Shazam Keeps Your Mac's Microphone Always On, Even When You Turn It Off (vice.com)

An anonymous reader quotes a report from Motherboard: What's that song? On your cellphone, the popular app Shazam is able to answer that question by listening for just a few seconds, as if it were magic. On Apple's computers, Shazam never turns the microphone off, even if you tell it to. When a user of Shazam's Mac app turns the app "OFF," the app actually keeps the microphone on in the background. For the security researcher who discovered that the mic is always on, it's a bug that users should know about. For Shazam, it's just a feature that makes the app work better. Patrick Wardle, a former NSA hacker who now develops free Mac security tools, discovered this issue thanks to his latest software OverSight, which is designed to alert users when apps use their webcam and microphone. After he released OverSight, Wardle received an email from a user who noticed that the security app alerted him that Shazam was still listening even after he had switched the toggle to "off." Curious about this discovery, and worried his own software might be issuing a false alarm, Wardle reverse engineered the Shazam app to figure out what was happening. After a few hours analyzing the code, Wardle found out that, in fact, Shazam never stops listening, as he explained in a blog post published on Monday. James Pearson, VP of global communications for Shazam, said in a statement to Motherboard: "There is no privacy issue since the audio is not processed unless the user actively turns the app 'ON.' If the mic wasn't left on, it would take the app longer to both initialize the mic and then start buffering audio, and this is more likely to result in a poor user experience where users 'miss out' on a song they were trying to identify."

Comments

Always on puns.

[SeaFox]

For the security researcher who discovered that the mic is always on, it's a bug that users should know about.

I see what you did there.

Re:Always on puns.

[Miamicanes]

Probably the same kind of programming logic that causes a computer with a quadcore 3GHz+ i7 running Windows to grind to a complete halt for several seconds whenever something triggers UAC...

Or the logic that causes my three LCD monitors to take longer to finish waking up (one... by... one...) after the screensaver puts them to sleep than it used to take me to COLD-BOOT GODDAMN WINDOWS 7 from my first SSD ~5 years ago.

Same with SoundHound on android

[wbr1]

Google has its own 'what's this song' feature, but for a while I sued sound hound. Initially it was the only one, and it had better features like lyrics search. Then I found that unless I force closed the app (app switching or closing did not work), the mic was unavailable for ok google searches. Forcing the app closed released the mic. Bug or intentional, I don't know. The last time I used the app was a year or more so it could have changed, but this behavior no longer surprises me.

Re:Sounds legit

[Sowelu]

It's a great legitimate reason, but that doesn't mean it's not a big problem, too. Just because they're not actually bugging it, doesn't mean that it's okay behavior...it makes malicious behavior harder to spot. Engineering would be so much easier if we never had to worry about unintended consequences or inconvenient best practices.

Disclosure would have been nice.

[XeXeN]

The reason is understandable, but there should an opt-in or some kind of disclosure. Something like "This app keeps your microphone initialized for a better user experience. This "feature" can be disabled in the programs settings."

Proprietary software never discloses the truth.

[jbn-o]

Disclosure is no substitute for software freedom. It's so easy to disclose something, give the user a bogus UI for "controlling" the program, and then do whatever the proprietor really wants done (which could include covertly recording audio from unsuspecting users who believe they control their computer's mic). There's no substitute for being free to run, share, inspect, and modify the program at any time for any reason. Software freedom is the only thing that will keep proprietors from taking advantage of computer users because when the proprietors don't know who is inspecting the code, improving the code, or distributing improved versions they know they can be caught.

You are a spy

[PPH]

... for the RIAA. The ability to sample and identify music has existed for years. It is used by the RIAA to sample radio broadcasts and enforce fee collection. But until now, it has been difficult to conduct this same level of surveillance on businesses like bars, restaurants and shops that play background music. And owe fees for doing so. But now, install the phone Shazam app and collect location data and the money will roll in.

It's just a shame they don't pay the phone users a cut of the take.

Re:Sounds legit

[Anonymous Coward]

Had they labeled the setting "Ignore Mic" then it would be a legitimate reason. But because they lied about what the setting does you should assume the worst as they've already shown themselves to be untrustworthy.

Alexa/OK Google devices

[swb]

It wouldn't surprise me if they just decided that since people are willingly putting permanent audio listeners in their house, nobody would care if they kept the computer mic on too.

I'm a conspiracist, but I'm also something a fatalist and in many cases I kind of shrug my shoulders at the latest privacy dustup. But I really can't grasp why someone would buy an audio device capable of listening in their house all the time and sending it back to who knows where.

Every device with a microphone

[C3ntaur]

Every device with a microphone should have a physical, hardwired switch with an indicator that tells when it's enabled or disabled.

Re:Sounds legit

[MadKeithV]

It's potentially a good legitimate reason made very very suspect by having an "off" option that doesn't actually work.