• Due to ongoing issues caused by Search, it has been temporarily disabled
  • Please excuse the mess, we're moving the furniture and restructuring the forum categories
  • You may need to edit your signatures.

    When we moved to Xenfora some of the signature options didn't come over. In the old software signatures were limited by a character limit, on Xenfora there are more options and there is a character number and number of lines limit. I've set maximum number of lines to 4 and unlimited characters.

Amazon echo will upload everything

Wudang

BOFH
Wudang
Joined
Jun 30, 2003
Messages
17,786
Location
People's Republic of South Yorkshire
Where's, "We pit a sniffer on our Internet connection and measured the traffic from the Echo to an Amazon IP address"? OTW. Poo!
 
About time is all I can say, hopefully Google will start this type of upgrading as well. It's about time their devices lived up to their marketing hype.
 
Ah. I was wondering what had happened to trigger my employer (a chain of hospitals and clinics) to issue a sudden order that nobody working from home could have an Alexa or such devices in the room they work. HIPAA violation.
 
plague311 said:
I've got a buddy that uses all open source stuff. It doesn't have the voice activation but most of it can be used from his phone. People need to stop depending on these stupid little devices.
Click to expand...
I don't depend on mine but why should I stop using these stupid little devices that I find very helpful and useful day in, day out?

I'm more than happy that I may actually get the devices to live up to their marketed potential, I've found it very frustrating that the manufacturers have taken so long to start using the massive breakthroughs in AI we've experienced over the last few years.

Now if I had an option to use devices that could do all processing locally I would prefer that, but that would mean the devices would need to be a couple of grand each or have something like a local processing unit that costs a couple of grand and dumber devices that are connected to it.

To get the functionality I would like to see requires cloud processing at the moment.
 
My cat just activated my Alexa. (I assume to order new boxes.)
My wake word is "Echo" -- if there's one change I'd like them to make it would be to create our own wake words. But the cat had let out a broken "meow" that sounded like "eee-oh" which I guess was close enough. Sometimes even the TV would activate it with the word or something that sounds like it. It's also happened when I had the clingy cat and I often had to tell it to "Let go!".
 
Darat said:
I don't depend on mine but why should I stop using these stupid little devices that I find very helpful and useful day in, day out?
Click to expand...

If the lack of privacy is worth the convenience for you then my comment wasn't aimed at you. I don't think it's a mystery to anyone as to why Amazon is doing this, and that's because they're making their own generative AI, or they're selling all of that data to someone who is making a generative AI.

I want my private conversations about my family and friends to be private. I don't need some device uploading my life just so I don't have to open my laptop to order ◊◊◊◊◊◊◊ ballpoint pens from Amazon, or flip a light switch, or open the garage door. I already have perfectly good analog devices that do all that ◊◊◊◊ for me that I have more control over.

As everyone in the IT world knows there's a scale for convenience vs. security. If the convenience is more important than you're security then rock on, but there's no ◊◊◊◊◊◊◊ way that things like passwords or usernames won't get caught up in this as those are conversations people have in their own home.
 
As I've said before, I don't want AI in my search telling me what I really want. My ex-wife ruined that for me. I want pseudoSQL that allows clauses to exclude results. My searches usually try to be fairly focused.
 
Wudang said:
As I've said before, I don't want AI in my search telling me what I really want. My ex-wife ruined that for me. I want pseudoSQL that allows clauses to exclude results. My searches usually try to be fairly focused.
Click to expand...
Even when shopping on Amazon I'd like to be able to check some boxes that say "Disregard these", rather than having to check all the boxes except one.
 
plague311 said:
If the lack of privacy is worth the convenience for you then my comment wasn't aimed at you. I don't think it's a mystery to anyone as to why Amazon is doing this, and that's because they're making their own generative AI, or they're selling all of that data to someone who is making a generative AI.

I want my private conversations about my family and friends to be private. I don't need some device uploading my life just so I don't have to open my laptop to order ◊◊◊◊◊◊◊ ballpoint pens from Amazon, or flip a light switch, or open the garage door. I already have perfectly good analog devices that do all that ◊◊◊◊ for me that I have more control over.

As everyone in the IT world knows there's a scale for convenience vs. security. If the convenience is more important than you're security then rock on, but there's no ◊◊◊◊◊◊◊ way that things like passwords or usernames won't get caught up in this as those are conversations people have in their own home.
Click to expand...
Good luck to anyone who wants to clandestinely mine petabytes of audio data, looking for my PII.

I already do substantial business with Amazon. What harm could they do to me, using my vocalizations as part of their AI training corpus? They already have my passwords, my credit cards, my home address, and decades of marketing and sales data about me.

"Hello. My name is. theprestige. My voice is my. Passport. Verify. Me."

Pull the other one. It's got an MD5 checksum.
 
Last edited:
theprestige said:
I already do substantial business with Amazon. What harm could they do to me, using my vocalizations as part of their AI training corpus? They already have my passwords, my credit cards, my home address, and decades of marketing and sales data about me.
Click to expand...

As I said, and maybe you missed, if it's worth it to you then by all means, knock yourself out. I don't like my data fed through a generative AI without any checks and balances, or even the ◊◊◊◊◊◊◊ option to opt out. If you don't, good for you.
 
alfaniner said:
My cat just activated my Alexa. (I assume to order new boxes.)
My wake word is "Echo" -- if there's one change I'd like them to make it would be to create our own wake words. But the cat had let out a broken "meow" that sounded like "eee-oh" which I guess was close enough. Sometimes even the TV would activate it with the word or something that sounds like it. It's also happened when I had the clingy cat and I often had to tell it to "Let go!".
Click to expand...

Hmm...

I always wondered why the Teletubbies greeted each other with: "Eh-Oh!"

They're communicating with Alexa!
 
theprestige said:
Good luck to anyone who wants to clandestinely mine petabytes of audio data, looking for my PII.

I already do substantial business with Amazon. What harm could they do to me, using my vocalizations as part of their AI training corpus? They already have my passwords, my credit cards, my home address, and decades of marketing and sales data about me.

"Hello. My name is. theprestige. My voice is my. Passport. Verify. Me."

Pull the other one. It's got an MD5 checksum.
Click to expand...
"Give me six lines written by the most honest of men and I will find in them something with which to hang him."
With the current administration in the US, I want to give them as little ammunition as possible.
 
Blue Mountain said:
"Give me six lines written by the most honest of men and I will find in them something with which to hang him."
With the current administration in the US, I want to give them as little ammunition as possible.
Click to expand...

Am I too suspicious?

I always read that as:

"Give me six lines in someone's own hand, and I'll be able to forge their writing to incriminate them."
 
Blue Mountain said:
"Give me six lines written by the most honest of men and I will find in them something with which to hang him."
With the current administration in the US, I want to give them as little ammunition as possible.
Click to expand...
If things were as bad as you imagine, the boogeyman you're afraid of wouldn't need any ammunition at all.

Again, petabytes of data. Who's going to mine it to your detriment? What form would that detriment take?
 
theprestige said:
If things were as bad as you imagine, the boogeyman you're afraid of wouldn't need any ammunition at all.

Again, petabytes of data. Who's going to mine it to your detriment? What form would that detriment take?
Click to expand...

If they can't use it, and aren't mining anything from it, then why the ◊◊◊◊ do they need it?
 
plague311 said:
If they can't use it, and aren't mining anything from it, then why the ◊◊◊◊ do they need it?
Click to expand...
Because the current AI systems run on very high end hardware, often hundreds of graphic cards, so to use them at home your queries etc have to be uploaded to the AI’s hardware.
 
plague311 said:
If they can't use it, and aren't mining anything from it, then why the ◊◊◊◊ do they need it?
Click to expand...
What "they" are you talking about? What use do you have in mind?

One of the "they" I'm talking about is Amazon. I assume they have a use for it, as a training corpus for their AI. I also don't see that as a detrimental or potentially detrimental use.

I think people worried that they're revealing private information that Amazon will use against them are jumping at shadows.

And I think that people worried that someone else will access these petabytes of audio data clandestinely, and mine it for harmful information, are also jumping at shadows.

Specifically, I think Blue Mountain indulges in absurd catastrophization, with their concern the Trump Administration will somehow get access to this data, and mine it to drum up a false accusation against someone.
 
theprestige said:
What "they" are you talking about? What use do you have in mind?

One of the "they" I'm talking about is Amazon. I assume they have a use for it, as a training corpus for their AI. I also don't see that as a detrimental or potentially detrimental use.

I think people worried that they're revealing private information that Amazon will use against them are jumping at shadows.

And I think that people worried that someone else will access these petabytes of audio data clandestinely, and mine it for harmful information, are also jumping at shadows.

Specifically, I think Blue Mountain indulges in absurd catastrophization, with their concern the Trump Administration will somehow get access to this data, and mine it to drum up a false accusation against someone.
Click to expand...
I think that is absolutely a valid concern. It is exactly the type of thing they would attempt if they had the opportunity, perhaps even legally. I wouldn't be surprised if they make a run at getting all of 23andMe's DNA data as well.
 
Darat said:
I don't depend on mine but why should I stop using these stupid little devices that I find very helpful and useful day in, day out?

I'm more than happy that I may actually get the devices to live up to their marketed potential, I've found it very frustrating that the manufacturers have taken so long to start using the massive breakthroughs in AI we've experienced over the last few years.

Now if I had an option to use devices that could do all processing locally I would prefer that, but that would mean the devices would need to be a couple of grand each or have something like a local processing unit that costs a couple of grand and dumber devices that are connected to it.

To get the functionality I would like to see requires cloud processing at the moment.
Click to expand...
I think you and ThePrestige are missing the point. It's absolutely fine that you want the functionality that comes with "AI" processing. There's no problem at all with that. Knock yourselves out.

However, some people do not want the AI nonsense and do not want all of the audio from their house uploaded to Amazon. There is apparently an option in Amazon Echo to accommodate these people. However, Amazon has remotely changed the software so that these people's choices are being ignored. This is not cool.
 
theprestige said:
What "they" are you talking about? What use do you have in mind?

One of the "they" I'm talking about is Amazon. I assume they have a use for it, as a training corpus for their AI. I also don't see that as a detrimental or potentially detrimental use.
Click to expand...

I was also talking about Amazon. I also knew what they were using it for as I specifically said it in my post. While you might not see it as detrimental, potential or otherwise, that isn't a view shared by everyone. Shocking, isn't it? People disagree with you.
theprestige said:
I think people worried that they're revealing private information that Amazon will use against them are jumping at shadows.
Click to expand...

Why? Based on what? Define "use against them", because that's not what I was implying at all, although that doesn't mean it's out of the realm of possibilities.
theprestige said:
And I think that people worried that someone else will access these petabytes of audio data clandestinely, and mine it for harmful information, are also jumping at shadows.
Click to expand...

Yeah, who would have ever thought that a hacker would acquire vast, vast amounts of information and then mine through it to find usable information? Or better yet, just release it to the public to see what comes out of it. That ◊◊◊◊ happens all of the time. Hell, Amazon itself was just ◊◊◊◊◊◊◊ hacked within the last 6 months. If you think it's "jumping at shadows" then I hope other people don't follow you for personal digital security advice.
theprestige said:
Specifically, I think Blue Mountain indulges in absurd catastrophization, with their concern the Trump Administration will somehow get access to this data, and mine it to drum up a false accusation against someone.
Click to expand...

Why wouldn't they? Musk has a history of bowing to foreign governments, why wouldn't Bezo's do the same? He's already helped fund his inauguration while the WaPo is hemorrhaging subscribers because of Bezo's new direction of kissing Trump's ass.

Give me one solid reason why this wouldn't or couldn't happen? What's stopping it? Is there some legal standard as to why?
 
alfaniner said:
Specifically the They I highlighted in your very quote, ffs.
Click to expand...
The Trump administration doesn't need to gain access to petabytes of Amazon's audio data, and mine it, to drum up false accusations against people. If that's what they wanted to do, they'd just do it out of whole cloth. Much easier.

Or they'd just do it through ECHELON. Also much easier. So yeah, let's see if they do it with systems and data they actually have legal authority over, before we start panicking that they might do it with Amazon's data.
 
does alexa listen all the time
jeremyp said:
I think you and ThePrestige are missing the point. It's absolutely fine that you want the functionality that comes with "AI" processing. There's no problem at all with that. Knock yourselves out.

However, some people do not want the AI nonsense and do not want all of the audio from their house uploaded to Amazon. There is apparently an option in Amazon Echo to accommodate these people. However, Amazon has remotely changed the software so that these people's choices are being ignored. This is not cool.
Click to expand...
Do you have any evidence that Alexa is collecting audio when it is "Off"?

From what I understandTM it is trivially easy for someone with a modicum of knowledge to sniff the traffic outgoing from an internet connection. For details just do your own Google for "managed switch" and Wireshark.

If Alexa was snooping, I would expect to see a report or two. Thus my request.
 
Gord_in_Toronto said:
does alexa listen all the time
Click to expand...

If it doesn't then it's kind of ◊◊◊◊◊◊◊ useless, isn't it? The device listens to everything until it's specifically addressed and then given an action to take.
Gord_in_Toronto said:
Do you have any evidence that Alexa is collecting audio when it is "Off"?
Click to expand...

Do you mean "asleep" because if you're going to shut it off that makes it rather useless.
Gord_in_Toronto said:
From what I understandTM it is trivially easy for someone with a modicum of knowledge to sniff the traffic outgoing from an internet connection. For details just do your own Google for "managed switch" and Wireshark.
Click to expand...

Well, it's not. A standard "managed switch" only monitors where traffic is going from hop to hop and doesn't even know, or care, where traffic is going when it leaves that specific switch. It doesn't have to know since it's not relevant to a switch's job. A switch receives a packet, looks at it's routing information and sends it to the next hop. It might keep basic info like destination address if it's layer 3, but most of the time that's not the case. That's also not to mention that the majority of households don't have managed switches since they cost significantly more and the bulk of the population has no idea how to configure them.

If you think wireshark is "trivially easy for someone with a modicum of knowledge" then I'd suggest finding a laymen to use it and tell me how it goes. The ISO and TCP\IP stacks aren't exactly common knowledge or easy to pick up on for the standard user.
Gord_in_Toronto said:
If Alexa was snooping, I would expect to see a report or two. Thus my request.
Click to expand...

Amazon's official statement is that the Alexa is always listening but only for it's "wake word". It doesn't record anything else until after it hears the wake word, if people find that reassuring I guess. It doesn't to me, but if people are ok with it then they should use them.
 
Last edited:
plague311 said:
If it doesn't then it's kind of ◊◊◊◊◊◊◊ useless, isn't it? The device listens to everything until it's specifically addressed and then given an action to take.


Do you mean "asleep" because if you're going to shut it off that makes it rather useless.


Well, it's not. A standard "managed switch" only monitors where traffic is going from hop to hop and doesn't even know, or care, where traffic is going when it leaves that specific switch. It doesn't have to know since it's not relevant to a switch's job. A switch receives a packet, looks at it's routing information and sends it to the next hop. It might keep basic info like destination address if it's layer 3, but most of the time that's not the case. That's also not to mention that the majority of households don't have managed switches since they cost significantly more and the bulk of the population has no idea how to configure them.

If you think wireshark is "trivially easy for someone with a modicum of knowledge" then I'd suggest finding a laymen to use it and tell me how it goes. The ISO and TCP\IP stacks aren't exactly common knowledge or easy to pick up on for the standard user.


Amazon's official statement is that the Alexa is always listening but only for it's "wake word". It doesn't record anything else until after it hears the wake word, if people find that reassuring I guess. It doesn't to me, but if people are ok with it then they should use them.
Click to expand...
Whatever you say. I do not claim to be any sort of expert in the collection and analysis of internet data. But there are people who are.

It is possible to continuously monitor the traffic from an Alexa device. Nothing I have seen anywhere says that Aexa is sending any data until it is woken up. Then data is sent. After Alexa finishes responding it stops sending data.

Show me where I am wrong.

Show me anywhere anyone in the security business has shown otherwise. This would be a big security issue if it were true.
 
Gord_in_Toronto said:
Whatever you say. I do not claim to be any sort of expert in the collection and analysis of internet data. But there are people who are.

It is possible to continuously monitor the traffic from an Alexa device. Nothing I have seen anywhere says that Aexa is sending any data until it is woken up. Then data is sent. After Alexa finishes responding it stops sending data.

Show me where I am wrong.

Show me anywhere anyone in the security business has shown otherwise. This would be a big security issue if it were true.
Click to expand...

I'm not making the claim that it is so I'm not sure what you're asking me for. The change Amazon is making hasn't even gone into effect as of yet.

I also don't have any always-on listening devices in my house or I would wireshark up to them because I know for a fact that Alexa sends data more than only when it's activated. Every device does. Especially IoT devices. They, without prompt, download firmware for instance. Even with wireshark you can't tell what information they're sending, only that they're sending information. You can't see what the packets contain.
 
And they are also doing two way traffic, my Alexa device will play a ping sound when I have a notification from Amazon.

ETA: and this where I’d like to see the latest AI agents get to work, I’d like it to tell me unprompted when I am getting ready to go out (because I’ve told Alexa to stop playing the radio as I’m going out so it knows I am going out, be even better if it detected my tile tag attached to the car keys was moving so it would ask me if I am going out and do I want to stop the radio playing..) that the delivery driver is about 10 minutes away with my delivery if I want to wait or do you want to tell the delivery to use the safe space for the delivery. Plus also remind me that I’ve put a reminder in to call my mother at 4. And so on.
 
Last edited:
Gord_in_Toronto said:
Whatever you say. I do not claim to be any sort of expert in the collection and analysis of internet data. But there are people who are.

It is possible to continuously monitor the traffic from an Alexa device. Nothing I have seen anywhere says that Aexa is sending any data until it is woken up. Then data is sent. After Alexa finishes responding it stops sending data.

Show me where I am wrong.

Show me anywhere anyone in the security business has shown otherwise. This would be a big security issue if it were true.
Click to expand...
As Gord noted, is possible to continuously monitor traffic on a network. But in practice, encryption renders packet sniffing much less useful. You can see who is talking but not what they're saying. I don't have an Alexa, but if the device isn't encrypting the traffic over the internet between it and Amazon then it would be a sloppy design indeed.

While I'm by no means an expert on TLS (Transport Layer Security) I do have a decent understanding of how it works. The protocol is designed such that without the session keys one simply cannot decrypt the traffic. And recovering session keys is next to impossible due to the design of the Diffie-Hellman key exchange protocol.

It is possible to set up a man-in-the-middle (MITM) server that sends fake credentials to the target and thus gain control over the encrypted stream. I've done it myself. But not even this is not guaranteed to work, because one has to convince the target device to trust and then use the fake credentials. I can get my web browser to trust a fake certificate, because ultimately I have control over the list of certificates it trusts. But that level of control isn't available to casual users of the Alexa or any other Internet of Things device running a reasonably secure operating system.

In summary, I'm assuming the Alexa device encrypts all traffic between it and Amazon. Modern internet cryptography makes it well nigh impossible to decrypt that traffic. Monitoring the data stream will tell you that the Alexa is talking back and forth to Amazon and probably several other endpoints as well, and even that level of information can be used to make inferences as to what the device is up to. But they might as well be speaking in ancient Hittite for you won't understand a word of it.
 
Last edited:
Blue Mountain said:
In summary, I'm assuming the Alexa device encrypts all traffic between it and Amazon. Modern internet cryptography makes it well nigh impossible to decrypt that traffic. Monitoring the data stream will tell you that the Alexa is talking back and forth to Amazon and probably several other endpoints as well, and even that level of information can be used to make inferences as to what the device is up to. But they might as well be speaking in ancient Hittite for you won't understand a word of it.
Click to expand...

That's why it's easier to attack the end points rather than the traffic. Sure there are plenty of rogue hotspots (I just watched a webinar on Wi-Fi pineapples, and man is credential harvesting getting easier). Stealing creds is all fine and well but the big money is in the databases. Steal a database and you can either throw a massive amount of processing power at breaking the encryption and then sell everything (this can take a few years though) or you can just sell the database itself.

That's why I'm saying if Amazon isn't being picky about what it's collecting, and things like false wake ups and ◊◊◊◊ like that are causing it to upload general conversation, then that is a privacy concern for me. It doesn't have to be for everyone else, but it is enough of a concern for me to to not want one in my house.
 
Darat said:
And they are also doing two way traffic, my Alexa device will play a ping sound when I have a notification from Amazon.

ETA: and this where I’d like to see the latest AI agents get to work, I’d like it to tell me unprompted when I am getting ready to go out (because I’ve told Alexa to stop playing the radio as I’m going out so it knows I am going out, be even better if it detected my tile tag attached to the car keys was moving so it would ask me if I am going out and do I want to stop the radio playing..) that the delivery driver is about 10 minutes away with my delivery if I want to wait or do you want to tell the delivery to use the safe space for the delivery. Plus also remind me that I’ve put a reminder in to call my mother at 4. And so on.
Click to expand...
Off the top of my head (ie may be daft) can IFTT do any of that?

As an aside, it's quite dated now, but the IBM TCP/IP redbook is (was?) a great reference. Last updated 2006. Shame they seem to have stopped that program.
 
Yes but it's fiddly and can't cope with changing circumstances. The example scenario I created is what the marketing of the likes of IFTT and these devices sort of promise but they haven't been able to deliver until the recent batch of AI and AI agents, now they can and I don't have to program them, they can learn my routines, my preferences and start to make appropriate suggestions and take actions on my behalf.

Another example - when going out for a few hours I will get my devices to play Radio 4 at a low volume -some company for my dog but sometimes I forget. I want an assistant to notice if I've forgotten and do something, perhaps prompting me with a message saying, "are you out for some time, do you want me to switch on the radio for the dog?". Or after some learning it messages me and says "switched the radio on for the dog".
 
You must log in or register to reply here.

Back
Top Bottom