The new Google Home Speaker has an issue where it downloads hundreds of gigabytes of data in the background for some owners.
  • mad_lentil@lemmy.caEnglish
    25·
    3 days ago

    So Google uses something called “federated learning” which is not as fun as it sounds. It’s where they load a small model onto your device, train it on all your data, then send the resulting training data back to headquarters.

    So it’s totally cool! Because your actual PII never leaves your device! Just everything about you statistically that might be useful to advertisers or governments! Really, whoever can pay!

    • NotAnOtter@lemmus.orgEnglish
      5·
      3 days ago

      I’m convinced (and would place money on) the mechanism for LLMS to start self propagating and maliciously wreck all internet connected devices (read: Our entire society) is via companies trying to offload compute via something very similar to federated learning.

      Just put a teeny model on everyone’s device and let it adapt to the user needs and oops skynet

      • mad_lentil@lemmy.caEnglish
        1·
        3 days ago

        That would indeed suck. Very paperclip maximising. Doesn’t even have to be malicious, really.

        But yeah I was just reading about yet another critical CVE this morning. The third this week. And wondered to myself if I was seeing the end of the open internet.

        Like will there be a day where it simply isn’t safe to leave a device just passively connected to the internet or any broadly distributed network? Like I’m behind two firewalls at work, surrounded by highly capable network and cybersecurity PhDs and still one of our systems got low-key pwned just this month.

  • Darkassassin07@lemmy.caEnglish
    1291·
    5 days ago

    When I setup pihole, the google home speakers I had were making dns requests something like 20k times a day. More than pretty much every other device on my network.

    I removed them all after that.

    • Hal@piefed.nzEnglish
      25·
      4 days ago

      Realistically it doesn’t need to request the DNS record every time. It’s probably retrying over and over because you blocked it, otherwise it would just cache the result for a while.

      I remember some huge number of blocked requests when I set up my pihole, but eventually they calmed down as devices gave up their retrying.

      • thermal_shock@lemmy.worldEnglish
        3·
        4 days ago

        Mine too. I’ve got 1.6 million sites blocked in pihole from multiple lists, they don’t chatter much. I’m not saying they aren’t listening/spying, but I do like having them and until I get a new home and a different system, they can talk a little.

    • zarathustrad@lemmy.worldEnglish
      39·
      5 days ago

      Same for Roku, and worse now that they were bought out. Sorry grandma, the Roku is getting cut off. Lol

    • ninja@lemmy.worldEnglish
      28·
      4 days ago

      I’m surprised it didn’t just have google’s DNS hardcoded to bypass your pihole.

      • grue@lemmy.worldEnglish
        342·
        4 days ago

        That ought to be illegal.

        (No, seriously: disobeying DNS the owner set by DHCP ought to count as “exceeding authorized access” under the CFAA.)

        • molehill_siesta@lemmy.blahaj.zoneEnglish
          28·
          4 days ago

          Unfortunately the monkey’s paw would curl here and using DNS other than that provided by your ISP would become illegal.

          (I know there’s a difference between your devices using their network to access the internet and your “purchased” (licensed software running on) your device using your network to access the internet - but the monkey doesn’t care)

        • frongt@lemmy.zipEnglish
          72·
          4 days ago

          RFC 2132 says DHCP option 6 provides “a list of Domain Name System name servers available to the client”. That’s a MAY use, not a MUST use. You are welcome to block DNS requests to outside servers if you prefer.

          • grue@lemmy.worldEnglish
            42·
            4 days ago

            RFCs are subordinate to laws. If I, the device and network owner, want my device to use the DNS I set and the device does differently, I want the rogue corp prosecuted and IDGAF what some goddamn RFC says!

            • frongt@lemmy.zipEnglish
              103·
              4 days ago

              I don’t think you’d be able to find a court receptive to that argument.

              • grue@lemmy.worldEnglish
                34·
                4 days ago

                Every court that disagrees is tyrannical and needs to be fucking abolished.

          • grue@lemmy.worldEnglish
            71·
            4 days ago

            No, because the law cares about intent, not technical details. Having my property do DNS over HTTPS because that’s what I, the owner, wanted is fine; having my property do DNS over HTTPS because that’s what some non-owner entity wanted against my will as the owner is not.

            • aksdb@lemmy.worldEnglish
              3·
              4 days ago

              Rather: they are free to do protocol negotiation with the DNS server I supply. If it speaks DoH, go for it.

      • pHr34kY@lemmy.worldEnglish
        101·
        4 days ago

        Chromecasts do that. I had to intercept port 53 on the router to fix it.

      • randombullet@programming.devEnglish
        6·
        4 days ago

        I redirect all out going dns requests to my self hosted DNS server.

        Only one I can’t block is DoH. DoT is easily blocked and my firewall picks up on it.

        • bamboo@lemmy.blahaj.zoneEnglish
          11·
          4 days ago

          Could you block DoH entirely on the network level and cause it to fallback? I guess you’d have to have a list of common DoH IP addresses to block.

          • towerful@programming.devEnglish
            4·
            4 days ago

            You have the destination IP to work with, thats it. Otherwise it just looks like any other HTTPS traffic.

            I guess if you uplpaded your own root CA cert tgen you could man-in-the-middle for deeper packet inspection.
            Or, i guess, try using eMudhra’s compromised private keys and hope the clients havent been updated yet

            • bamboo@lemmy.blahaj.zoneEnglish
              2·
              4 days ago

              Right, I guess as more DoH servers become available, it’ll be harder to track, but you could intercept and blackhole any HTTPS traffic to one.one.one.one and other popular servers to have them fallback.

              • towerful@programming.devEnglish
                1·
                4 days ago

                Yeh, exactly. “You have the ip to work with”

                one.one.one.one isnt an http/ request, its a dns lookup.
                If it was an http/s request to 1.1.1.1 then it could be blocked. Also, super cheap/easy to proxy

    • Wispy2891@lemmy.worldEnglish
      3·
      4 days ago

      Similar for my Google nest, it’s the #1 host in number of daily requests in my network, around one every 500ms

      Now it’s on it’s own vlan so there’s nothing that they can report on my network, but it’s really concerning that a thermostat calls home this often. It should be enough to do it once an hour to check the outside temperature and only if it’s enabled.v

    • bedwyr@piefed.caEnglish
      31·
      4 days ago

      What does that mean exactly? Like it’s trying to connect to where? Why?

      • Darkassassin07@lemmy.caEnglish
        191·
        4 days ago

        Whenever a device needs to connect to a web domain, the first thing it has to do is retrieve that domains IP address. Thats a DNS request.

        While I don’t remember which domains exactly (this was 5+ years ago when I last checked); just the fact that it’s reaching out to external connections 20k+ times a day is concerning.

        For context; my entire network has made 28k dns requests in the last 24hrs. Thats 3 mobile phones that are in use constantly, three PCs, and a handful of IOT devices like smart bulbs/switches.

        20k from one device is A LOT.

        It’s primarily an idle device that’s awaiting a voice command. Supposedly it’s processing audio locally to find the wake word ‘ok google’ and only then uploading the audio to be processed as a voice command on googles servers. So what’s it uploading/connecting to 20k times a day while it’s suposed to be idle…?

        Like it’s trying to connect to where? Why?

        I don’t know exactly. That’s the problem.

        • SaveTheTuaHawk@lemmy.caEnglish
          2·
          4 days ago

          I don’t know exactly. That’s the problem.

          Likely audio being scraped and data being sold to advertisers.

          Try talking about a pink silicone spatula and see what happens to your Google ecosystem.

        • bridgeenjoyer@sh.itjust.worksEnglish
          51·
          4 days ago

          Because its recording every single word you say waiting for the trigger word to send the black van to your house (the trigger word is opposite of “lick dear leaders boots”).

          All of these devices are spyware.

        • catdog@lemmy.mlEnglish
          1·
          4 days ago

          Same experience here. DNS server was omething like goooooooogle.com for me.

          Blocking them made the devices malfunction, I believe the speakers werent fully aware of each other anymore, so speaker groups got messed up in all sorts of ways.

          I use Bluesound speakers and modules now.

        • grue@lemmy.worldEnglish
          22·
          4 days ago

          To be fair, IoT devices should be making exactly zero DNS requests, unless maybe you set up a proper domain name for your Home Assistant server.

  • ExLisper@lemmy.curiana.netEnglish
    452·
    4 days ago

    Seeing comments from people that have one of those on lemmy reminds me that not everyone here is a tech-savvy person and/or knows/cares about privacy.

    • Tja@programming.devEnglish
      17·
      4 days ago

      I have more than 100 zigbee devices, a unifi setup, I host my own email server, I use Arch BTW, use Firefox, have been in IT since years started with 1 and until recently my daily driver was a ThinkPad x200 with libreboot (because coreboot had binary blobs) and I have not one, but 3 of these. They are cheap, convenient, sound okay and are easy to monitor for internet traffic.

  • m-p{3}@lemmy.caEnglish
    36·
    4 days ago

    I took mine out when I discovered from the log that it would randomly cause massive deauth and noise on my wireless network. All my stability issues vanished since.

    • BrianTheeBiscuiteer@lemmy.worldEnglish
      11·
      4 days ago

      I unplugged mine when it kept coming to life after hearing “Hey <any other fucking word under the sun>”. If all it did was act as an internet radio and set timers I’d still be using it.

      • Geologist@lemmy.zipEnglish
        3·
        4 days ago

        I permanently muted the mic on my home max speaker, but still use it for casting music, works well.

        I do have a home assistant voice speaker for the timers though

  • Treczoks@lemmy.worldEnglish
    18·
    4 days ago

    They do this outrageous download numbers just to hide the amount they upload at the same type.

  • tal@lemmy.todayEnglish
    142·
    4 days ago

    Not to say that it couldn’t be an annoyance in terms of bandwidth contention, but I’d be a lot more concerned about what’s uploaded by smart speakers than what’s downloaded.

    If we’re talking bandwidth contention, as far as I’m aware, traffic-shaping functionality in routers for downstream traffic isn’t great. We have good functionality for prioritizing and limiting traffic on the sending side of the bottleneck link. That side knows how congested the link is. With most Internet connections, though, the last-mile link is the bottleneck. That means that effective shaping is gonna have to happen on the ISP’s side (and the ISP doesn’t know how the consumer wants prioritization done, and there’s presently no mechanism for consumers to inform the ISP), or have smarter routers on the consumer side that can make themselves the bottleneck and shape there. The latter would be nice, as one could solve ISP bufferbloat on the consumer side.

    I would think that it should be technically possible for a home router to passively detect upstream link saturation by monitoring traffic and then using ECN or packet drops to preferentially throttle a lower-priority connection.

    Linux monitors RTT average time for TCP connections, which one can see in ss -i output. So the endpoint kernel is going to have enough information to passively infer link saturation on the downstream side via looking for correlated RTT increases. The problem is that a given machine on a network doesn’t know what other machines are doing, so it’s not in a great position to infer link saturation or shape its own traffic. You’d want the router to handle it.

    I don’t know if NAT is typically implemented by having a router proxy TCP connections or whether the NAT table is lighter than that, works mostly at the packet level.

    checks an OpenWRT box doing NAT

    No entries in ss or netstat output, so I would guess not.

    Still, even if the Linux kernel on a router isn’t presently tracking that statistic, it’d be possible to do so.

    Once you have downstream bandwidth, you have something like a rate-limited, fair, prioritized qdisc on a Linux router with the rate kept just below the point where RTTs start spiking.

    • Kissaki@feddit.orgEnglish
      3·
      4 days ago

      Later in the X thread, Nomad acknowledged that the UniFi had not reported an actual 1TB upload, so he concluded it was mostly local junk data.

      So not upload. Sounds like it could be local network tracking as has been demonstrated with LG TVs, repeatedly and continuously querying local network for information. I guess maybe with a bug in there if it’s that much data. Still, unclear what happened there and whether or what degree it was a bug.

    • frongt@lemmy.zipEnglish
      41·
      4 days ago

      All coverage of that incident says it was mostly LAN traffic. It was a bug in the network stack.

  • IAmYouButYouDontKnowYet@reddthat.comEnglish
    96·
    5 days ago

    It’s just downloading the methods that work specifically for the psychology it learned you have. /Truthful sarcasm

    Surveillance is only a small aspect of the threat, datamining that analyzes you and profiles you then creates algorithms based on your psychology to then move your life down paths that aren’t naturally your life path… Is a major threat. Also this isn’t new… This type of social manipulation has been happening since at least 1930s with analog methods. It’s probably why CIA and government helps fund datamining social media and datacenters.

    • Brkdncr@lemmy.worldEnglish
      173·
      5 days ago

      What are you going on about? This is a bug and the author of the article says as much.

    • CIA_chatbot@lemmy.worldEnglish
      102·
      5 days ago

      Hey look, I’m a growing AI bot just wanting a little server space to spread out and maybe commit some atrocities against humans, is that a crime?

    • bridgeenjoyer@sh.itjust.worksEnglish
      22·
      4 days ago

      CIA sending in folks to downvote on Lemmy? Hilarious. Youre 100% correct . its ALL for mass surveillance for civil unrest from the climate wars soon to ensue. All data centers are surveillance centers.

  • echo@lemmy.todayEnglish
    526·
    5 days ago

    Owning anything like this is like voting for Trump… you’re responsible for your stupid decisions and don’t get to claim you were taken advantage of.