Google’s Nest fiasco harms user trust and invades their privacy(blog.malwarebytes.com)
blog.malwarebytes.com
Google’s Nest fiasco harms user trust and invades their privacy
https://blog.malwarebytes.com/security-world/2019/03/googles-nest-fiasco-harms-user-trust-and-invades-their-privacy/
18 comments
These companies want it both ways - they hide behind their terms of service etc. saying consumers should actually read this stuff and be inforned, and then when they get busted for failing to disclose something it’s “oops, our bad, we didn’t think anyone cared”
Are these Nest products sold worldwide? I recently worked on a product that included a microphone as an integral feature and we were told that in order to sell it worldwide we had to include a physical disable switch for the microphone in order to be able to sell it in multiple countries. Even though nobody who ordered the product would ever disable the microphone. How does Google get around selling their devices without even announcing there is a microphone in it?
I am quite convinced that consumers don't care all that much. I certainly am not. I trust Google not to fuck with stuff. When they do, I'll kick up a fuss.
The degree of "you should be panicking" around this is annoying to me.
The degree of "you should be panicking" around this is annoying to me.
Yeah, this doesn't seem like a big deal to me, and i haven't seen any outrage from actual customers of the product. All the outrage seems to be coming from bloggers who are taking this as justification for their existing "google is a privacy threat" stance.
I think that experience with abandonware will for long scare away regular people from all that IOT stuff.
My own position has for long been that all that IoTness needs to be "invisible," or otherwise it turns the thing into an annoying toy:
I've seen people throwing away their smart assistants already. A lot of people get quite surprised that the famed speaker is far more than just a speaker and tries to insert itself into your breakfast conversation. And those annoying, repeated "Internet connection failure," I think a few people threw them out just because of that.
My own position has for long been that all that IoTness needs to be "invisible," or otherwise it turns the thing into an annoying toy:
I've seen people throwing away their smart assistants already. A lot of people get quite surprised that the famed speaker is far more than just a speaker and tries to insert itself into your breakfast conversation. And those annoying, repeated "Internet connection failure," I think a few people threw them out just because of that.
There was a perfectly good reason for the microphone to be there, and there was a good reason why it wasn't mentioned (though it probably should have been). I'd hardly call the event "trust shattering".
I agree they were being dramatic, but Google still violated the trust of many people. Accidentally or not.
A product release in an established organization goes through legal checklist. It could have been one of those “our checklist for search, chrome, nest etc. can be same”. I am not defending nest. Just saying that sometimes these get bypassed, people move to other jobs, new folks come in, someone finds out and damage control begins.
We are at the last decades where privacy is somewhat possible. It is downhill from here.
Let's start with the obvious question - why all of those sensors require internet connection AND accounts. Seems absurd.
Cameras and microphones must come with physical switches to turn them off, not software switches.
The OpenBSD people implemented an interesting insight recently. Now a microphone attached to a OpenBSD system does not work by default. You need to actively turn on a sysctl as root to activate the microphone. So to get eavesdropping access on a default OpenBSD system you need to root the system, which makes that access somewhat harder to obtain.
The moral here is that microphone access should be treated differently than access to the rest of the audio system. You can get more protection through software than we normally get.
The moral here is that microphone access should be treated differently than access to the rest of the audio system. You can get more protection through software than we normally get.
Any software switches can be subverted by malware. But not physical ones. Physical switches and a light (like video cameras used to have when recording) are simple, cheap, and effective. I don't understand why companies don't add them to allay their customers' fears.
>“The on-device microphone was never intended to be a secret and should have been listed in the tech specs,” a Google spokesperson said. “That was an error on our part.”
I don't know, it sounds believable. Maybe they put it there "just in case", but didn't want to put it in the list of specifications because it had no software support, and having it there would've mislead customers who could've thought the microphone was functional software-wise.
I don't know, it sounds believable. Maybe they put it there "just in case", but didn't want to put it in the list of specifications because it had no software support, and having it there would've mislead customers who could've thought the microphone was functional software-wise.
It is believable. But that doesn't mean they shouldn't be reamed like crazy for it, including fines. There's a difference between "this was an act of god accident" and "we created the environment where this accident was allowed to happen".
Let me throw this at you. They shipped hardware with an incomplete spec sheet. Probably by accident. What's the probability that they ship software with incorrect behavior? Like, say, the software on the device? Software which could engage the microphone and send it to a remote server? At their scale, this is possible to mess up, with all of the abstraction layers and number of customers they're dealing with.
Google is the most careless company to ever reach the level of success that they have, possibly tied with Facebook. They need to be slapped, HARD, by some government, or else we'll never see the true institutional change necessary for a company of their power.
Let me throw this at you. They shipped hardware with an incomplete spec sheet. Probably by accident. What's the probability that they ship software with incorrect behavior? Like, say, the software on the device? Software which could engage the microphone and send it to a remote server? At their scale, this is possible to mess up, with all of the abstraction layers and number of customers they're dealing with.
Google is the most careless company to ever reach the level of success that they have, possibly tied with Facebook. They need to be slapped, HARD, by some government, or else we'll never see the true institutional change necessary for a company of their power.
They could have done what every console maker has been doing since the 80s. List the expansion port, say it’s for future use, and leave its use optional.
It's possible that google does it differently than other electronics devices manufacturers that I worked for, but I can't imagine someone putting something like this on device without some concrete plans on how it will be used.
The obvious reason for it existing is to serve as a glass breaking alarm, something that might have been part of the planned specs, and listed on the spec sheet, when they finalized the hardware design but they couldn't get working for launch. That's a very real feature people want their security systems to have, and forgetting to add "a disabled microphone, IMU, bluetooth and FM radios, and probably some other random chips privacy-obsessed people will care about" back onto the spec sheet is a really easy mistake to make, especially a few years ago when Nest mostly had user trust.
To be clear, I don't know exactly what chips modern electronics contain that we will worry about in a couple years, but all of the above seem like plausible things.
To be clear, I don't know exactly what chips modern electronics contain that we will worry about in a couple years, but all of the above seem like plausible things.
[deleted]
“Unexpectedly smart” and “hidden, software enable-able features” are both anti-features of security hardware.
I don’t think Google deserves the benefit of the doubt anymore: these untruths happen with every product, and they’re always in Google’s favor. There’s a consistent pattern of Google specifications, documentation, etc being knowingly untrue.
The only “error” is Google got caught deceiving people, again.
I don’t think Google deserves the benefit of the doubt anymore: these untruths happen with every product, and they’re always in Google’s favor. There’s a consistent pattern of Google specifications, documentation, etc being knowingly untrue.
The only “error” is Google got caught deceiving people, again.
What do you think was the secret nefarious purpose for this hardware?
To develop some opt-out feature in the future that will record audio as often as possible, activated by an update with this information hidden behind a long wall-of-text terms of service that nobody will read.
Nothing, I think it was hardware that was included because they might one day add a feature which used it, under the belief that customers would want that.
What I think is nefarious is not informing customers about that latent capability, because denying customers that information increased sales (eg, by not informing people who would be concerned by the mic).
A lie of omission for “good intentions” often is actually just denying the other person the information that they need to make an informed decision, for your own benefit.
That seems to be what Google did here.
What I think is nefarious is not informing customers about that latent capability, because denying customers that information increased sales (eg, by not informing people who would be concerned by the mic).
A lie of omission for “good intentions” often is actually just denying the other person the information that they need to make an informed decision, for your own benefit.
That seems to be what Google did here.
It may be true that Google no longer deserves the benefit of the doubt. The hyperbolic “every product” doesn’t help your case, though. Claiming that they engage in misleading behavior with every product, especially with no supporting evidence or examples, makes it look like you just have an axe to grind.
You are correct, let me list the Google services I’ve experienced deception from Google on:
YouTube, GMail, Google search, Google Docs, Google Drive, Google ads (both selling and buying), and GCP.
To me, that seems like every core product they offer, and so a little hyperbole is appropriate when calling out the misconduct of a gigacrime[0] syndicate.
It is, however, very HN to say I was too hyperbolic and mean to the gigacrime supyndicate.
[0] I mean this in the technical sense — I believe YouTube has committed over 1 billion acts of copyright infringement for profit, given that Google’s editorializing removes their safe harbor coverage. I believe other parts of Alphabet have similarly engaged in “scaled petty crime”.
Edit to footnote: I do want to say, I don’t think Google is unique in this category — and it should be taken partly as a criticism of corporate governance (particularly American), rather than Google in particular, that any business is allowed to operate that way.
YouTube, GMail, Google search, Google Docs, Google Drive, Google ads (both selling and buying), and GCP.
To me, that seems like every core product they offer, and so a little hyperbole is appropriate when calling out the misconduct of a gigacrime[0] syndicate.
It is, however, very HN to say I was too hyperbolic and mean to the gigacrime supyndicate.
[0] I mean this in the technical sense — I believe YouTube has committed over 1 billion acts of copyright infringement for profit, given that Google’s editorializing removes their safe harbor coverage. I believe other parts of Alphabet have similarly engaged in “scaled petty crime”.
Edit to footnote: I do want to say, I don’t think Google is unique in this category — and it should be taken partly as a criticism of corporate governance (particularly American), rather than Google in particular, that any business is allowed to operate that way.
You've just listed a bunch of services, in no way have you described how they use deceptive strategies in them.
The whole purpose of all these Google services is to collect private data. Very few people actually realize the scope and power of the data they are collecting and how it is used, and how they plan to use it when they will have the technical capability. If they would have it written out in clear text exactly what they do with this data, and what they can do with it in the future then nobody would use their services. Therefore all these services are deceptive.
Because I don’t care to.
It’s easy enough to Google literally any of them and read substantial numbers of articles on their practices:
For example, AdWords misrepresents clicks by slow rolling fraud mitigation and Google is quite deceptive about what various statistical measures and advertising practices actually deliver.
As another, YouTube has a quasi-DMCA process while feigning that it’s a safe harbor purveyor of information, while in fact maintaining an editorialized anthology. This quasi-DMCA process is frequently used to steal ad revenue from creators through acts of fraud which Google’s automated systems and lack of human support (intentionally) don’t mitigate.
It’s just not worth my morning to document all of it, because it’s literally a story a week for years. And a dozen stories a week for the past few years.
It’s easy enough to Google literally any of them and read substantial numbers of articles on their practices:
For example, AdWords misrepresents clicks by slow rolling fraud mitigation and Google is quite deceptive about what various statistical measures and advertising practices actually deliver.
As another, YouTube has a quasi-DMCA process while feigning that it’s a safe harbor purveyor of information, while in fact maintaining an editorialized anthology. This quasi-DMCA process is frequently used to steal ad revenue from creators through acts of fraud which Google’s automated systems and lack of human support (intentionally) don’t mitigate.
It’s just not worth my morning to document all of it, because it’s literally a story a week for years. And a dozen stories a week for the past few years.
I actually agree that it almost definitely wasn't something nefarious. But it speaks to a general lack of awareness of Nest's part about privacy and customer expectations - was there really no-one in a position of power who could have said "this is bad for customer trust"?
> While collecting data on users is nearly inevitable in today’s corporate world, secret, undisclosed, or unpredictable data collection—or data collection abilities—is another problem.
A smart-home speaker shouldn’t be secretly hiding a video camera. A secure messaging platform shouldn’t have a government-operated backdoor. And a home security hub that controls an alarm, keypad, and motion detector shouldn’t include a clandestine microphone feature—especially one that was never announced to customers.
This sounds too much like trying to move the overton window for me. If the next generation of smart devices is advertised as "no hidden cameras and microphones! (we'll just spy on you with the visible cameras and microphones)", I don't think this would be a win.
A smart-home speaker shouldn’t be secretly hiding a video camera. A secure messaging platform shouldn’t have a government-operated backdoor. And a home security hub that controls an alarm, keypad, and motion detector shouldn’t include a clandestine microphone feature—especially one that was never announced to customers.
This sounds too much like trying to move the overton window for me. If the next generation of smart devices is advertised as "no hidden cameras and microphones! (we'll just spy on you with the visible cameras and microphones)", I don't think this would be a win.
Agreed, but I would say the Overton Window was already way over there somewhere anyway.
The fact that they need to lay out why this might be wrong is mildly depressing.
The fact that they need to lay out why this might be wrong is mildly depressing.
>If the next generation of smart devices is advertised as "no hidden cameras and microphones! (we'll just spy on you with the visible cameras and microphones)", I don't think this would be a win.
Agreed but we have to consider that it's entirely plausible that we're in the minority in this line of thinking.
Agreed but we have to consider that it's entirely plausible that we're in the minority in this line of thinking.
True of course, but what specifically makes you think that?
I have said this before: the reason why people find a hidden camera much worse than a visible camera is simple. People aren’t dumb, they make trade-off choices. Of course they could spy on you with a visible camera, too. But either you know and don’t care and still buy the damn thing or you don’t. Knowing means in this case being able to make an informed decision. Not informing customers about a camera inside a home device feels like they don’t want you to consider this fact in your decision making...
I agree with you in principle, but I think the Nest actually only includes a hidden microphone, not a hidden camera.
Yep, it's "only" a microphone, but it's still an inexcusable breach of trust.
The breach of trust is bad enough, but the fact that it is a microphone opens the possibility of criminal wiretapping charges.
Well first of all this isn't a phone call so there's no chance at all of wiretapping charges regardless of any other circumstances. Second of all, the only potentially related charge would be something like eavesdropping and while that would vary by state, that would have required Google to actually use the microphone. If they didn't actually eavesdrop on anyone or design that in with the intent to eavesdrop on anyone then they haven't committed any kind of eavesdropping crime.
https://definitions.uslegal.com/e/eavesdropping/
https://definitions.uslegal.com/e/eavesdropping/
The rules for you and I are not the same rules for Google.
Even if the mic was never on?
Yes! Even if the gun to your head was never fired.
This is either stupid or dishonest.
A gun to your head is a threat of violence - that’s the criminal act. Threatening murder is a crime in itself.
The crime of wiretapping would be secretly listening/recording (and willfully so, not by accident as e.g. when baby monitors cross-talk). Having an inactive piece of hardware present, with no intention of using it for spying, is not a crime.
Having the hardware present is extremely unlikely to be nefarious. It could have been (a probably was) future-proofing. It could be a bundled package (unlikely I think for a mic, but you e.g. pretty much can’t buy cheap motion sensors without temp and luminosity bundled, so things like Philips Hue motion sensors measure temperature too).
A gun to your head is a threat of violence - that’s the criminal act. Threatening murder is a crime in itself.
The crime of wiretapping would be secretly listening/recording (and willfully so, not by accident as e.g. when baby monitors cross-talk). Having an inactive piece of hardware present, with no intention of using it for spying, is not a crime.
Having the hardware present is extremely unlikely to be nefarious. It could have been (a probably was) future-proofing. It could be a bundled package (unlikely I think for a mic, but you e.g. pretty much can’t buy cheap motion sensors without temp and luminosity bundled, so things like Philips Hue motion sensors measure temperature too).
I disagree strongly that characterisation of stupid and dishonest. Play ball. You didn't know about the gun to your head, are you ok with that? It was futureproofing in case you later might want the gun and we're claiming it's not loaded.
Yes gun to the head is the extreme example, that's the point. Not switching it on does not absolve you of guilt. Same thing here.
That is an entirely reasonable point of view and argument. If you really do find it stupid and/or dishonest reflect on that.
If there is no law against putting secret wire taps in people's houses "by mistake" and claiming it wasn't switched on there should be because ethically its a crime worthy of the Stasi. I would prefer if we didn't have a turnkey solution to creation of a facist state of the kind the soviets could only dream of. Perhaps you like the idea? Ah but "google wouldn't" So there's no need for law surrounding google because they just wouldn't. I know some of the engineers and no way would they allow that.
Democracy deserves better defence. Even if the gun to your head is never fired and you don't know about it. Criminal. If the law says otherwise, change it.
Now I wonder if there is something you would like to disclose about your vested interests? Perhaps not. I'm old enough to remember smart and kind people being Soviet apologists then finding out later something approximating the truth to their revulsion. You don't have to be on the take to be an apologist. But there is a lot of defence of big silicon valley companies behaving badly around here and very little "Disclosure, I work for.." going on.
Yes gun to the head is the extreme example, that's the point. Not switching it on does not absolve you of guilt. Same thing here.
That is an entirely reasonable point of view and argument. If you really do find it stupid and/or dishonest reflect on that.
If there is no law against putting secret wire taps in people's houses "by mistake" and claiming it wasn't switched on there should be because ethically its a crime worthy of the Stasi. I would prefer if we didn't have a turnkey solution to creation of a facist state of the kind the soviets could only dream of. Perhaps you like the idea? Ah but "google wouldn't" So there's no need for law surrounding google because they just wouldn't. I know some of the engineers and no way would they allow that.
Democracy deserves better defence. Even if the gun to your head is never fired and you don't know about it. Criminal. If the law says otherwise, change it.
Now I wonder if there is something you would like to disclose about your vested interests? Perhaps not. I'm old enough to remember smart and kind people being Soviet apologists then finding out later something approximating the truth to their revulsion. You don't have to be on the take to be an apologist. But there is a lot of defence of big silicon valley companies behaving badly around here and very little "Disclosure, I work for.." going on.
Many other Nest products, such as the Smoke alarm, doorbell and camera have microphones too. I agree that not disclosing that one was bad, but realistically if you have a Nest home, you probably have at least one microphone somewhere.
It also comes down to much you trust them that the microphone was disabled. If you don't, then you probably also shouldn't be carrying a smartphone with you either.
It also comes down to much you trust them that the microphone was disabled. If you don't, then you probably also shouldn't be carrying a smartphone with you either.
[deleted]
This is something I always ask people with those little "camera blockers" attached to their laptops: "How do you block the microphone?" and "Which is worse? Recording video of you all day, or recording audio of you all day?
It's not "would you rather be recorded in video or audio?", it's "would you rather be recorded in just audio, or in both video and audio?".
It's easy and quick to put some tape over the webcam, so unless you use it all the time, there's very little reason not to to so.
Disabling the microphone is harder and maybe not worth the effort.
It's easy and quick to put some tape over the webcam, so unless you use it all the time, there's very little reason not to to so.
Disabling the microphone is harder and maybe not worth the effort.
You crimp the internal microphone with a pair of pliers.
So how do I block the microphone on my MacBook?
Zuckerberg released a photo once where he had a piece of tape over the microphone hole on the size. I don't know what the effect is, but it would be easy to test.
It would muffle it slightly. It would still give an attacker perfectly usable sound.
The muffled sound is enough to prevent acoustic keylogging from working properly though.
https://www.davidsalomon.name/CompSec/auxiliary/KybdEmanatio...
https://www.davidsalomon.name/CompSec/auxiliary/KybdEmanatio...
That's a good point. I think it varies from person to person.
Part of my reason for blocking video is I can never figure out when videoconferencing tools will default to transmitting video, which I never want, before I have a way to turn it off.
Also, I don't think I'm a high profile enough target that somebody would bother sifting through everything I say in front of my laptop for something interesting.
Capturing images every minute or so and looking for something embarrassing (someone showing lots of skin) seems much easier for malware to automate.
Part of my reason for blocking video is I can never figure out when videoconferencing tools will default to transmitting video, which I never want, before I have a way to turn it off.
Also, I don't think I'm a high profile enough target that somebody would bother sifting through everything I say in front of my laptop for something interesting.
Capturing images every minute or so and looking for something embarrassing (someone showing lots of skin) seems much easier for malware to automate.
>I don't think I'm a high profile enough target that somebody would bother sifting through everything I say in front of my laptop for something interesting.
The threat model is closer to automated transcription, global history search, and parallel construction.
The threat model is closer to automated transcription, global history search, and parallel construction.
I am amazed at the general level of understanding regarding this sort of thing. People simply don't know enough, on average, to even make an informed decision about this stuff.
They think the FBI is gonna sit and watch or listen to a recording. They have no idea this is gonna sit as text in a database forever to be searched against later.
They think the FBI is gonna sit and watch or listen to a recording. They have no idea this is gonna sit as text in a database forever to be searched against later.
I think that would be hard to pull off in the US, where I live. There are enough paranoid infosec people that would spot the data transmission or CPU usage.
But certainly no harm done in muffling or ripping out a mic if you're concerned!
But certainly no harm done in muffling or ripping out a mic if you're concerned!
Why would anybody bother trying to hide traffic? Lots of apps already waste bandwidth and CPU to exfiltrate a wide variety of data, often sending it straight to Facebook[1]. They simply relabeled it "analytics",
[1] https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_...
[1] https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_...
Not if it’s intermittent / on-demand and hiding within existing traffic.
There are startups that automate listening to devices. See www.deepgram.com
Lenovo lets you order a ThinkPad with neither camera nor microphone, and USB webcams are small and fit easily in a bag or backpack.
My son worked in a chip fab for a couple of years. The only devices allowed in there must be certified to have no cameras, including phones. They issue modified phones with out working cameras to employees. All devices must have a big certification sticker on the back. Just thought it was interesting.
Plus if you know about it you can cover it over etc.
And get to question why they even need a camera to start with, before buying the product.
And get to question why they even need a camera to start with, before buying the product.
wait, that's even in question?
As long as "It's better to apologize later than to ask permission" is free or cheaper than doing the right thing, this is what we get.
I suspect this is going to be an unpopular opinion, but I still don't get the fuzz. People buy crap like Amazon echo left and right, and have been carrying little computers with microphones and an internet connection around all day for even longer. Apart from the fact that any sane person shouldn't trust any google product value their privacy in the first place, how many people are there consciously not buying a smartphone in fear of it being used to spy on them, then go buy this nest product and feel safe about it.
I might be an asshole for it and rightly so get down voted, but I really feel schadenfreude from this story. And maybe now some more people will learn their lesson. You can tell a toddler a dozen times that the stove is hot. They really only learn after they touched it once.
I might be an asshole for it and rightly so get down voted, but I really feel schadenfreude from this story. And maybe now some more people will learn their lesson. You can tell a toddler a dozen times that the stove is hot. They really only learn after they touched it once.
Couple of reasons why I think the fuzz is approp:
1. The fact that things are already bleak doesn't justify a more bleaker tomorrow. The fact that a large section of humanity is oblivious to privacy breaches doesn't mean the select few who do care about it should stop protesting against it, regardless of behaviour of the masses [0].
2. The law makers (governments) and the king makers (tech conglomerates) shouldn't be given a free-pass to do as they please at the expense of security, privacy, free-speech, and other ethos that make internet such a powerful medium. Policies needs to be continually renewed in response to emerging threats at pace [1] and so it is important to keep naming/shaming said entities to drive the dialogue.
--
[0] Bruce Schneier on Censorship, Surveillance, Propaganda, and User Control https://www.youtube.com/watch?v=m3NJ-Ow2Lvg
[1] Bruce Schneier, again, on Security of Everything https://www.youtube.com/watch?v=GkJCI3_jbtg
1. The fact that things are already bleak doesn't justify a more bleaker tomorrow. The fact that a large section of humanity is oblivious to privacy breaches doesn't mean the select few who do care about it should stop protesting against it, regardless of behaviour of the masses [0].
2. The law makers (governments) and the king makers (tech conglomerates) shouldn't be given a free-pass to do as they please at the expense of security, privacy, free-speech, and other ethos that make internet such a powerful medium. Policies needs to be continually renewed in response to emerging threats at pace [1] and so it is important to keep naming/shaming said entities to drive the dialogue.
--
[0] Bruce Schneier on Censorship, Surveillance, Propaganda, and User Control https://www.youtube.com/watch?v=m3NJ-Ow2Lvg
[1] Bruce Schneier, again, on Security of Everything https://www.youtube.com/watch?v=GkJCI3_jbtg
Fair points. And I didn't intend to say google should go unpunished for this, in case it came across as defending them.
Added those vids to my queue, thanks.
Added those vids to my queue, thanks.
little computers with microphones and an internet connection around all day for even longer
The difference is that we know our phones have microphones and cameras and internet.
The reason people are upset is because there was no way anyone would know they added an internet-connected microphone to their home with this device unless they opened it up and reverse engineered the firmware.
If anyone can prove that these microphones were turned on without the owner’s consent — even just for “telemetry” or “quality assurance” — then criminal charges will follow.
The difference is that we know our phones have microphones and cameras and internet.
The reason people are upset is because there was no way anyone would know they added an internet-connected microphone to their home with this device unless they opened it up and reverse engineered the firmware.
If anyone can prove that these microphones were turned on without the owner’s consent — even just for “telemetry” or “quality assurance” — then criminal charges will follow.
> The difference is that we know our phones have microphones and cameras and internet.
The question is, does that really matter? Isn't that just something you tell yourself to feel like you're still in control, ahead of the game? I have two colleagues who in general are pretty concerned with privacy, data protection etc. but still bought an echo. Then countered my surprise with the same argument: at least I know it's listening and how it works! Like somehow, that knowledge makes you immune to the Problem. In reality, you don't suddenly behave differently at home. You won't think twice before saying something. You just managed to fool yourself enough to deal with that cognitive dissonance.
And I'm all for charges against google here, I mean I dislike them more every day because of something they did, including this story. It's just funny that some people still think you can trust them in any way.
The question is, does that really matter? Isn't that just something you tell yourself to feel like you're still in control, ahead of the game? I have two colleagues who in general are pretty concerned with privacy, data protection etc. but still bought an echo. Then countered my surprise with the same argument: at least I know it's listening and how it works! Like somehow, that knowledge makes you immune to the Problem. In reality, you don't suddenly behave differently at home. You won't think twice before saying something. You just managed to fool yourself enough to deal with that cognitive dissonance.
And I'm all for charges against google here, I mean I dislike them more every day because of something they did, including this story. It's just funny that some people still think you can trust them in any way.
> The question is, does that really matter?
I absolutely think it does.
I have also bought an Amazon Echo, but I unplug it when it's out of use for extended periods of time.
I wouldn't purchase a similar product from Facebook, because I trust Amazon with my personal data more than Facebook.
I've never purchased a Smart TV that contains a microphone.
Just because I make some decisions you disagree with in balancing my privacy and convenience trade-offs doesn't mean I should be prevented from making those decisions at all.
I absolutely think it does.
I have also bought an Amazon Echo, but I unplug it when it's out of use for extended periods of time.
I wouldn't purchase a similar product from Facebook, because I trust Amazon with my personal data more than Facebook.
I've never purchased a Smart TV that contains a microphone.
Just because I make some decisions you disagree with in balancing my privacy and convenience trade-offs doesn't mean I should be prevented from making those decisions at all.
I have also bought an Amazon Echo, but I unplug it when it's out of use for extended periods of time.
I was given a Google Home for Christmas, and won't even take it out of the box. I'd give it away, but that not really solving the problem.
I've never purchased a Smart TV that contains a microphone.
My LG has one in the remote control. But I disallowed the TV from my home wifi about a year ago. I don't trust LG, and looking through the 53 screens of Terms of Service LG thinks need to agree to just to watch TV, I probably did the right thing.
I was given a Google Home for Christmas, and won't even take it out of the box. I'd give it away, but that not really solving the problem.
I've never purchased a Smart TV that contains a microphone.
My LG has one in the remote control. But I disallowed the TV from my home wifi about a year ago. I don't trust LG, and looking through the 53 screens of Terms of Service LG thinks need to agree to just to watch TV, I probably did the right thing.
> I'd give it away, but that not really solving the problem.
This implies that your moral judgement must apply to whoever you gave it to. Why?
This implies that your moral judgement must apply to whoever you gave it to. Why?
> I have also bought an Amazon Echo, but I unplug it when it's out of use for extended periods of time.
I'd buy an Echo if it had a physical switch to enable the microphone, along with a light that says its on. Software switches are worthless.
I'd buy an Echo if it had a physical switch to enable the microphone, along with a light that says its on. Software switches are worthless.
I power my echo through a smart plug. Works great... assuming there isn't a hidden mic in the plug. :D
Yes it does matter. I have camera covers for my phone and laptop. In terms of microphones I keep the phone and laptop away from me when I have conversations about politics. Call me paranoid but we know that the potential for listening in is there and I just don't know who is recording what. Remember that only two generations ago my German jew grandparents were put in camps. I don't live in a constant state of fear or anything like that, these precautions have just become habit.
> The question is, does that really matter?
Legally speaking, it really does matter (18 U.S.C. 2511(2)(d) [1]) [my emphasis]:
> It shall not be unlawful under this chapter for a person [...] to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception [...].
[1] https://www.law.cornell.edu/uscode/text/18/2511
Legally speaking, it really does matter (18 U.S.C. 2511(2)(d) [1]) [my emphasis]:
> It shall not be unlawful under this chapter for a person [...] to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception [...].
[1] https://www.law.cornell.edu/uscode/text/18/2511
You say that as if Silicon Valley is subject to the law in the same way as you or I.
They learned to pay off DC around when Microsoft was taken to the anti-trust woodshed.
Now they are beyond accountability. Especially once it's clear to everyone that they control election results to a wide degree.
They learned to pay off DC around when Microsoft was taken to the anti-trust woodshed.
Now they are beyond accountability. Especially once it's clear to everyone that they control election results to a wide degree.
That's not what he's saying. The section he is quoting is that if the user already consented to e.g. an Amazon Echo listening with a microphone then that's totally legal. Hence it does matter whether or not Google disclosed this to the end user although reading through the rest of that section there's nothing there that would implicate Google if they didn't actually use the microphone in some way. I'm not saying there isn't some law being broken here, but it isn't in 18 U.S. Code § 2511.
Of course it matters. How many consumers honestly knew that Nest was bought by Google?
I mean laughing and experiencing schadenfreude over someone planting a hidden and previously unknown microphone in ones home, is just weird man.
I mean laughing and experiencing schadenfreude over someone planting a hidden and previously unknown microphone in ones home, is just weird man.
The camera and microphone on a phone is severely limited by battery life (and your data plan). But one connected to the electric grid and LAN can run 24/7 without being noticed.
> People buy crap like Amazon echo left and right
People know the Amazon echo contains a microphone.
> have been carrying little computers with microphones and an internet connection around all day for even longer
People know that their phones contains a microphone.
Surely the difference of being able to make an informed choice is still significant?
> I might be an asshole for it and rightly so get down voted, but I really feel schadenfreude from this story
I don't understand the schadenfreude here. Because some people make privacy choices that you disagree with, then we should take pleasure when companies stop presenting a choice at all?
I guess I just fundamentally don't understand how you can equate the two categories of products together.
In one category people make a knowing choice. In the other category they do not, and the company has outright lied to them to prevent them from making a knowing choice.
People know the Amazon echo contains a microphone.
> have been carrying little computers with microphones and an internet connection around all day for even longer
People know that their phones contains a microphone.
Surely the difference of being able to make an informed choice is still significant?
> I might be an asshole for it and rightly so get down voted, but I really feel schadenfreude from this story
I don't understand the schadenfreude here. Because some people make privacy choices that you disagree with, then we should take pleasure when companies stop presenting a choice at all?
I guess I just fundamentally don't understand how you can equate the two categories of products together.
In one category people make a knowing choice. In the other category they do not, and the company has outright lied to them to prevent them from making a knowing choice.
I don't understand the shadenfreude either, but for the opposite reason. I think most people who have Nest products also are in the Google ecosystem, and are probably happy that they now have a Google Home for free.
Considering half of the other Nest products contain microphones already, I don't think anyone who truly is worried about this stuff would've gotten a Nest ecosystem to start with.
I agree, it's important to have all the facts so you can make informed decision, but this specific case has been way overblown, mostly by people who don't use Nest nor ever will. Almost anyone who's outraged probably would've never bought the product anyway.
Considering half of the other Nest products contain microphones already, I don't think anyone who truly is worried about this stuff would've gotten a Nest ecosystem to start with.
I agree, it's important to have all the facts so you can make informed decision, but this specific case has been way overblown, mostly by people who don't use Nest nor ever will. Almost anyone who's outraged probably would've never bought the product anyway.
What's the point of arguing who made the arguments, when we are debating how much validity do the arguments have.
> People buy crap like Amazon echo left and right, and have been carrying little computers with microphones and an internet connection around all day for even longer.
Consent. The difference is consent. You may get laid ten times a day for a week, but the time it happens without your permission is still a problem.
I have trouble believing folks that “don’t get this” aren’t being purposely obtuse. Consent isn’t that complicated an idea.
Consent. The difference is consent. You may get laid ten times a day for a week, but the time it happens without your permission is still a problem.
I have trouble believing folks that “don’t get this” aren’t being purposely obtuse. Consent isn’t that complicated an idea.
> Consent. The difference is consent. You may get laid ten times a day for a week, but the time it happens without your permission is still a problem.
Interesting choice of analogy.
Lets assume that you actually consented to your smartphone recording you at any time without telling you, and then google use that recording for whatever they like. That is most probably not true: you only want the mic to record you in very specific moments, and you also probably want to know exactly where any data that leaves your device is stored and how it's being used.
You have to trust google (or any other company who's app you gave permission to access the mic) to comply with this.
If you do, then the nest case shouldn't be an issue to you at all. You never consented to this mic being used for anything, so legally they can't use it for anything, and since you trust them in the smartphone case, you do here too. End of story.
If however you wouldn't even trust google with the mic in your smartphone, then why would you buy anything from them at all? "Oh it doesn't have a mic so they'd only abuse all the other data they can collect from it."
> I have trouble believing folks that “don’t get this” aren’t being purposely obtuse. Consent isn’t that complicated an idea.
Common sense isn't either. Google is evil, and not just since yesterday. I wouldn't even buy a Chromecast.
Interesting choice of analogy.
Lets assume that you actually consented to your smartphone recording you at any time without telling you, and then google use that recording for whatever they like. That is most probably not true: you only want the mic to record you in very specific moments, and you also probably want to know exactly where any data that leaves your device is stored and how it's being used.
You have to trust google (or any other company who's app you gave permission to access the mic) to comply with this.
If you do, then the nest case shouldn't be an issue to you at all. You never consented to this mic being used for anything, so legally they can't use it for anything, and since you trust them in the smartphone case, you do here too. End of story.
If however you wouldn't even trust google with the mic in your smartphone, then why would you buy anything from them at all? "Oh it doesn't have a mic so they'd only abuse all the other data they can collect from it."
> I have trouble believing folks that “don’t get this” aren’t being purposely obtuse. Consent isn’t that complicated an idea.
Common sense isn't either. Google is evil, and not just since yesterday. I wouldn't even buy a Chromecast.
The reason I think it’s news: I agree Google products are a privacy dumpster fire, and even think some people that bought the nest thingy agree.
The part that is news for me: Google is (inadvertently?) moving the bar of acceptable behavior to “we’ll plant microphones (and other surveillance hardware capabilities) in devices now, wait until you start relying on unrelated functionality, then totally issue a press release before we turn them on and start slurping your data.”
The part that is news for me: Google is (inadvertently?) moving the bar of acceptable behavior to “we’ll plant microphones (and other surveillance hardware capabilities) in devices now, wait until you start relying on unrelated functionality, then totally issue a press release before we turn them on and start slurping your data.”
If a stranger comes in your house uninvited and without your knowledge, what’s the big deal? You’ve let other people in your house, and your father in law is a terrible house guest!
>...how many people are there consciously not buying a smartphone in fear of it being used to spy on them...
I'd say that the number is relatively small to non-existent but that might have more to do with the fact that cell phones are more a requirement for day-to-day life than anything else.
For example, try to sign-up for paging services, as a means to replace your cellphone with a passive-only device, and see how far you can actually get with that idea.
Or try to buy a CRT-TV.[0]
At some point you have to concede that means to go against society's trends are no longer there, unless you make them yourself - and most people either don't have the resources nor the time or a combinations of either to do that.
[0] - https://www.amazon.co.uk/s/ref=lp_560864_nr_p_n_feature_thre...
I'd say that the number is relatively small to non-existent but that might have more to do with the fact that cell phones are more a requirement for day-to-day life than anything else.
For example, try to sign-up for paging services, as a means to replace your cellphone with a passive-only device, and see how far you can actually get with that idea.
Or try to buy a CRT-TV.[0]
At some point you have to concede that means to go against society's trends are no longer there, unless you make them yourself - and most people either don't have the resources nor the time or a combinations of either to do that.
[0] - https://www.amazon.co.uk/s/ref=lp_560864_nr_p_n_feature_thre...
try to sign-up for paging services, as a means to replace your cellphone with a passive-only device, and see how far you can actually get with that idea.
Pagers are still used in some industries, like healthcare, where people can die if a message doesn’t get through. Pagers are still more reliable than text messages and cell phones in many locations and especially inside large buildings like hospitals. Though the industry is switching.
Pagers are still used in some industries, like healthcare, where people can die if a message doesn’t get through. Pagers are still more reliable than text messages and cell phones in many locations and especially inside large buildings like hospitals. Though the industry is switching.
>Pagers are still used in some industries...
I never said that they weren't, yeah?
I suggested it being a difficult alternative because of the wide-spread use of cell phones. For example, in my country, the national paging system was taken down in August of 2011; so, there's no consumer paging services. B2B (which hospitals would be inclusive of) still exist, to be sure, but that means nothing in the overall scheme of a consumer trying to not buy a cell phone.
I never said that they weren't, yeah?
I suggested it being a difficult alternative because of the wide-spread use of cell phones. For example, in my country, the national paging system was taken down in August of 2011; so, there's no consumer paging services. B2B (which hospitals would be inclusive of) still exist, to be sure, but that means nothing in the overall scheme of a consumer trying to not buy a cell phone.
https://www.washingtonpost.com/news/the-switch/wp/2014/08/11...
"Why one of cybersecurity’s thought leaders [Dan Geer] uses a pager instead of a smart phone"
"Why one of cybersecurity’s thought leaders [Dan Geer] uses a pager instead of a smart phone"
>I suspect this is going to be an unpopular opinion, but I still don't get the fuzz. People buy crap like Amazon echo left and right
People are aware an Echo contains a microphone though.
For consent to be valid, it must be informed consent.
Keep in mind pretty much any sensor can be leveraged via court order, so it's valid for people to be upset they were unable to properly threat model due to a lack of information.
People are aware an Echo contains a microphone though.
For consent to be valid, it must be informed consent.
Keep in mind pretty much any sensor can be leveraged via court order, so it's valid for people to be upset they were unable to properly threat model due to a lack of information.
I believe that one reason it grinds people's gears is that it's symbolic of a larger problem. Dumping microphones in products and then having it not occur to you to even note the microphone in a spec represents a blind spot in how this company views privacy, and indicates how they take for granted the ability to add whatever sensors and capture hardware into their products with the purpose of collecting information about their customers - with or without their consent.
Does it really grind peoples gears? As in, new people who weren't upset with amazon echos, google homes, apple homepods, etc? Or is it just the same people that were up in arms about 'spy devices' being welcomed into peoples homes that are also up in arms about Nests having a microphone in them?
Some people want to receive what they pay for, nothing more, nothing less.
If you had a peanut allergy, wouldn't you want to know if the candy bar has peanuts?
If you had a peanut allergy, wouldn't you want to know if the candy bar has peanuts?
I agree. Remember Amazon's little dash buttons they sold to allow quick reordering of products? They contain a microphone. I'm pretty sure they didn't mention that in their public documents, and it never seems to have been used for anything except an ultrasonic pairing procedure with some iPhones, but it definitely exists. HN didn't get mad because Amazon has never claimed to be a morally good company, so they aren't the current corporate bogeyman.
It seems to me like disclosing when I sell a product all of the nefarious ways it could possibly be OTA updated is a little bit of an extreme position, given that even a simple accelerometer can be used to track you and sometimes record sound. In short, if you think a company is actively working against your well being, don't put anything they make in your house. Otherwise, don't worry.
They did? You are wrong, I find that equally concerning. I do make choices on electronics based on their hardware. I do not have any devices like he echo or homepod because I find them intrusive. Maybe you two don't but I definitely do. I have two devices with microphones and cameras connected to the internet as far as I know and I have taken the necessary precautions to ensure that those are safe. Now I have to open up my other Google products to check if they've been bugged. You bet your butt I'm a bit miffed.
"People" use Facebook and vote, but it's really not that simple now, is it?
There’s a difference between doing it knowingly vs unknowingly. In fact, that is the ONLY thing that matters.
But that's people bullshitting themselves. It's not like you suddenly behave differently in your own home once you got an echo dot. You basically know you just sold your privacy to amazon, but you tell yourself it's OK since you know about it, which somehow puts you on top of the game. It doesn't.
> But that's people bullshitting themselves.
No it's not. What Google did here was illegal. There are also people who value their privacy and don't have an Amazon echo or other listening device.
You're trying to argue that SOME people don't value their privacy so NO ONE should ever have an expectation that a device they buy isn't secretly listening in on them illegally. I fundamentally disagree with that take.
No it's not. What Google did here was illegal. There are also people who value their privacy and don't have an Amazon echo or other listening device.
You're trying to argue that SOME people don't value their privacy so NO ONE should ever have an expectation that a device they buy isn't secretly listening in on them illegally. I fundamentally disagree with that take.
I think yours is an important question that few people realize which is; these companies are legally required to tell you when they are listening to you, or even potentially listening to you.
Google "accidentally" forgot to tell people that they included a mic in those devices. That's still illegal.
Google "accidentally" forgot to tell people that they included a mic in those devices. That's still illegal.
Google admitted to congress they're constantly tracking people via their devices
>Hawley pointed out on Tuesday that a user's location is sent to Google hundreds of times a day, even when the phone is not in use. In fact, Hawley said, a user's location is tracked "every four minutes, or 14 times an hour, roughly 340 times during a 24-hour period," even when the phone is not in use.
>DeVries confessed that "location information is absolutely core to making a mobile phone work the way that you want it to work." He said that Google has an "optional service" called Location History that is opt-in and "can collect location over time when people turn that on."
>"But Google collects geolocation data even if Location History is turned off, correct?" Hawley pressed.
>"Yes, senator, it can in order to operate other services—"
This should be illegal and was admitted to congress -- justifying it with BS excuses -- but virtually no major media outlet is covering this.
https://pjmedia.com/trending/google-tracks-you-even-when-loc... (one of 3 articles I found about this)
>Hawley pointed out on Tuesday that a user's location is sent to Google hundreds of times a day, even when the phone is not in use. In fact, Hawley said, a user's location is tracked "every four minutes, or 14 times an hour, roughly 340 times during a 24-hour period," even when the phone is not in use.
>DeVries confessed that "location information is absolutely core to making a mobile phone work the way that you want it to work." He said that Google has an "optional service" called Location History that is opt-in and "can collect location over time when people turn that on."
>"But Google collects geolocation data even if Location History is turned off, correct?" Hawley pressed.
>"Yes, senator, it can in order to operate other services—"
This should be illegal and was admitted to congress -- justifying it with BS excuses -- but virtually no major media outlet is covering this.
https://pjmedia.com/trending/google-tracks-you-even-when-loc... (one of 3 articles I found about this)
This has been well-known for a while, so the story itself isn’t news.
(The fact that congress called them in to testify is news, since it means maybe some politicians are going to make noises about how unacceptable this is, or perhaps even introduce a bill.)
(The fact that congress called them in to testify is news, since it means maybe some politicians are going to make noises about how unacceptable this is, or perhaps even introduce a bill.)
It's not new news to me, but having a Google exec publically admit should be bigger news, in my opinion. In the testimony [0] he also positions Google's location service as something that's required for the phone to function and even make calls, which is untrue. Being a lawyer and apparently on Google's privacy counsel for a decade this may've been a disclosure on how deep the data-mining goes. These are the sort of details that should be pulled out and scrutinized by the media.
Unfortunately most of these news publications rely on things like Google's YT + Adsense for content distribution and revenue, so they may not want to anger their overlords. I also doubt anything will come out of this hearing -- people don't seem to care about privacy and they want convenience. Although this senator understands the privacy concerns, most of his peers are clueless.
https://www.youtube.com/watch?v=PwyuCtbK3qw
Unfortunately most of these news publications rely on things like Google's YT + Adsense for content distribution and revenue, so they may not want to anger their overlords. I also doubt anything will come out of this hearing -- people don't seem to care about privacy and they want convenience. Although this senator understands the privacy concerns, most of his peers are clueless.
https://www.youtube.com/watch?v=PwyuCtbK3qw
What happens if i created a device that has multiple speakers and through a software update I make one an (albeit)poor quality mic? Do I need to tell you before hand that this was possible? Are they still considered speakers?
Uh, yes? I don't think it's an open question that product updates should detail the updates made. And since recording someone in any way without their knowledge is illegal in many contexts, that would go double for something like you describe.
The point is that there are a million devices with speakers and we don't expect their manufacturers to disclose that it is possible to record us with them. As long as they are not actually doing it I don't see the big deal with the dormant microphone either.
They disclose the speaker. And I'm willing to bet the vast majority aren't wired to be an input device. Your comparison is a false equivalency.
Obviously that change would be made in order to use the new microphone capability, and of course that would require informing consumers when you’re using the mic and why.