Slashdot Mirror
Watchdog Group Claims Smart Toys Are Spying On Kids (mashable.com)
The Center for Digital Democracy has filed a complaint with the Federal Trade Commission warning of security and privacy holes associated with a pair of smart toys designed for children. Mashable reports: "This complaint concerns toys that spy," reads the complaint, which claims the Genesis Toys' My Friend Cayla and i-QUE Intelligent Robot can record and collect private conversations and offer no limitations on the collection and use of personal information. Both toys use voice recognition, internet connectivity and Bluetooth to engage with children in conversational manner and answer questions. The CDD claims they do all of this in wildly insecure and invasive ways. Both My Friend Cayla and i-QUE use Nuance Communications' voice-recognition platform to listen and respond to queries. On the Genesis Toy site, the manufacturer notes that while "most of Cayla's conversational features can be accessed offline," searching for information may require an internet connection. The promotional video for Cayla encourages children to "ask Cayla almost anything." The dolls work in concert with mobile apps. Some questions can be asked directly, but the toys maintain a constant Bluetooth connection to the dolls so they can also react to actions in the app and even appear to identify objects the child taps on on screen. While some of the questions children ask the dolls are apparently recorded and sent to Nuance's servers for parsing, it's unclear how much of the information is personal in nature. The Genesis Privacy Policy promises to anonymize information. The CDD also claims, however, that My Friend Cayla and i-Que employ Bluetooth in the least secure way possible. Instead of requiring a PIN code to complete pairing between the toy and a smartphone or iPad, "Cayla and i-Que do not employ... authentication mechanisms to establish a Bluetooth connection between the doll and a smartphone or tablet. The dolls do not implement any other security measure to prevent unauthorized Bluetooth pairing." Without a pairing notification on the toy or any authentication strategy, anyone with a Bluetooth device could connect to the toys' open Bluetooth networks, according to the complaint.
So exactly like Microsoft does with Windows 10 and Xbox One. Why aren't they cracking down on those?
didn't CSI Cyber use this idea as a story line?
Mal's Content http://malcontent.malcolmcampbell.org
Pixar studios will take them to court for copyright infringment.
Nawwwww really?
There's no good reason for a fucking doll (or refrigerator or thermostat or dog bowl or...) to have goddamn internet access.
As a dog, I agree with you on everything except the dog bowl.
No, you are a cow. Cows say Mooo. Moooo! Moooo! Moooo Cows Mooo! Mooo you internet connected cow!
They're listening. They're learning. They're coming.
This is all part of PizzaGate's grand kid swiping scheme. I just knew it!
Table-ized A.I.
I can see an argument for being able to adjust the temperature of my house before I get home on the rare occasion I'm getting home at an unusual time. I wouldn't get a connected thermostat just for that though.
. . . "Think of the children!" is now used for something good.
By all means, crack down on spyware. Boycot if necessary.
I've got to say, this seems creepy to me. It's not just spying on kids, it's spying on whoever is in range. It's basically an open mic in your home, transmitting to god knows who.
Who knows what kind of conversations it might overhear, or how it might be mined for incriminating information. Or how something innocuous might be misinterpreted as grounds for an investigation by the police, CPS, the FBI, etc etc.
I'd bet my ass it's easy to hack to act as a remotely controllable audio bug by anyone with nefarious intent.
Even worse, who's to say the stream couldn't be modified to make it seem like it "heard" child abuse, criminal activity, domestic violence, drug dealing...the possibilities are endless. How would you dispute a recording from one of these things where you were supposedly heard discussing (or confessing to) illegal activity? How would you prove it wasn't real?
If I was paranoid, I'd say that some intelligence organization is pushing these kinds of things in order to establish a covert surveillance network that could be used for all sorts of evil shit. But that's crazy, right? The CIA/FBI/NSA would never want a bunch of microphones in everyone's home, right?
Just cruising through this digital world at 33 1/3 rpm...
They're a watchdog group. Their whole reason for existence is to spot things like this and call attention to them, even if there isn't really a problem. I'm not saying that they're making this up, but I'd take any claims like this with a grain of salt until there's some outside confirmation.
Good, inexpensive web hosting
Same thing, except marketed to adults.
at random of children's rooms could turn out badly? But seriously, I'm still pissed that pictures of my preteen great-nieces were taken.
Instead of "Smart" just say "Treacherous" -- as in, treacherous appliances, treacherous toys, and treacherous "telephones" which are entirely treacherous computers that give you only the flimsiest illusion of control.
Simpsons did it!
Monstar L
At least my Lincoln Logs never spied on me.
And I'm so old that when I was five and told my dad I wanted Lincoln Logs for Christmas, he handed me a hand axe, a piece of flint and some beef jerky and dropped me off in the woods. I was out there in my little jammies in the middle of December and let me tell you, it got so cold I had to kill a deer and crawl inside to keep from freezing to death. It was like something out of The Revenant.
Yeah, I had a rough childhood, let me tell you.
You are welcome on my lawn.
As someone who actually looked and considered it, the toys are less nefarious than they seem to be accused of being. The physical toys are actually just (insecure) bluetooth speakerphone devices. Seriously, you can use the dolls to talk to people on the phone. Where the real danger lies is in the Android/iOS applications. I do not know if the application runs in the background 24/7 but I get the feeling you have to activate it to make the toy "smart" because always being on would cause battery drain issues. If your kid already has their own Android/iOS device then you have already failed on the privacy front.
Anons need not reply. Questions end with a question mark.
and my submission gets put up. An interesting story, better late than never.
At least my thermostat doesn't stop working randomly and my lights don't turn on and off because someone flew their drone by my house. That, and my things don't participate in DDoS attacks.
Give it 5 years and the TV shoots the baby.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
So is a "smart" TV, a laptop computer, a tracker (a more appropriate name for a cell phone or mobile phone which recognizes the activity it does the most), and so many other voice-activated gadgets with network connectivity all running proprietary (read: untrustworthy by default) software. And a lot of these devices have cameras in them too, also under proprietary software control. And virtually all of them have been used by kids for years. Some of these devices have geolocation hardware in them too, that must make it easier to geotag the data the proprietors can acquire, keep, and share. I think it's great that people are finally getting around to thinking about the security and privacy implications when this is presented to them in the form of a toy but really this is far too late in coming.
Departing from the parent comment, situations like this are also a constant reminder of the profound inadequacies of modern-day IT experts who choose to surround themselves with these things, not in an experimental way to investigate them but as consumers who apparently value minor convenience more than their own privacy.
Only software freedom helps you enjoy all of these devices in a way where you, the user and owner of the device, can have a real say in what gets recorded, where that data is copied, and thus who gets access to that data. It's not about shutting these things out of your life entirely, it's about respecting who should control this data.
Digital Citizen
What if Teddy Ruxpin 3.0 overhears abuse? Shouldn't child-rearing AIs mandated reporters? We can also arm them to serve as guard bears.
There is a huge difference between "spying on kids" and "security hole". This article and complaint are such crocks of shit.
RealityTV taken to a whole new level...
Unicode killed the ASCII-art *
democreeps want to know which ones to invite to some pizza next
I have no pity for idiots laying out thousands for pointless SmartCrap. There's no good reason for a fucking doll (or refrigerator or thermostat or dog bowl or...) to have goddamn internet access.
It's like some irresponsible asshole buying a gun then crying when he leaves it out and the baby shoots the TV.
I don't own any but I don't see it as pointless. I can see a very good reason for it. Adults ask siri and google thousands of questions a day via their smartphones. A logical extension of this is a teddy bear for a 4 year old where the 4 year old can ask questions like "what is a raccoon?"
Back in 2008 when Jennifer Stoddart put the snow boots to Facebook, I came up with what still strikes me as a reasonable compromise, that legal proscriptions against reverse engineering only apply to products promising to collect/report no personal information whatsoever (with Draconian thumb screw stockades for corporations affixing a "does not collect" sticker by means of a cryptochemical Volkswagon-grade adhesive).
It just seems wrong that a toy can A) collect personal information, and B) the user has no legal capacity to investigate the nature of the personal data captured.
Wronger than wrong.
Also, such a law would demonstrate that sometimes a halfway sensible compromise is possible to achieve, which means that my proposal has less than a snowball's chance in T. E. Lawrence's head scarf (the sun never sets on the British panopticon).
Read 1984 if you haven't.
Having any kind of microphone in your home invites malicious actors like the government to listen to you at all times regardless if you are talking to your Alexa device.
The telescreen should have been a warning to all of us yet we adopt the technology eagerly.
My PC has neither a webcam nor a microphone and I will never buy a smart tv or smart add-on that has voice control. Maybe if I could definitely mute the mic with a button but I think I would have to hack that in myself.
This is a perfect playground for predators. How creepy? My goodness... Can you imagine somebody watching your child and you at the privacy of your home? Unbelievable!