Slashdot Mirror

← Back to Stories (view on slashdot.org)

Google Criticized For 'Opaque' Audio-Listening Binary In Debian Chromium

Posted by Soulskill on from the ok-google-stop-listening-to-me-breathe dept.

An anonymous reader writes: Google has fallen under criticism for including a compiled audio-monitoring binary in Chromium for Debian. A report was logged at Debian's bug register on Tuesday noting the presence of a non-auditable 'hotword' module in Chromium 43. The module facilitates Google's "OK, Google" functionality, which listens for that phrase via a Chrome user's microphone and attempts afterwards to interpret the user's instructions as a search query. Matt Giuca from the Chromium development team responded after the furore developed, disclaiming Google from any responsibility from auditing Chromium code, but promising clearer controls over the feature in release 45.

45 of 85 comments (clear)

  1. "Ok, Google, are you snitching to the NSA?" by Anonymous Coward · · Score: 1

    I can see why they'd be less than transparent about it..

    1. Re:"Ok, Google, are you snitching to the NSA?" by jellomizer · · Score: 4, Funny

      Oh come on, you all know those engineers at Google, actually wrote that code in a HEX editor in straight machine code. It is completely open source. Just because you don't know machine code, doesn't mean Google is violating open source methodology. Say you didn't know APL and I created an APL program, and gave you the source. Am I not sharing the source with you?

      FYI: Tongue in cheek.

      --
      If something is so important that you feel the need to post it on the internet... It probably isn't that important.
    2. Re:"Ok, Google, are you snitching to the NSA?" by Carewolf · · Score: 2

      I can see why they'd be less than transparent about it..

      Nah, not the NSA. They spy for the one spying organzation bigger than the NSA: Google ;)

    3. Re:"Ok, Google, are you snitching to the NSA?" by greenfruitsalad · · Score: 1

      i, for one, like the idea of this feature. i just wish it would listen for a "f*ck you google" keyphrase and then immediately delete all google services related cookies from my browser. the "f*ck you google" subroutine should work completely locally but i'm ok with it increasing some kind of counter on google's servers. they should be able to see how many million people said "f*ck you google" this month.

  2. Turn off in Windows? by nefus · · Score: 2

    So is the microphone on by default in windows? How would you turn it off?

    1. Re:Turn off in Windows? by gbjbaanb · · Score: 2

      unplug it, or if its embedded, remove the audio driver for it, or set the 'volume' control so it cannot hear anything anyway. And put some tape over the little hole it listens through.

      Now.. good luck doing that on your phone.... best just to remove the app (if you can) or trust Google not to have slipped this stuff into Android as part of its voice activation feature (for your convenience, of course)

    2. Re:Turn off in Windows? by Anonymous Coward · · Score: 1

      If you can't see the Windows source, how exactly do you know what it's doing? It could easily claim to be muted, but in fact recording everything you say.

    3. Re:Turn off in Windows? by swillden · · Score: 3, Informative

      unplug it, or if its embedded, remove the audio driver for it, or set the 'volume' control so it cannot hear anything anyway. And put some tape over the little hole it listens through.

      Now.. good luck doing that on your phone.... best just to remove the app (if you can) or trust Google not to have slipped this stuff into Android as part of its voice activation feature (for your convenience, of course)

      Hotword detection is optional in Android. If you don't like it, just turn it off.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    4. Re:Turn off in Windows? by Anonymous Coward · · Score: 1

      Go home, shill.

    5. Re:Turn off in Windows? by drinkypoo · · Score: 3, Interesting

      Hotword detection is optional in Android. If you don't like it, just turn it off.

      The software which provides hotword detection on Android is also not auditable. How do you know it doesn't turn itself on when it detects that you're not looking at it, or monitoring it via adb? Oh no, I don't really think that it does either, but it's precisely the same concern as on Debian. You'd have to not install the google services to be sure you were avoiding it.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    6. Re:Turn off in Windows? by swillden · · Score: 4, Insightful

      Hotword detection is optional in Android. If you don't like it, just turn it off.

      The software which provides hotword detection on Android is also not auditable. How do you know it doesn't turn itself on when it detects that you're not looking at it, or monitoring it via adb? Oh no, I don't really think that it does either, but it's precisely the same concern as on Debian. You'd have to not install the google services to be sure you were avoiding it.

      If that's your level of paranoia, you're lost, and omitting the Google services doesn't help.

      The fact is that you implicitly and deeply trust all the companies in the production pipeline for the networked electronic devices you use, because absolutely any one of them can easily arrange for whatever sort of backdoor they want. It's a little tougher for the hardware component vendors, I'll grant, but if they do the work they're in the best position of all to compromise your security without any possibility that you could find it.

      With Android specifically, though, I'm interested in ideas for how we can make the system more transparent. We can't do anything about hardware-level compromises, but I'd like it if the upper layers were more auditable -- and note that having access to source code that purports to be what's running on the device doesn't get you there.

      One idea I've been toying with is a framework-level network tap that allows you to divert a copy of every bit that your phone sends or receives, via network, Wifi, bluetooth, NFC or USB, for your perusal and examination. Since most apps use the framework APIs for SSL, it should be possible to snarf this data before it's encrypted, too. Of course, there's a big downside: if this single data collection point exists, it will be a tremendously attractive target for compromise by other parties who want to see what your device sends or receives.

      You're a smart person, do you have any ideas for what Android could do to make its operations more transparent? We can't achieve perfection, but if we could get it to the point where Google or anyone else in the supply chain would have to do something which is obviously and solely intended to hide their actions in order to exfiltrate private data, that would be great.

      Note that this is not an idle question. I'm a member of the Android security team, and in a position to make these sorts of things happen, or at least dramatically increase the likelihood.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    7. Re:Turn off in Windows? by drinkypoo · · Score: 1

      having access to source code that purports to be what's running on the device doesn't get you there.

      hence the superiority of the gentoo/lfs/etc approach :) but building Android is a serious nightmare... even if they wanted to give you the code.

      One idea I've been toying with is a framework-level network tap that allows you to divert a copy of every bit that your phone sends or receives, via network, Wifi, bluetooth, NFC or USB, for your perusal and examination.

      That seems like a fairly obvious thing to do; if it's in the kernel, then a user can reasonably work out whether it does what it's supposed to. Aren't there some facilities in the Linux kernel which could trivially be used to provide that functionality?

      Of course, there's a big downside: if this single data collection point exists, it will be a tremendously attractive target for compromise by other parties who want to see what your device sends or receives.

      There's always a down side. I perceive untampered Android security as pretty good, though. As long as you need root elevation, it seems like the kind of thing that you can keep users from shooting themselves with accidentally. What more can you hope for?

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    8. Re:Turn off in Windows? by firewrought · · Score: 1

      One idea I've been toying with is a framework-level network tap that allows you to divert a copy of every bit that your phone sends or receives, via network, Wifi, bluetooth, NFC or USB, for your perusal and examination. Since most apps use the framework APIs for SSL, it should be possible to snarf this data before it's encrypted, too.

      Good luck. I captured all the traffic that a nexus 7 sends during initial setup, and it was immense. Numerous hosts, protocols, you name it. A few hundred megabytes total. Very hard to make heads or tails of (especially given the encrypted content).

      --
      -1, Too Many Layers Of Abstraction
    9. Re:Turn off in Windows? by swillden · · Score: 1

      having access to source code that purports to be what's running on the device doesn't get you there.

      hence the superiority of the gentoo/lfs/etc approach :) but building Android is a serious nightmare... even if they wanted to give you the code.

      No kidding. There's a reason my workstation has 40 cores and 128 GiB RAM.

      I perceive untampered Android security as pretty good, though.

      I do, too, actually. Far better than I thought it would be. It's refreshing to hear someone outside of Google say that, though :-)

      As long as you need root elevation, it seems like the kind of thing that you can keep users from shooting themselves with accidentally. What more can you hope for?

      Well, the current direction is to create a lot of firewalls between components that even root can't breach, using SELinux. This is obviously to reduce the impact of privilege escalation exploits, and even more important to eliminated many of them because many exploits today are actually exploit chains, so if SELinux can break any link, the whole exploit is DOA. We're actually seeing a lot of exploits for older versions which no longer work in L because SELinux is in enforcing mode.

      If what I'm thinking about doesn't require poking any holes through SELinux firewalls, then it's a relatively minor risk, though it does make an attacker's job easier. Specifically, the sort of attack I'm most worried about in this context is what we call "spouse spying". It's obviously not restricted to spouses, but it's the sort of thing that non-trivial numbers of people want to do, and which is a real and occasionally dangerous problem (as in, people die from the fallout of such tools being readily available -- not that the tools are at fault, exactly, but we'd rather not facilitate it). So we're not in the abstract realm of "well, it's theoretically possible to...", this is about real-world attacks, and so merely making it harder actually does achieve something in many cases.

      I may be unduly pessimistic about the dangers of such a "central I/O tap", because I haven't had time to look at it hard. I will, though. I fundamentally like the idea -- probably mostly because it was my idea :-) -- if I can convince myself (and my colleagues) that it doesn't create any unacceptable new risks.

      Other ideas for creating greater transparency are welcome.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    10. Re:Turn off in Windows? by swillden · · Score: 1

      One idea I've been toying with is a framework-level network tap that allows you to divert a copy of every bit that your phone sends or receives, via network, Wifi, bluetooth, NFC or USB, for your perusal and examination. Since most apps use the framework APIs for SSL, it should be possible to snarf this data before it's encrypted, too.

      Good luck. I captured all the traffic that a nexus 7 sends during initial setup, and it was immense. Numerous hosts, protocols, you name it. A few hundred megabytes total. Very hard to make heads or tails of (especially given the encrypted content).

      It couldn't be that bad, or people on mobile networks would burn most of their month's data setting up a new device.

      And the idea would be to get as much as possible out before it's encrypted. It would still be tough to analyze, but people would figure it out.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    11. Re:Turn off in Windows? by drinkypoo · · Score: 1

      I may be unduly pessimistic about the dangers of such a "central I/O tap", because I haven't had time to look at it hard. I will, though.

      So, how do you keep applications from knowing that the tap is in use? :)

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    12. Re:Turn off in Windows? by Type44Q · · Score: 1

      It couldn't be that bad, or people on mobile networks would burn most of their month's data setting up a new device.

      And if that data is flagged in such fashion as to not count against one's data cap?

    13. Re:Turn off in Windows? by swillden · · Score: 1

      You are absolutely, positively 100% wrong.

      Really? Care to support that claim?

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    14. Re:Turn off in Windows? by swillden · · Score: 2

      It couldn't be that bad, or people on mobile networks would burn most of their month's data setting up a new device.

      And if that data is flagged in such fashion as to not count against one's data cap?

      Android doesn't send any particular different parameters during setup. There's really no way the carrier could even know the difference. And if the device could send something that meant "hey, doing setup, don't charge this" you know custom ROMs would arrange to send that *all* the time, or at least as often as they can get away with.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    15. Re:Turn off in Windows? by swillden · · Score: 1

      I may be unduly pessimistic about the dangers of such a "central I/O tap", because I haven't had time to look at it hard. I will, though.

      So, how do you keep applications from knowing that the tap is in use? :)

      That would be the easy part. There'd just be no way for them to tell.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    16. Re:Turn off in Windows? by drinkypoo · · Score: 1

      It couldn't be that bad, or people on mobile networks would burn most of their month's data setting up a new device.

      I don't know under what conditions Android will decide to install some subset of your installed apps to a new install; is it just when it thinks it's the old device? Sometimes when I reload my phone with another OS (I run SOKP on my Moto G 2014 (titan) and just did a clean flash of the latest) the play store wants to reinstall all my apps, sometimes it doesn't. I use Ti Backup so that it doesn't have to, and sometimes I have had to interrupt it trying to be helpful. That could easily come to hundreds of megabytes. If the device has a lot of preinstalled apps and you've had it in the box for a long time, again, that might also result in a pretty massive initial update. But the device in question is a tablet, and these are often used in conjunction with WiFi at least some of the time, even if they're cellular-enabled.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    17. Re:Turn off in Windows? by swillden · · Score: 1

      I'm not sure about older versions (I just don't remember) but with L it asks you if you want to sync your apps.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    18. Re:Turn off in Windows? by jtgd · · Score: 1

      best just to remove the app (if you can)

      I just got a tablet running Lollipop and in fact you cannot remove Chrome (without rooting).

      --
      J
  3. If the hardware is there, assume it will be used by Anonymous Coward · · Score: 3, Insightful

    That is one reason my desktop doesn't have a mic, nor a camera. If it isn't there, then software can't abuse it.

    Even with laptops, back in the early 2000s, I remember a brand that had an analog switch. Flip the switch, no mic, no way for software to access the mic.

    We need that functionality back in hardware, just because it should be assumed that software will abuse it.

  4. Comment bubble thing next to the story icon? by meta-monkey · · Score: 5, Insightful

    No. I do not like change. Put the comment link back below the summary.

    Do it.

    Do it now.

    Do it.

    Do.

    It.

    --
    We don't have a state-run media we have a media-run state.
    1. Re:Comment bubble thing next to the story icon? by Anonymous Coward · · Score: 1

      And what's with this "Share" button being so prominent now? Does anyone actually want to share things on Slashdot?

    2. Re:Comment bubble thing next to the story icon? by bulled · · Score: 5, Funny

      Does the average /.er have anyone to share something with?

    3. Re:Comment bubble thing next to the story icon? by nullchar · · Score: 2

      Assuming we did want to share /. stories with someone, we only paste URLs into our chat clients, never "share" them on "social media" platforms.

      I paste /. URLs into Jabber and IRC chats all the time.

    4. Re:Comment bubble thing next to the story icon? by 14erCleaner · · Score: 1

      And can you change the dropdowns back so they're not black-on-dark-green?

      --
      Have you read my blog lately?
    5. Re:Comment bubble thing next to the story icon? by aardvarkjoe · · Score: 2

      But the new design saves so much screen real estate!

      Oh, wait. Because of that stupid "share" button sitting all by itself that nobody is going to use, you haven't saved any space at all.

      Isn't one of the tenets of good website design that it's better make the links obvious so that people can find them? Old users are annoyed by the change because it breaks their expectations. New users are much less likely to find the comment section of Slashdot because there's no clearly-marked link to get to them -- you have to figure out to click on some cryptic icon that just looks like a decoration. You're not saving any screen space, and the "share" button sitting all alone like that just looks silly.

      I don't mind an interface change if there's a good reason for doing so, but this one is all downside.

      --

      How can we continue to believe in a just universe and freedom to eat crackers if we have no ale?
    6. Re:Comment bubble thing next to the story icon? by Anonymous Coward · · Score: 4, Insightful

      That's not the worst part. They don't just not know the audience, they don't know how this site is used, or why it's any good.

      Nobody is going to share the /. summary of a linked article. The summary is crap most of the time, the good part about /. is the discussion it generates, not the summary itself. You'll either share the linked article (so nothing related to /.) or the article page with the comments after you read the comments.

      Put a big-ass share button button on the bottom of the comment page and you'll get more shares and might get more readers after they see the comments. As it is right now nobody will use the share button and newcomers to the site won't even realize there are comments worth reading and will dismiss it as a crappier commentless reddit clone.

    7. Re:Comment bubble thing next to the story icon? by virens · · Score: 1

      They will not put the comments link back. You don't get it: these are corporate slime. All that corporate slime and businesschmucks can do is "be like everybody else". They don't have a face - they are just suits, which is just the same for everybody else. When Cmdr Taco was at the steering wheel, this was Slashdot. When the corporate slime from Dice took over, I don't even want to click on 90% of stories. This is why MBA must be abolished. But alas - migrate to https://soylentnews.org/

  5. Re:Speaking of "opaque" - Dice, WTF re: comment li by LordWabbit2 · · Score: 1

    Until eventually
    goatse!

    --
    There are three kinds of falsehood: the first is a 'fib,' the second is a downright lie, and the third is statistics.
  6. Re:Speaking of "opaque" - Dice, WTF re: comment li by ArchieBunker · · Score: 4, Insightful

    More minimalist bullshit. If you have to stop and think about what a button or image means then the design is broken. What is wrong with the word "comments"? Why must it now be a cartoon speech bubble?

    --
    Only the State obtains its revenue by coercion. - Murray Rothbard
  7. Re:Who cares by Anonymous Coward · · Score: 1

    When you stop visiting it.

  8. Re:Speaking of "opaque" - Dice, WTF re: comment li by Anonymous Coward · · Score: 1

    You mean the one in the topright of every article that looks like a speech bubble and has the number of comments?

    Protip: when the article has no comments that balloon isn't there. In fact, when an article has zero comments, it's not obvious that you even can click through to the comments page. There's no 'Read more', either, since that's been hijacked by the godawful 'share' links. The only place you can click is on the title. Above where you were just reading.

  9. Re:If the hardware is there, assume it will be use by Carewolf · · Score: 1

    No, this is why we use open source, so that things like this doesn't happen. Chromium is just not that opensource friendly.

  10. Re: If the hardware is there, assume it will be us by Anonymous Coward · · Score: 1

    Open Source software is not guaranteed to not have backdoors. Just because something is opensource doesn't mean it is safe or that someone (beside the original author) ever looked at it.

    But while it is easier to spot backdoors in OSS than in closed source products it is also easier, for a trained eye, to spot defects and vulnerabilities that can be used for malicious purposes.

    For this reason I second every hardware device that can limit the software from spying on me. A physical switch can seem old fashioned, but it is more effective than the best and expensive antivirus out there.

  11. Re:Speaking of "opaque" - Dice, WTF re: comment li by Anonymous Coward · · Score: 4, Insightful

    Or just clicking the article name? Its the same damn page. This really isn't that hard.

    It's not obvious that the article name is where you would click to delve into the article since it's above the summary and most people read from top to bottom. Not only that, but on a collapsed article, clicking on the title expands the post. Why on Earth would I expect clicking the title again would take me to the comments and not to collapse the post back down again?

  12. time for better sandboxing / permissions? by NostalgiaForInfinity · · Score: 1

    At Google’s product forums users of Chrome have expressed concern about the lack of any API access to disable the audio recording capability,

    The problem isn't so much that Chromium is doing that, it is that most packages run largely unprotected.

    What Linux lacks is something similar to what the Android / iOS permission systems attempt to do (but aren't very good at either). All the low level infrastructure is there, but there is support missing at the package and desktop level.

  13. Re:Speaking of "opaque" - Dice, WTF re: comment li by macs4all · · Score: 1

    You mean the one in the topright of every article that looks like a speech bubble and has the number of comments?

    No, he means the "speech bubble" that COVERS OVER the rightmost 4 or 5 characters of each and every Article Title.

  14. Dice mismanagement? by faway · · Score: 1

    Who are these people? How did they get in control? Should users migrate elsewhere?

  15. Re:Speaking of "opaque" - Dice, WTF re: comment li by geminidomino · · Score: 1

    Maybe Dice ought to hire some of those "usability" experts advertised on their main site.

    Who do you think came up with the changes in the first place?

  16. Off by default by mgiuca · · Score: 1

    The key point I made in my official response was overlooked by this article: the hotword module does not run at all unless you opt in, by going to Chromium's settings and turning on the "Ok Google" feature.

    Once you turn it on, it's true that we don't send recordings to Google unless the hotword detector hears "Ok Google", but without explicit opt-in, this module is not listening. It is not even running.

  17. Re:Speaking of "opaque" - Dice, WTF re: comment li by geminidomino · · Score: 1

    . If they don't, then they're not UI experts.

    They're not. "Usability Experts" these days are using "UX", to differentiate them from the people who actually understand such useless concepts as "use cases" and "suitability to purpose."