[slg]

I see this argument all the time, but these things are less dangerous than smartphones. First off, they ride off your own network so it is easy to see when they are sending data back home unlike phones which can transfer data over harder to monitor 3rd party networks. They are cheaper and lower powered machines so they can't do a lot of processing on device and can't store a large amount of data for later transfer. They are stationary in your home and therefore likely spend a majority of the time listening to nothing unlike phones which might be at their owners side 24/7. They also only have one source of data which is audio as opposed to the other various sensors phones have like GPS. Finally, if you believe that these companies are shady enough that they are lying to their customers about what these smart speakers are doing, why do you think they aren't lying about what their mobile OSes or apps are doing?

All that said, I believe Apple, Amazon, and Google all have worlds more trust in this area than Facebook.

[saagarjha]

> these things are less dangerous than smartphones

I disagree.

> they ride off your own network so it is easy to see when they are sending data back home unlike phones which can transfer data over harder to monitor 3rd party networks

…if you use a VPN, then you can check for traffic here as well.

> They are cheaper and lower powered machines so they can't do a lot of processing on device and can't store a large amount of data for later transfer.

HomePod has an Apple A8 processor, and Google Home has some sort of ARM SoC. These aren't low-powered machines; on the contrary, they can run 24/7 since they're always powered.

> They are stationary in your home and therefore likely spend a majority of the time listening to nothing

I think this makes them more likely to be overlooked, more than anything.

> Finally, if you believe that these companies are shady enough that they are lying to their customers about what these smart speakers are doing, why do you think they aren't lying about what their mobile OSes or apps are doing

Some of them, maybe.

[ehsankia]

You start off with disagreeing that smartphones are more dangerous as home speakers, then every single subsequent point you make is along the line as "this may not be as bad as smartphones but they're still an issue".

Yes the processor is still strong but it's weaker than smartphones. Yes you can still sneak data past home networks but it's harder than 3rd party networks. Yes they can be more overlooked, but they still have access to less data than smartphones.

None of the points you make prove that home speakers are as bad or worse than smartphones. The original comment wasn't arguing that smart speakers are safe, they were just pointing out the hypocrisy over owning a smartphone and being against smart speakers.

[ci5er]

Since most people buy phones in 20 packs, and change devices between each charge, this is a non-issue, no?

[saagarjha]

The main issue with smart speakers is that they're in your home and they have access to continuous power, so they're always on. Sure, they might not have all of the processing power of your flagship smartphone, and you can check their traffic, but this doesn't mean that they aren't less dangerous. With smartphones, you can tell pretty quickly if someone's been recording audio in the background: just check to see if your battery is depleting quickly. Smart speakers also have better range than smartphones: they're meant to pick up noise from far away.

[ehsankia]

> The main issue with smart speakers

And? Your phone is with you 24/7

> they have access to continuous power

I don't know about you but my phone hasn't run out of power in months.

> this doesn't mean that they aren't less dangerous

No one is saying that they aren't dangerous, you're missing the point. What I'm saying is if you carry a smartphone around, that's just as risky. Therefore, it's hypocritical to warn against smart homes unless you also don't have a smartphone.

> Smart speakers also have better range than smartphones

But smartphones are literally next to you at all time, they don't need better microphones.

[amirmc]

> Therefore, it's hypocritical to warn against smart homes unless you also don't have a smartphone.

It's not hypocrisy to warn of dangers, regardless of being exposed in other ways. Also, your comment here equates 'smart speakers' with 'smart homes', which are not the same thing (yet).

This conversation can only progress when you consider the actual threat models (like security folks talk about). It seem strange to me to rant about the risks of smartphones vs smart home devices, when the data from both of those is potentially ending up with the same small set of companies.

[saagarjha]

> I don't know about you but my phone hasn't run out of power in months.

I don't understand your argument here. If your smart speaker 100% maxed out its CPU and sensors for a month, would you notice? Probably not. I guarantee you would if your smartphone did, though, unless you keep it constantly plugged in.

> But smartphones are literally next to you at all time, they don't need better microphones.

I'll chalk this one up to individual preference. Personally, my phone is usually not near me at home (e.g. downstairs) since I have access to my computer, which I prefer using instead.

[ehsankia]

Sure, but you don't need to max out CPU to collect and upload data. It's fairly trivial amount of computation for most things it can collect.

[slg]

>…if you use a VPN, then you can check for traffic here as well.

This is conditional on the assumption that the device is doing what it tells you it is doing. Like the point in my previous comment, if you believe the device is lying to you about when it is recording, why do you trust that it isn't hiding non-VPNed connections from you? Smart speakers can not physically transfer data themselves and can only forward data over WiFi or Bluetooth.

>HomePod has an Apple A8 processor, and Google Home has some sort of ARM SoC. These aren't low-powered machines; on the contrary, they can run 24/7 since they're always powered.

The A8 is a 4 year old processor and the HomePod is by far the most expensive and powerful of these devices. Maybe I was downplaying their potential processing power too much, but the fact still stands that a modern smartphone is much more powerful than a modern smart speaker.

>I think this makes them more likely to be overlooked, more than anything.

And phones aren't overlooked when they spend almost 24/7 within a few feet of the owner?

I am not saying these devices don't present any potential issues. I am just pointing out that the risk is lower than the one we have already accepted by using smartphones. Stressing over compromised smart speakers is like stressing about whether you locked the door to the third floor balcony while not caring that the front door is unlocked.

[saagarjha]

> why do you trust that it isn't hiding non-VPNed connections from you

Ahh, so you don't trust the operating system itself, rather than the apps running on it. In this case, you're free to physically turn off cellular data on your phone (e.g. by removing the SIM) and connect it to Wi-Fi.

> The A8 is a 4 year old processor and the HomePod is by far the most expensive and powerful of these devices. Maybe I was downplaying their potential processing power too much, but the fact still stands that a modern smartphone is much more powerful than a modern smart speaker.

Sure, but you don't need a whole lot of processor power. What you need is a reliable power source, which is something that a smart speaker has.

> And phones aren't overlooked when they spend almost 24/7 within a few feet of the owner

While smart speakers don't have to even be within a few feet of the owner to work.

[slg]

>Ahh, so you don't trust the operating system itself, rather than the apps running on it.

The argument against any of these devices is that they are compromised either by a third party or by the actual device maker. Google and Apple make the OSes installed on almost every mobile device. If you don't trust Google's or Apple's smart speaker why do you trust their OS?

>In this case, you're free to physically turn off cellular data on your phone (e.g. by removing the SIM) and connect it to Wi-Fi.

That isn't a valid solution became it is hindering a device in such a way that it can't perform its most basic duty. Real people don't put a SIM into their phone only when they are expecting a call and take it out as soon as the call is over.

>Sure, but you don't need a whole lot of processor power. What you need is a reliable power source, which is something that a smart speaker has.

What do you think the average smartphone uptime is per day? I am willing to bet it is approaching 24/7. A majority of phones probably are hooked up to chargers a couple hours a day and they all have access to the battery any time they aren't/

>While smart speakers don't have to even be within a few feet of the owner to work.

And neither do phones. The range of smart speaker microphones is likely within an order of magnitude of the range of smartphone speakers but the average distance between a smart speaker and its owner is going to be several orders of magnitude higher than the average distance between a smartphone and its owner.

[saagarjha]

> That isn't a valid solution became it is hindering a device in such a way that it can't perform its most basic duty.

This isn't intended as a permanent thing: it's just a spot check on the traffic.

> A majority of phones probably are hooked up to chargers a couple hours a day and they all have access to the battery any time they aren't

The issue here is that any sort of processing is very noticeable on smartphones, since it will either cause the battery to deplete very quickly or charging to take a long time. It's basically impossible to get away with performing computation without it showing up in battery statistics.

[lev99]

I would suspect that small cpu inside them is better at real time voice processing than you think.

[Retric]

Smartphone radios use quite a bit of energy. So, they can't be used to record 24/7 without the drain becoming really obvious.

These things send back full audio to be processed by design. So, it's not a question of possible it's up to the provider what they want to do with the recordings the device is directly sending.

[cornholio]

The fundamental difference is that a smartphone will record and send the data remotely only when you have applications or malware to that effect. So you still have nominal control.

Smart speakers are sending the audio to the mothership by design, it's the way they work in normal operation.

[musage]

> these things are less dangerous than smartphones

They're also orthogonal to smartphones.

> why do you think they aren't lying about what their mobile OSes or apps are doing?

Why do you think everybody thinks that? And why frame it that way from the get go, to what the companies themselves are doing today, and/or to what the widgets do in isolation? It's another vector of attack for all sorts of actors, present and future, including the companies themselves.

> All that said, I believe Apple, Amazon, and Google all have worlds more trust in this area than Facebook.

They're not the baseline, the baseline is none of these devices. And for me, those all have worlds less trust than entities I trust, and the difference between them and Facebook is pretty much irrelevant in the big picture.

[SlowRobotAhead]

Thank you, sometimes I feel like I’m nuts for seeing all these people run to install always on mics in their house.

I don’t like the 1 second of buffer the iPhone has for Siri with Hey Siri disabled - but LOL if I’m going to install a single purpose always listening microphone for gimmick reasons.