Smart Speakers

(No time to read right now? Just want to see the list of things to know? Here you go.)

---

What Do They Do?

They can do a lot of things such as…

  Play music

  Set timers and alarms

  Add items to your shopping list

  Provide up to date info like the weather forecast, latest news, sports scores, etc.

  Do a search engine query and read you the results

  Control “smart home” devices like thermostats, light bulbs, smart locks, and alarm systems

---

Who Makes Them?

Smart speakers, also known as voice assistants, are made by Amazon (Echo), Google (Google Home), Apple (HomePod), Sonos (One), Bose (Home Speaker), and others.

---

How Do They Do These Things?

The devices are configured to listen for a “wake up” command phrase, such as “hey, siri”, “OK Google”, or “Alexa”. Once activated by the command, they listen to the request, process the audio, match it to a large database of known phrases, and then attempt to execute the command.

---

What Are the Risks?

In order for a smart speaker to “hear” your wake up command, it has to keep its microphone turned on and constantly be listening for it.

Their manufacturers claim that the devices are not capturing audio or processing it until they hear the command.

But how do we know that for sure? And how do we know that after a command is completed, the device stops listening for anything except the wake up command?

Several manufacturers admitted that they sometimes capture recordings for “quality assurance” purposes or debugging. While in some cases this might be legitimate, there's no confirmation that the recordings are immediately deleted.

It's possible that non-audio information is captured and sold to third parties (or used directly by the manufacturers). Since many people use these smart speakers to control other devices in their homes, the speakers know when things are being turned on or off (like light bulbs, smart locks, and security systems). That data could be quite revealing.

In addition, the smart speakers know when you wake them up and know when there are longer periods of silence. So their manufacturers (if they were evil and wanted to) could potentially understand when you're home and when you're not. You can imagine how that information could be used nefariously.

Also, if you've got your smart speaker in the same room with a TV, it's possible that it can determine what shows you watch. That, in turn, could lead to you being targeted with certain types of ads in your web browser, email, or phone.

A more serious risk is that special custom commands (called “skills” or “actions”), downloadable from third parties, could install malicious software. This software could do all sorts of bad things, from enabling the microphone without your knowledge to tricking you into providing a password for your account.

These downloads are supposed to be checked by the smart speaker manufacturers, but things can slip through. And they usually do not check updates to previously-verified software, so hackers can exploit that loophole.

The key thing to understand about the overall risk exposure with smart speakers is that they are connected to the Internet all the time.

Any “always-connected” device presents a juicy target for hackers. While there are ways to make them more secure, the procedure is a bit technical and most people aren't going to bother.

---

What Should You Do?

Smart speakers provide some very useful (and fun) benefits. But you need to weigh that convenience against the inherent privacy concerns. What's your comfort level? Are you willing to give up some privacy in exchange for the (admittedly helpful) features these devices provide?

For the people only mildly concerned about the potential problem, you could keep the smart speakers powered down except for the times you'll be actively using them. That at least reduces their potential “listening” from 24x7 to a shorter time period.

The more paranoid could look into devices from a company named, quite appropriately, “Paranoid, Inc.” They make non-Internet-connected products that work in conjunction with smart speakers to make them a bit safer.

They do this by adding a physical button you must press to activate the microphone or by “jamming” the audio until their product hears its special command phrase. (I am not endorsing these products; I'm just making you aware of them.)

---

Summary

Smart speakers, and the voice recognition they rely on, take advantage of some quite advanced technology. They can be helpful and fun, but they do come with underlying risks. So the best advice is “use with caution.”

---

Questions?

If you have any questions about smart speakers, please get in touch...