Amazon Error Allowed Alexa User To Eavesdrop on Another Home (reuters.com) 91
A user of Amazon's Alexa voice assistant in Germany got access to more than a thousand recordings from another user because of "a human error" by the company. From a report: The customer had asked to listen back to recordings of his own activities made by Alexa but he was also able to access 1,700 audio files from a stranger when Amazon sent him a link, German trade publication c't reported. "This unfortunate case was the result of a human error and an isolated single case," an Amazon spokesman said on Thursday. The first customer had initially got no reply when he told Amazon about the access to the other recordings, the report said. The files were then deleted from the link provided by Amazon but he had already downloaded them on to his computer, added the report from c't, part of German tech publisher Heise.
Single case? (Score:5, Insightful)
"This unfortunate case was the result of a human error and an isolated single case," an Amazon spokesman said on Thursday.
"Why is this even possible?", internet users said on Thursday.
Re:Single case? (Score:5, Insightful)
Its possible because Amazon and others have convinced people its a great idea to have hot mic; under third party control in their homes.
Its possible because people are stupid.
Re:Single case? (Score:4, Interesting)
Its possible because Amazon and others have convinced people its a great idea to have hot mic; under third party control in their homes.
That's not even what I'm talking about. Why is it even possible for an Amazon employee to make these voice files available to other users through the interfaces available to them? It's understandable why the data is there, but not understandable why someone can make the files available to another user with a click. Even if it's done with a backdoored system, those files ought to be encrypted to the user.
Re:Single case? (Score:5, Insightful)
I think a better interpretation of your question should be, why do they have and keep these recordings? The conversation should have gone like this:
Customer: I'd like to listen to all of the recordings of my interactions with the Alexa device.
Acceptable answers:
Amazon: I'm sorry, we do not keep recordings of your interactions with our products.
or
Amazon: I'm sorry, all recordings are anonymized. We cannot access recordings by user, location, or time of recording because that information is not stored.
Re: (Score:2)
I think a better interpretation of your question should be, why do they have and keep these recordings?
A user who doesn't care if an always-listening device is in their house might well want access to recordings of everything they've ever said to it. Besides all the actual reasons, Amazon might also want to retain your voice samples for technical reasons; as a training corpus for future versions of their recognition engine, for example. But nobody wants their files to be able to be accidentally listened to by someone else...
Re: (Score:2)
Re: (Score:2)
Sure, but I'm guessing they do not need the users' account number, IP address, MAC address, or precise time of day to do that.
Every attempt to anonymize that data should be made. Full stop.
Best answer (Score:2)
Re: Single case? (Score:1)
Re: (Score:2)
The latter would be impossible. One of the features of Alexa is to learn your voice so that it can track your preferences, recent playlist, etc...
I agree that recordings shouldn't be easily accessible by any Amazon employee - or any random person for that matter. There should be solid procedures when it comes to the recordings, say anything over a week or two old gets archived somewhere, beyond 6 months is deleted. In order to retrieve recordings requires verification of identity and two-person integrity on
Re: (Score:2)
I knew you were asking how/why this can occur on a technical or process level. Clearly some bad engineering design choices from a security standpoint were made. My assumption would be 'requirements' around keeping the data useful and available for mining/analysis/sale now or in future resulted in a misfeature.
The core issue though is no amount of engineering is going to make a fundamentally bad idea into a good product. Its not smart to let someone company have this kind of access to your personal life.
Re: (Score:2)
Kinda like why you trust your Dentists to help you care for your teeth well. He makes money when you take his/her advice but if you are getting bad advice and the result is your are uncomfortable all the time you might go somehere else. Its in their interest to care for you well.
Right. And that's why it's in Amazon's best interests to give your data more care than this. Incidents like these translate directly into reduced sales, because even people who don't really care about security of privacy get creeped out by them.
Re: (Score:2)
Incidents like these translate directly into reduced sales
No they really don't. Security conscious types were never going to get an always on voice assistant. Its also not very likely to make anyone stop using amazon because honestly there isn't a replacement for Amazon.com (in terms of being one stop shopping for ANYTHING); certainly not for Prime. Its not going to make your company not choose AWS either.
Look at facebook! How many privacy incidents have they had, how much negative press, and yet #DELETEfacebook went basically nowhere. Same is true all be it
Re: Single case? (Score:1)
Re: (Score:2)
That's not even what I'm talking about. Why is it even possible for an Amazon employee to make these voice files available to other users through the interfaces available to them?
Because extracting those files it is a manual process so that employee has to be given access to all recordings from accounts that are entitled to a download of their extracted audio files through GDPR.
To limit access to files for the requesting account the permission system would need to know to which accounts that employee needs to have access today. (and if you do that manually, errors might happen there)
Re: (Score:1)
GDPR. is a back door.
Re: (Score:2)
Its possible because Amazon and others have convinced people its a great idea to have hot mic; under third party control in their homes.
That's not even what I'm talking about. Why is it even possible for an Amazon employee to make these voice files available to other users through the interfaces available to them? It's understandable why the data is there, but not understandable why someone can make the files available to another user with a click. Even if it's done with a backdoored system, those files ought to be encrypted to the user.
This happened before, again to a single customer. My understanding of that incident was that the two devices had the same hardcoded device ID. This could potentially happen if the device IDs are assigned in sequence, and one run started with same number of the previous run.
Re: (Score:2)
Its possible because Amazon and others have convinced people its a great idea to have hot mic; under third party control in their homes.
Its possible because people are stupid.
Indeed. There are numerous indicators people are generally stupid, but this one is a true gem.
Re: (Score:1)
Those who would give up a their essential privacy to purchase a little temporary convenience deserve neither privacy nor convenience.
That's my misquote of the day.
Re: (Score:2)
A honest answer would probably be: "Well, you see, we actually wanted to send that link to one of our advertising partners..."
Let's wait and see what cover story PR will spin.
Re: (Score:2)
FBI MODE! (Score:2)
FBI MODE!
Re: (Score:2, Interesting)
This isn't the only case we've heard of exactly this type of phenomenon. There's been another incident where exactly this happened, and yet another where someone could hear live conversations directly from someone else's Alexa device. Until people realize live mics in the home under someone else's control are a bad idea, which I'm not convinced will ever happen, we'll keep hearing about these sorts of incidents.
One of my more paranoid friends is convinced in a few years you'll be ostracized if you don't h
Re: (Score:2)
One of my more paranoid friends is convinced in a few years you'll be ostracized if you don't have these devices implanted in every room because if you don't, you clearly are trying to hide something
I don't think so, at least, not that fast. Enough normal people think they're a bad idea (it's not just nerds) that it will take more than a few years, if ever. Mind you, I can see it happening in China, or in hardcore theocracies, and I can see western nations turning into the latter of those (or hell, being owned by the former) but neither within just a few years. I've been wrong before, though.
Re: (Score:2)
One of my more paranoid friends is convinced in a few years you'll be ostracized if you don't have these devices implanted in every room because if you don't, you clearly are trying to hide something and shouldn't associate with the "normal, decent god fearing" humans that want to be sure they are safe and secure at all times. I used to think he was babbling bullishit, but the way we're going I'm not so sure.
Nobody official cares if I turn off my cell phone and go "off the grid", nor will anyone care if you don't have any device listening. The primary goal is to establish who all the people you don't have to worry about because their lives are transparent. It doesn't matter if you can defeat facial recognition with a hoodie and sunglasses, they'll see 9 out of 10 going about their daily business, you can pay cash but they'll see 9 in 10 use plastic and so on. They want to know all the mundane things people do s
Re: (Score:3)
"Why is this even possible?", internet users said on Thursday.
Didn't strike me as any great mystery. Amazon is too big and clunky to have gotten their GDPR ducks in a row and are manually handling requests that should be automated.
The longer version: For whatever reason Amazon has not made accessing your Echo recordings something you can just do at will (I assume this to be the case, otherwise the request would make no sense, but I don't own an Echo so I don't really know). The user made a request for the recordings, which falls under personal information, thus the GD
Re: (Score:2)
"Isolated single case" = "we screwed up massively, but we are not admitting it"
Tell me... (Score:5, Insightful)
Just how fucking beyond stupid do you have to be to willingly bug your own home with one of these devices? Or is just the ultimate expression of apathy when you can't even be bothered to use a touchscreen to find or do what you need? I think the passengers in the Wall-E film are a closer reality than anyone believed.
Re: (Score:2)
Re: (Score:2)
I have multiple of these devices. Great for looking up recipes.
Right, when you are "cooking" meth eh? Good luck, they know who you are now. (sarc off)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
explain to me how the microphone on your smartphone is any different. It's always listening, just say, "Hey Siri..." or "OK Google..."
I've turned that off. Of course, I'm trusting that this is actually the case. But wait, I'm not that trusting. I'm happy to turn my phone off, put it in a box or whatever if I'm having a sensitive conversation. It's different from a device designed first and foremost to always listen.
Re: (Score:2)
I agree, but explain to me how the microphone on your smartphone is any different. It's always listening, just say, "Hey Siri..." or "OK Google..."
I trust it because, 1) I've disabled it so that it doesn't respond to voice, only manual triggering (thus much more difficult to invoke accidentally), and 2) at least with Android, it's open source, and although I haven't personally looked at the source, enough people have that I'm fairly confident if it were doing something to upload recordings without my permissions, somebody would likely have figured it out by now.
Re: (Score:1)
Sorry the "OK, Google" functionality is NOT open source. Try again.
Re: (Score:2)
This is the result of entire generations of people never having known anything but life in a civilized world. They've never had to wake up to the sound of bombardement sirens in the middle of the night, they've never had strangers with governement badges bust down their door and take one of their loved ones away, never to be seen again. They've never had to call the police for an emergency, just to have police ask for bribes before they do anything, if they do anything, except maybe gang-rape their daughter
Re: (Score:1)
Well, to be honest I guess we're ALL fucking beyond stupid for willingly bugging ourselves with a listening device in our pockets; our cell phones. They have the same capabilities as these.
My current TV has no mic or camera, but my next TV I will likely have to keep off the network or physically remove the mic & camera in it. I don't even trust being able to disable it in software and there probably won't be any models without those "features".
Re: (Score:2)
Re: (Score:1)
Not too long ago, if the feds were caught installing bugs in people's homes en masse, people would be howling about Constitutional violations of privacy and demanding action be taken to punish the perpetrators. These days, however, the feds don't even have to worry about bugging homes because idiots everywhere are actually paying money to do it themselves. All the feds have to do to get the data is get a warrant signed off by a secret judge in a secret court with zero oversight or transparency to force a co
As an Alexa user... (Score:2)
So what changed? I was honest with myself on this question, a
Re: (Score:2)
Re: (Score:2)
I also see this in doctor offices too. Ugh.
Re: (Score:1)
This has got to be the weirdest trolly reference to Wargames I have ever seen...
Facebook analytic data 2.0 (Score:1)
Hahaha.
In 5 years Normies will be asking how all their voice data was collected and traded by Amazon.
"Wait Alexa RECORDS my voice?"
not me (Score:2)
Re: (Score:2)
I got one on discount and it was pretty useful, though admittedly I really only used it to control my hue lights and entertainment system when I would misplace the remote. However, as soon as these issues started, I unplugged it and its been that way ever since.
If this was an 'accident' due to 'human error'.. (Score:3)
Not going to mince words: you are STUPID if you allow these devices in your home! FFS at least unplug the gods-be-damned thing when you're not actively using it!
You've been warned. Repeatedly.
Funny how this works (Score:1)
"Errors" always seem to allow access to personal information.
Which makes you wonder what they are intentionally selling to their, uh, "partners".
Hash collision (Score:3)
Link to original Story (Score:1)
Alexa keep me free (Score:3)
With the ever increases in security measures sweeping through the world, there may be a day when we'll all be tracking ourselves, just to prove our social-standing/citizenship.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Who wants to listen to me? (Score:2)
Seriously, who would find what I say at home interesting?
You might prove that I really am crazy, that I really do talk to myself when no one is around to hear and that my shower concerts are cringe worthy affairs. But all that really means is you are more likely to knock before you enter my home...
Re: (Score:2)
You might prove that I really am crazy, that I really do talk to myself when no one is around to hear and that my shower concerts are cringe worthy affairs.
Actually, that's very common behavior. Some people talk to themselves to self-comfort, some as an aid to memory. I was just skimming an article on this recently, but can't seem to find it...
Re: (Score:2)
ALEXA! (Score:1)
What are my neighbors saying?
Fake News (Score:2)
The headline is factually wrong, and the way things are going here, that is intentional. So Slashdot is lying to us, again.
I love these kind of stories! (Score:2)
I use them as examples to add to my Middle School Computer class. I started this one with "how many of you use voice assistants?"
Then I introduced the story. These case studies are great for making the stuff I teach seem relevant.