216M Spy TVs – The LG Smart TV Problem [video]

Terms of service are not an absolute "I'm rubber you're glue" type shield against all possible accusations of wrongdoing, however much companies would love us to believe they are.

Even if they did, it's a bad to let clickthrough TOS subvert laws and privacy. This idea that contracts can dismiss all other considerations needs to die.

ToS from a lot of tech companies say the wildest shit that doesn't hold up in court and they should get a penalty for putting that into these documents, as it is misleading and misrepresenting the agreement that the customer has with them.

Until some responsibility for illegal statements in the ToS happens I will read most comments from a ToS with a grain of salt and a lot of skepticism.

How can that be concent?

> Sue them for not telling you the TV is recording you

Good design communicates even without language. It is reasonable to see a toggle switch and think it... you know... toggles. The same reason you see a handle on a door a pill before you read the sign that says push. The sign is literally there because the physical design is telling you something different. It is literally mixed signals.

Apple could have done many different things to make the design clearer. Hell, if they really wanted to keep the toggle like design, make it look like a spring.

But no matter what, the current design is abhorrent because they use the same design language for a temporary toggle and a real toggle. It doesn't take a genius to figure out why people get confused. It is also crazy considering how much Apple prides themselves on design. If it was good design, you wouldn't need the sign...

It should work just like a physical button. I don’t appreciate the “we know better for you so we’ll adjust the behavior accordingly” MITM.

Nah, for the most part the law has been unable to keep up with (or choose to oppose) corporate power, and new ways it's being used. Usually there's no magic quantum doohickey which demands fundamentally new legal theory.

Sufficiently advanced incompetence is indistinguishable from malice, and should be treated accordingly.

The CEO is responsible for what their company does. If a major breach can occur through the oversight or "incompetence" of one worker, the CEO has already failed, whether through negligence or malice.

At some level, and certainly at the level where you get paychecks of 10 million a year for the "huge responsibility you are bearing", then incompetence IS malice!

2. It doesn't really matter if you opt out, because _other people around you don't_: they take pictures in which you show, they tag you, they talk about you, they send you links, etc. Which means they (Meta) build a shadow profile of you anyway.

The "personal responsibility angle" is pure fiction.

There is obviously a fine that could bankrupt the company: this would be a clear signal "do not do this".

There are also many cases where people have been doing everything they should have been, and still got hacked (zero days, for instance).

Now, I do not think people should only be slapped on the wrist in that case: it still needs to be significant so companies carefully decide to store only the data they really do need!

Or, if that does not happen, when enough people rise up in revolution and take the compensation for themselves.

Or, never.

If enough people vote enough or revolt enough, they cannot be stopped. But the incentives for too few people rising up are too costly. They work hard to keep the equilibrium in that balance.

But I would absolutely not install an app for that.

Most apartment buildings in the US already use face-tracking cameras to get this log

It's even worse if some staff wrote paranoid in your file, 'cause they'll argue it's good for "exposure".

In Poland/EU we have an (ever growing) list of forbidden clauses that even when written and signed by consumer are null and void. And I think these can be enacted retroactively - when corporations invent new shady clauses, government steps in and tells them these are invalid.

This helps to even out the consumer-corporation field.

I'd love to have a similar standard applied in the US but I'm not holding my breath.

For another perspective, check out the comment you're replying to.

So just treat it as a best case scenario, knowing that it can get even worse.

Because technology got ever more complex. A TV of yore? That thing operated on (relatively) simple physics alone, at the cost of requiring an absurd amount of broadcast infrastructure to make sure a TV signal could be received across the country.

Modern TVs however... digital modulation schemes with a lot of signal processing wizardry allow TV reception with far less broadcast towers and far better quality. You got satellites and with these a myriad of control schemes (DiSEqC, Unicable, ...). You got Pay-TV that requires decryption. You got HDMI CEC to allow your TV to remote control your DVD player.

And all of that complexity requires firmware which means it can have bugs which means you need a firmware update capability and when you're at that point you can just go and slap something Linux on it and get all the apps for streaming services.

1080p, but the picture far outstrips most other TVs I've owned to this day.

I have zero plans to change it, and it's usefulness has outlasted the Chromecast that's connected to it.

Yes, I put the first ads on Smart TVs. Apologies.

The problem is we've not enforced any strong regulation against ads, downgrade rights or hack ability.

I don't need "better performance" from the system built into my TV I just need it to run Kodi.

They can just start a capture, record to RAM / storage, and retrieve it later when it is reconnected to the network.

Otherwise if it's disconnected, it is still hard to exfiltrate the data somewhere. Maybe they could get creative via Bluetooth, but then you would need a cooperating device in proximity of the device.

I've just used an old Intel NUC with Debian stable, a remote mini-keyboard and an automounted Samba share on the network forever. It's no more hacked together than any other computer. I do make the mouse pointer and the fonts real big. No apps required. Don't really need the keyboard except for mplayer hotkey presses - just the touchpad on it; if I need to do something that involves typing other than typing a password, I usually ssh in.

I think people are lowkey addicted to having shit sliding in and out and constantly being advertised to. How do you know what to watch unless somebody is constantly bombarding you with options? If it doesn't look like a star trek control panel, is it really TV?

If you like that, you can install Kodi. I haven't tried it since it was XBMC because I found the interfaces annoying and it had trouble dealing with networks, but I'm sure it's better.

> I've yet to hear of a reasonable recipe to isolate and secure such connected TVs

I don't even try. I overpay for dumb tvs in the present, or underpay for 10 year old tvs pre-Applefication. I've never owned a network capable television, or one with apps. I wouldn't.

edit: if your NAS is a separate box that can sit in proximity to your television, you could probably just run all of this stuff directly from the NAS. They spend most of their time doing nothing at all.

But I guess like an xkcd comic, someone is obligated to raise the issue every time TVs come up.

Samsung were openly bragging about this on their website some years ago (for the benefit of their advertising partners) but have recently muddied the waters when I check their site again, couching it in language mentioning privacy and other evasive language:

https://www.samsung.com/us/support/answer/ANS10010616/

As far as I know, they don't literally scan your media libraries; they screenshot whatever you're watching through HDMI (most often cable / satellite boxes), as those devices don't provide the telemetry that normal apps do. This info is used for audience measurement (thing Nielsen ratings), as well as showing you ads that are actually likely to match your interests.

"Starting in 2014, Vizio made TVs that automatically tracked what consumers were watching and transmitted that data back to its servers. Vizio even retrofitted older models by installing its tracking software remotely. All of this, the FTC and AG allege, was done without clearly telling consumers or getting their consent.

...

"Vizio collected a selection of pixels on the screen that it matched to a database of TV, movie, and commercial content

https://arxiv.org/pdf/2409.06203 shows LG and Samsung doing something similar

I'm hopeful that there will be sufficient distrust that "jailbreaking" or "rooting" TV controller boards will be turnkey enough to move to something like OpenWrt or GrapheneOS but for TVs.

Not GP, but I do so to make sure my TV doesn't try to connect to a different network. I provide specific IP addresses to the ethernet-connected interface and then block those IP addresses.

I suppose I could also move the TV to an isolated VLAN, but I spent months (the device was purchased nearly, or perhaps even more than, a decade ago) monitoring network traffic to determine to where (via DNS queries and packet captures) my TV was trying to phone home and blocked all egress for the TV and ingress from the sites/IP addresses to which the TV tried to connect.

I suppose that newer TVs might be sneakier (with the kind of WiFi surfing mentioned in TFA and/or installing cellular modems) in their attempts to bypass user control and when I need a new TV, I'll burn that bridge when I come to it.

But for now, my TV can't phone home. Or I'd have thrown it away years ago.

Idk why this is so often citied in Smart TV boogeyman arguments.

https://en.wikipedia.org/wiki/Tempest_%28codename%29

The problem is really that this tracking is at an absurd scale. So while an individual attacker isn’t targeting you and buying your profile from LG, the data is out there, and once it’s out there, it’s probably easy to get on the dark web if someone did want to do something nefarious. So it’s not just the surveillance capitalism.

  > There *has* to be some complex math involved.

Their explanations are typically around markets being myopic and that low competition fucks things up even more. But we do make small decisions and they add up. I think many of the problems in the world today come from the accumulation of many small decisions, which is why they're hard to address. Obviously some people have more power than others, and more frequently have high power, but we should still look for our opportunities and not abdicate when and where we do have power. It is important for us to push back when we can. The top always wants to convince us that we have no power and we try to convince ourselves that's true because we believe that if we have power that makes us culpable, but I don't think that's true.

[0] my goto example is AWS. It's easy to find articles about how Azure or GCloud are "doing better" but AWS still has more total customers. But AWS is being "punished" for being at the top because it is just harder to grow percentage wise when you have a larger base amount (note, it isn't a zero sum game)

Seems pretty logical, no?

How do we sell more TVs? Be a cheaper and or better choice. If we're already doing well technically, sell customer data to discount the TV and appear more attractive.

If this is ethical / how much disclosure you'd need to give to customers so they can make this informed choice is a whole other discussion...

And it feels like an inflationary behavior: people need marketing because the product doesn't sell itself because it is neglected in favor of data collection and marketing that is needed because GOTO 1.

Pure naked greed, something to be celebrated in our Ferengi style capitalist system.

How do you audit that ? it's not like they opensource their OS.

Okay, but it does work until then. "Things could change in the future" is definitionally true.

Never connect the TV in the first place, and you don't need to physically alter the hardware, firmware, or TOS agreements.

If you're not using the defining feature of a TV (the OTA tuner), why not buy a monitor instead of a TV?

(Next time I have to replace our house's TV, I'm seriously considering buying a separate SBTVD tuner and a monitor instead of a TV, if ignoring the "smart" features of these TVs by not connecting them to a network starts getting too difficult.)

Even having an account at all, and being able to see that I have a subscription, or that I previously watched that video, is personal data they collected.

So the Privacy Policy is what you “agree” to let the company do with that data. How do you even begin to differentiate the superfluous stuff they track just for ads, on a technical level without workarounds?

And then think about banning “transferring personal data to a 3rd party.” Does that mean I can’t host account data on AWS, or use a hosted database, be causing I’m transferring data to a different company which can presumably also access it? That’s what the privacy policy has to allow, and why sites have so many “partner services”

does anyone know of a reputable site which rates companies by things such as trustworthiness?

are any companies at all trustworthy anymore? like literally any?

To be fair, most TVs on the market are buying panels from the same few manufacturers. For example, Hisense sources panels from part of LG. I think Samsung is another manufacturer.

So a new company could theoretically access these panels to make a privacy friendly TV without as much capital.

But like you say, it wouldn’t be able to compete on price, because the ad tech lets other companies sell at a loss.

And they still do it anyway because why wouldn't they? My $4K+ TV still wants all sorts of "personalized viewing experience" access.

I mean, LG would probably also pay someone to run around going "it's just funny, is all" in support if anyone noticed this pathetic astroturfing.

Who the fuck ever buys anything just because of an ad??

That they didn't ALREADY know about or were going to buy anyway?

The ads industry is a racket. At best it's a case of the emperor with no clothes: every one believes it works because everyone says that it works.

At worst, it's a thin veil for obnoxious privacy-raping constant global surveillance.

Also taking this moment to head off two common responses, for ettiquette's sake:

1. The alternative is catalogs! Products are listed accurately and thoroughly, and we deal with edge cases as needed. This is especially tractable in the internet age, of course. See: [the Wells-Fargo Wagon](https://www.youtube.com/watch?v=fP0E1tbfi2g)

2. Yes, you are affected by advertisements. I don't care who you are: if you're on HackerNews from anywhere other than shack in rural Montana, you are affected by advertisments. Many (most?) ad spend is on "brand advertising", which isn't trying to get you to take any conscious action at all -- it's swaying your subconscious.

This sorta feels like the problem with "rent fixing" via algorithms from a few years back. The system has been bumbling along fine enough for a while, but the arrival of mass computing makes these tactics so insanely effective that they become unfair.

The "own the glass" thing is the most consumer disrespect I have heard in a while. They claim they own the TV and YOUR LIVING ROOM.

They know they are invading your privacy, they know the make it fricking hard for you to be able to disable it. They are pyschos. I'm ditching buying LG forever

Even if you think they're running some sort of massive botnet, the fridge being part of it is still implausible. They probably have billions of phones and tablets alone, plenty enough to scrape/DDoS the entire internet several times over. There's no need to add clandestine hardware into non-smart fridges.

1. Do not connect to network 2. Create unauthenticated WiFi network 3. Monitor WiFi network

Strange no one has ever done this simple af test to backup their claims

It's much easier to just throw a $10 5G modem in there, pay the $2/year subscription fee for service, and extract data that way. Assuming a 5-10 year relevant lifespan of the TV, they'd throw $20-$30 on top of the sales price for the modem and 10 years of service.

The 5G modem could run completely independent of the wifi network, be a completely different circuit, and you'd never know it was there.

Uploading the weeks, months, or years of locally-stored activity [0] data? Text compresses really well and local storage used to be very cheap.

[0] ...mic voice transcription, how often you use the thing, for how long, and a best guess (because of lack of time sync) at when, "automated content detection" logs [1], names of files you've fed to the thing, -if equipped with a camera- number of people in the room and interesting information about them, etc, etc, etc...

[1] ...assuming that that can be done with data loaded from the factory, which I kinda doubt...

https://www.pulse-eight.com/p/104/usb-hdmi-cec-adapter

The average user would not realize LG was the reason, if they do they will loose more money and effort; LG's reputation and public image won't be even damaged enough for them to take a notice. You are an ant for them and ants are only powerful if they work together.

Then they'll get a joke fine, and continue as before. Maybe cut the price for a while, until they reintroduce it with another pretext a few years down the line.

The legal systems that are in place (at least, those in the US) are not sufficient or even designed to act in any amount of favor of individuals. Even leveraging collective action (class action cases), most individuals are left worse off after judgement when they are wronged. Signalling that you are an affected class is effectively an admission of, at minimum, association - and worse guilt, of whatever an inteligence agency may suspect you of. Intelligence is not justice, and does not "protect" individuals under the same standards. If a government wants you to be wronged, they will accomplish it regardless of law, and the information they have regarding you will be leveraged as aggressively as possible. If you are simply wronged, the cost of accomplishing justice is often insurmountable.

In the most innocent case of wrongdoing by one of these surveilance devices, what would you, as an individual, do if your bank details were compromised as a result of a "smart" device exposing your credentials to bad actors? Obviously, you would contact your banking institution and try your best to rememedy the situation. But say, for example, this smart device is on your home network, has your login details, and possibly used your 2fa details because you used it to log in to your banking institution. That is You™. You logged in. You actioned something. It's verifiable because of your IP and your cookies and your 2fa code and the heuristics of your device usage (time of day, and the previous factors, and more). Many smart device applications already include SDKs that act as residential proxies - it's not impossible to believe that malicious ones may act as MITM or such. The possibility of 0Day expoloits or even backdoors can never be ruled out as you do not own these devices.

People should be subject to shame. Every government and every company are composed of people (for now) - these people are what action these possible futures, and who action the exploits of now. They are shameless by trade because that is their value. Much like the adtech industry thrives on the compromise of compensation to overcome the shame of doing wrong, so does intelligence and clandestine commercial exploitation. Money affords people the things that they want and need, which are becoming ever more impossible to acquire without succumbing to the shame of doing Bad Things™ to acquire it. You are never going to be able to sue LG because your bank details were leaked by a public DB or some other endpoint. Nobody will. Because the value of the information that LG provides to governments circumventing established anti-surveilance law (in the US, the 4th Amendment) through sales is worth more than any dollar amount it costs these parties.

Shame on every fucking one of you stains who implements this, if you can feel it, hidden in the walls of your owned property.

0: https://en.wikipedia.org/wiki/Five_Eyes 1: https://en.wikipedia.org/wiki/Israeli_espionage_in_the_Unite...

"Criticizing Israel" has moved from edgy subversive to lamely pedestrian in the last few years.

There's no great secret that Mossad needs to unearth by spying on you watching tv.

Consumers will buy it if they're told they "never have to worry about an over the air TV antenna again" because it has a magic 5G antenna in it!

https://developers.google.com/maps/documentation/geolocation...

https://wigle.net/

Both games weren’t particularly intensive, the one i remember last was divinity original sin 2, but i think both games ran on unity.

Performance mode mostly fixed it, but blowing out several years of dust from the vents properly sorted it out.

But better watch the whole video. Then get snarky again ;)

Plus, the HDMI-CEC "just works".

You've accidentally proven my statement: If you're not specific, you're not helping.

It's only meant to spy on you in the way that won't get really bad viral press right now. If it spies on you in the way that people notice and object, it was clearly a honest mistake.