Three recent papers uncover the extent of tracking on TVs
I try to think long and hard before I buy any hardware which has an obvious tracking use case, other than a router and a smartphone, but so many friends and relatives try to one-up each other by filling their homes with Alexas and Ring doorbells, and all sorts of tracking technology.
I'm not saying I'm perfect, like I said I have a phone and a router, and I understand at a point I can't hide certain things, i.e. my ISP can see what I'm pulling on the net and I find it's not worth the hit to convenience to try to scrub or obfuscate that info, but man, one guy I know has an Alexa in every room in his house! Another has IoT'd his place upside down with various Chinese equipment that is collecting who-knows-what data and sending it who-knows-where, and it's not that I have a problem with it, but they don't even think of the privacy implications when they buy these things.
I try to live my life as if I'd become president one day and the CIA/FBI/NSA would use everything in their power to find something heinous they could use to destroy my life, and also so that I don't have to worry about my future children having their entire life uploaded from birth to death because of mistakes I made in the technology I buy. It keeps me humble and skeptical of new hardware and I truly measure the impact it has on the privacy of myself and those around me, but I wonder sometimes if it has no affect because they could always build a profile based on how I've intereacted around others' technology
Isn't there some way these TVs are violating the Video Privacy Protection Act?
https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act
Even the amendment in 2012 seems to make it only legal to add a function "share" functoin for a user to post what they watched on a service. It does not seem to make it possible to just share all viewing info. It also does not make it possible to just add it to a EULA or TOS.
Having thought about it a bit recently, smart-TV advertising and tracking seems like it may become more invasive in some ways than smartphone-based tracking. Smartphone ads at least give the perception of being personal.
Watching TV is a social activity - gathering at a friend's place to watch a new episode, or relaxing with family.
The future implied by these developments is that TV-based tracking will take the home audience into account, and the screen becomes -- in some sense at least -- a camera as well as a display.
Instead of being shown subtly inadequacy-leveraging ads on your own device, now they're going to be interwoven into you and your family's home in such a way as to influence thoughts and opinions.
Gradually adtech will - as it has already - erode the ability to have peaceful, genuine social human interaction while enjoying an artist's intended work uninterrupted.
I'd like to think that alternatives to advertising finance are on the horizon, because the ad business seems to further income inequality. Adtech employees deny and avoid their guilt by enjoying the profits they make, while their audience (who are increasingly also their acquaintances, as peer-based referrals and influence marketing heat up) are pressed to spend and consume, often unnecessarily.
I'd wager the trend towards ads and quantified influence is going to continue until it necessitates radical change.
NB: In reality the capability likely already exists to target ads based on who you're currently with, so this is really just an opportunity for the advertising industry to socialize and normalize these practices.
From trying to reduce hostile snooping/malware "TV" behavior for the last few years (as an on-principle techie exercise)...
My current practical requirements: Lately, I mostly watch movies and series from borrowed Blu-ray and DVD discs (which turned out to be a better catalog, IMHO, than Netflix's streaming catalog at the time I switched). I also want to occasionally play PS4 online multiplayer games on the same display.
I didn't want the PS4 to be phoning home when I played the discs, so I found a model of Blu-ray player that does DVD 1080p upscaling, but which still doesn't have WiFi. I did a final firmware update of the (EOL'd) Blu-ray player over the Internet, and then have a policy that the player will never be plugged into the Internet again. (Again, this is mostly an on-principle exercise, and, so far, it's proven practical for me. I've encountered only one Blu-ray implementation bug, which is known lockups of a very small number of titles in 24p mode of some players, and which never got a firmware update anyway.)
(Before the Blu-ray player appliance, I tried using Kodi for playing DVDs, first with a laptop, and then a RasPi 3 setup, but that worked poorly.)
I paired the airgapped Blu-ray player with a nice older Sony 1080p TV with decent integrated speakers, and which had no WiFi, and was not new enough to be fully "smart TV" obnoxious. It has a nice picture, and works well with the Blu-ray player's remote over HDMI. To get this one, I had to do some research, and then do daily searches on CraigsList for a while.
The two main drawbacks to the older, less-smart TV are that it's not 4K, and that it's power-hungry. (20W off, 90W to display no-signal screen, peaks to 140W+ even in a dim room.) For saving the 20W when off, I'll probably move the TV to a secondary position on a smart power switch, but I've hesitated, because I don't know whether the TV was designed for frequent abrupt power cuts, and, if I wear it out prematurely, finding a similar replacement model on the used market looks increasingly difficult.
When I eventually upgrade to 4K or whatever is next, I suspect I'll probably end up getting a non-TV commercial display without Internet, and a separate audio amp and speakers.
Maybe I'll also be forced to give up on borrowed discs, and switch more to streaming, which I suspect will be locked-down with anti-user hardware and software, and (unless regulation really steps up) fraught with excessive corporate surveillance and other misbehavior (and possible attendant vulnerabilities, due to the complexity and methods).
There are some open source media player things I'd like to build, if I can ever spare the time again, but those might be precluded by the available (legal) consumer-hostile media methods at the time.
All legal because you clicked 'agree' on a mountain of legalese. It's past time voters and consumers engage in some serious collective bargaining as to what manufacturers are allowed to put in those agreements, and what the products are allowed to do. We've been 'voting with out wallets', isolated and individually, for decades, and things have only been getting worse.
I never plug TVs into the internet and generally don’t connect any device unless it has a clear need to connect.
In the office I’ve taken to calling connected TVs a security concern, but I didn’t realise how right I was. The conference room TVs there are currently connected (before my time) but I’ll be disconnecting them next week.
They haven't exactly been secretive about it, here is Vizio CTO giving an interview at CES this year over the topic
https://www.theverge.com/2019/1/7/18172397/airplay-2-homekit...
Meat of it starts @15:58
I'm in the market for a new TV. I'm impressed by display technology advances, but everything else about TV manufacturers is unimpressive. i.e. all the "smart" software, the OS, menus, apps, apps, and more apps. And surveillance. No thanks. Please give me compliant HDMI, USB, and other connections and let me feed sources of my choosing to your display controller.
My intention is to keep my TV offline right from the start, but maybe I'm screwing myself out of useful (display) firmware updates?
They found the Ring doorbell records video when someone moves in front of it? Isn’t that what is made for? I’m opposed to subscription cameras and avoid Ring but everyone I know who has one bought it because it records when someone walks in front of it.
I don't have a TV. I'm not into sports, and there's not much else that I care enough about. What I have is a huge display, attached to a Linux NAS/server with a decent graphics card. With a couple TB of video, from various sources. And even it is offline, except when I need to update stuff.
I would settle for some laws to protect against adding tracking and ads later. Something as simple as, "if a device is sold without tracking or ads, they shall never be added through software updates or other means" and "if device has tracking or ads, it must display this fact on the box/other conspicuous places."
Drives me insane buying a device and for it to get slathered with ads six months later.
Discussion of one of the papers mentioned here: https://news.ycombinator.com/item?id=21100404
Our 25yo analog Sony CRT television just gave up the ghost. I looked online for a new television, but all of them come with 'voice control' and other 'smart' features. Do I really want to engage in yet another infosec fight trying to keep what should be a simple dumb appliance from reporting on what I do in my own home?
Samsung smart TV. We had to use it with an external receiver so we set the TV on video input. It works. We turn off the TV, turn it on again, it shows the video input for a brief moment and then hides it with a message that there is no signal and please choose you signal input. No matter what we did, it didn't want to just work.
The solution? connect the TV to internet (in a rural area), wait overnight so it can download the Terms and Conditions without any indication that this is what it is trying to do, sign the T&C and then it works...
I have an old Thinkpad T420 with a non-working display that I attached to my (non smart) tv. I'm very satisfied with Kodi and browsing with Firefox in Linux. Next step would be some voice and gesture recognition (open kinect maybe?)
Has anyone tried implementing DOS attacks on ad providers with the intention of making them block all traffic from your IP? Are these requests signed?
"TV watches you" was discovered at least 6 years ago, here's some discussions from that time:
Can anyone explain this to me? My Roku TV knows what I'm watching even if it's just a .avi file. I'm watching a movie on my Raspberry Pi with Kodi via HDMI. About 30 seconds into the movie it says "You can watch this movie on ... channel."
How does it know what I'm watching? Is it analyzing the feed like Shazam to music?
My wife and I Watch a lot of entertainment in our iPad Pros, only using our TV when we want to watch the same Netflix, HBO, or Prime content together. We are using a Firestick our kids gave us. I am thinking that an Apple TV would be a bit better privacy wise. In any case, I am going to remove my WiFi password from my Samsung TV’s setup config and see if it works without an online connection.
That's why I use ad-block hosts file on the router.
With how complex these systems are, I wonder when companies will start open sourcing and using reproducible builds to show there's nothing up their sleeves. For Microsoft, it clearly gives away too much, but for a company like Huawei facing bans over security, it gets closer to showing there's no government backdoor...unless it's in the hardware.
I read one of the papers, and the channels listed with trackers were largely "long tail" garbage channels that 99.9% of Roku users wouldn't touch. Now, it only lists the ten worst channels, but it leaves it hard to figure out whether or not the use of trackers is prevalent on popular channels like Hulu, Netflix and such.
The Pi-Hole lists to contribute to and subscribe to: https://github.com/Perflyst/PiHoleBlocklist
I’m thinking about buying a screen that has no TV with a basic amazon fire stick (no microphone) for precisely this reason.
Does anyone have any recommendations?
Long ago I was dissatisfied with the smart TVs sluggish smart features so I just gave up and never connect them to internet.
Seems like a good policy now.
Well, you need consent with CCPA. This is going to be fine.
Does any of that studies look at Chromecast?
test