information can be used to make inferences as to what the device is up to. But they might as well be speaking in ancient Hittite for you won't understand a word of it.

That's why it's easier to attack the end points rather than the traffic. Sure there are plenty of rogue hotspots (I just watched a webinar on Wi-Fi pineapples, and man is credential harvesting getting easier). Stealing creds is all fine and well but the big money is in the databases. Steal a database and you can either throw a massive amount of processing power at breaking the encryption and then sell everything (this can take a few years though) or you can just sell the database itself.

That's why I'm saying if Amazon isn't being picky about what it's collecting, and things like false wake ups and ◊◊◊◊ like that are causing it to upload general conversation, then that is a privacy concern for me. It doesn't have to be for everyone else, but it is enough of a concern for me to to not want one in my house.

 

[Wudang]

And they are also doing two way traffic, my Alexa device will play a ping sound when I have a notification from Amazon.

ETA: and this where I’d like to see the latest AI agents get to work, I’d like it to tell me unprompted when I am getting ready to go out (because I’ve told Alexa to stop playing the radio as I’m going out so it knows I am going out, be even better if it detected my tile tag attached to the car keys was moving so it would ask me if I am going out and do I want to stop the radio playing..) that the delivery driver is about 10 minutes away with my delivery if I want to wait or do you want to tell the delivery to use the safe space for the delivery. Plus also remind me that I’ve put a reminder in to call my mother at 4. And so on.

Off the top of my head (ie may be daft) can IFTT do any of that?

As an aside, it's quite dated now, but the IBM TCP/IP redbook is (was?) a great reference. Last updated 2006. Shame they seem to have stopped that program.

https://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf

 

[Darat]

Yes but it's fiddly and can't cope with changing circumstances. The example scenario I created is what the marketing of the likes of IFTT and these devices sort of promise but they haven't been able to deliver until the recent batch of AI and AI agents, now they can and I don't have to program them, they can learn my routines, my preferences and start to make appropriate suggestions and take actions on my behalf.

Another example - when going out for a few hours I will get my devices to play Radio 4 at a low volume -some company for my dog but sometimes I forget. I want an assistant to notice if I've forgotten and do something, perhaps prompting me with a message saying, "are you out for some time, do you want me to switch on the radio for the dog?". Or after some learning it messages me and says "switched the radio on for the dog".