• 0 Posts
  • 10 Comments
Joined 1 year ago
cake
Cake day: September 25th, 2023

help-circle





  • utopiah@lemmy.worldtointernet funeral@lemmy.worldreminder
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    1 year ago

    I don't think so, here is another example, what if the device counts how many times someone said "fuck", then sending {fuck:0} or {fuck:4,294,967,295} will result in the same size of data being transmitted. In fact imagining that the device is designed to do so, it could always send a large meaningless packet on querying for updates just so that when it actually needs to send data, it would look similar, same approximate number and lengths of packets and can be capped. I'm not saying it's the case now, just technically feasible and I believe hard to detect.

    Also on "trusting" someone then answered in https://lemmy.world/comment/4594899 but I'd said it's also not "easy". At least one must trust their institutions able to vet on the person able to review such devices and that the device tested and the one used are actually identical.

    Finally I'm not arguing for conspiracy theory or that Echo is spying on users, only that verification for privacy on closed system is not "easy" either through trust of 3rd parties or technical expertise for an "average" user, not somebody working in the domain.



  • utopiah@lemmy.worldtointernet funeral@lemmy.worldreminder
    link
    fedilink
    English
    arrow-up
    1
    arrow-down
    1
    ·
    edit-2
    1 year ago

    Are you saying the size of the upstream packet should be proportional to the mute time? Wouldn't that assume that one knows ahead what such logs include or not? For example if we imagine that the device is listening while on mute for the keyword "potato" and it's not being said once during the mute period, wouldn't that still making an upstream packet of a fixed length, i.e zero, despite being actively listening and able to phone home? Genuinely trying to understand how one can be so confident based solely on packet size as this seems to make some assumption on how the device behaves.

    Edit: regardless, monitoring traffic (which I already mentioned, hence aware of but arguing it's not sufficient) using Wireshark or netcat is definitely not "easy" for most people buying such devices.


  • utopiah@lemmy.worldtointernet funeral@lemmy.worldreminder
    link
    fedilink
    English
    arrow-up
    15
    arrow-down
    2
    ·
    1 year ago

    Curious to learn how would you verify it. Wouldn't one has to go as low level as power spikes? Not to sound paranoid but one can't just believe the PR these companies said. Consequently we have to check how the device behaves. It's not because it doesn't send information that it does not process it. One could imagine it logs on specific behavior or keywords and only send information back when "normal" behavior is expected, e.g update check. I'm not trying to imply this is the case, only that verifying doesn't seem "easy" to me.