Hacker News new | past | comments | ask | show | jobs | submit login
The spies in your home: How WiFi companies monitor your private life (proton.me)
110 points by austinallegro 3 months ago | hide | past | favorite | 46 comments



Maybe of-topic but related,

For years I've wanted a robot vacuum cleaner with home mapping (to optimize routes, limit sections even by day, etc.), but they all ask you to connect to the Internet in order to use them... It is madness.

Map of your house, habits/presence and so on, I don't want to give any ideas. So I prefer a manual vacuum cleaner as one finish faster and better, at time one do a bit of exercise also.

The only way I could think on buying one of such things is to be able to use all such mapping functions without the device being connected to the internet, and also that nothing could be connected to the device remotely if I don't give permission at that moment (Even to program it I'd prefer to connect it via USB to whatever, with the requirement that the app working as UI cannot connect to the internet, of course).

I don't like this trend of recent years with devices on general. Looks like "smart" is an euphemism for "spy", spy-tv, spy-phone, spy-home, and so on. The key here is, internet connected.


Might be worth looking into valetudo, a local-only replacement for cloud services on robot vacuums. This enables mapping, etc. but does not require a connection to the internet.


You really don't need mapping to get reasonably efficient cleaning. We have a robot that's nearing 15 years old with no mapping, but the algorithm it uses is pretty effective. The mapping represents huge over-engineering for what is a pretty simple problem.


Plume can use IEEE 802.11bf Wi-Fi Sensing to monitor movement in homes, https://arstechnica.com/gadgets/2020/03/from-wi-fi-to-spy-fi...

> Plume is doing real-time analysis of extremely low-level RF data pulled from the Superpods' radios. This is real motion detection, with no gimmicks involved.. Consumers who are already paranoid about mesh telemetry really aren't going to love the addition of motion detection.

RF/radar human detection is present in Intel Meteor Lake and likely to appear in upcoming "AI" PCs.


why is this a thing we want in our computers again? how does this help consumers buying the hardware exactly? I mean i get why the nsa or adsense might want it but they aren't the ones buying the "AI" PC are they. where is the value ad proposition for consumers?


I can think of a couple of uses. None of them require the cloud. None are worth the investment.

One is sensing where people are in the home. Could be used to turn on lights, but that isn’t worth with LEDs. I would love to know where my cats are without searching the house,

Another is sensing gestures. Instead of talking to home assistant, you can make rude gestures. This would primarily be useful for the deaf.

For computers, might be good enough for tracking head position. Or track hand position for pointing at screen. Niches uses but useful if can use builtin WiFi than special sensor.


Samsung spyware in TV's and smartphones and Lenovo rootkits in laptops (random examples) have shown that customers only need 1 simple value proposition to be ok with being spied on: slightly cheaper hardware.

The companies can offer cheaper hardware and software, because they (and their business and government clients) spy on you.

TLDR: end-users are not the only customers.


I think this is inaccurate, people simply feel like its hard to keep up with all the abuses and that they are powerless to stop them by voting with their wallet.

But they do want politicians to outlaw such practices, which indicates they aren't happy and satisfied with the status quo.


It's a "feature" introduced to allow businesses to track their employees' movements in the office.


I only use ethernet for my computer and I don't even have a wifi card.

Switching to a wired ethnernet only router might be the way to go. But there is still other concerns such as the Intel and AMD management engines.


It doesn't matter. You probably don't live in the forest. You have neighbours, probably that kind of people that don't understand technology and buy the latest fancy TV, laptop, or allow the ISP to install whatever equipment they want "for free".

BTW, how are you going to avoid installing the ONT from your ISP?


copper is going to be around for a very long time, 20 years ago we were supposed to all have fiber in 10 years. Yeah, I will believe it when I see it.

Also its possible from my understanding to use your own OST. At the very least you could just put it in a makeshift faraday cage.

> You probably don't live in the forest. You have neighbours

Lot of people in the United States live in very rural areas with their nearest neighbor being 5-10 miles away.

The cheapest places to buy are also in rural areas. With the popularity of work from home rising, its not crazy to think a large amount of people will start living in secluded places.

Anyway, packing like a sardine in a city is gross and for gross people. If you can't be happy alone in nature, don't deserve to be happy. Urbanites are the lowest species of human, with the highest crime rate and most drug use and homelessness. They are all depressed, neurotic freaks because they live in an environment where you xan't even see the stars in the night sky where there is constant noises every second of the day. No wonder these people all need anti depressants and anti anxiety medication.


Wi-Fi in 2023 Meteor Lake and 2024 Lunar Lake is integrated into the SoC.

In older devices, an M.2 Wi-Fi radio can be physically removed.


Are you talking about CNVi? It predates Meteor Lake by quite a bit.

Also, the implementation on the SoC is only part of the WiFi stack, it still needs an additional RF chip.


Thanks, didn't realize it went back to 8th gen.

BT/WiFi split between SoC and PCIe device will be fun for IOMMU passthrough.


individuals can avoid this types of devices but how can they protect themselves from their neighbors,especially in cities. RF shielding wall paint? live in a farday cage? I guess the tinfoil hat wearers are appearing less and less crazy these days.



Old Wifi uses a very similar frequency band to microwaves, so you just need to target your neighbors with a modified microwave that is much stronger than your average wifi router. What could go wrong?

Jamming is probably indeed an option. Illegal, but detecting the source and blaming you could be difficult. There is no technical countermeasure against jamming aside from using a different frequency, which would break any form of wifi.


https://news.ycombinator.com/item?id=34424677

  shielding
  jamming
  regulation
  publicity


This kind of thing is why I wish Apple would go back to building Airport routers and only consider “pure” dumb APs as possible replacements.


You don't need Apple to achieve wireless freedom, all you need is a few devices which can run OpenWRT. Use one of of them as router, the others as APs and you're set. The router can also be a virtual one, running in a container or VM on the server-under-the-stairs. The APs can be anything which you have laying around or managed to scrounge somewhere. This is what I do home on the range - farm really - where I have several APs spread around the area, connected together using Cat5 using a number of VLANs for different wireless networks: one for the private network, a guest network, an IoT network, an OPS network, a surveillance cam network and a low-speed open network called 'snigelnät' (Swedish for 'slug net'). The APs don't do routing, the virtual router of course does not do WiFi. Some of the APs are also connected to local POE switches for cameras. The whole setup has been mostly maintenance free since I got it up and running some 4 years ago, it offers way more functionality and flexibility than anything offered by commercial entities like Apple and it was cheap to build.


I contributed patches to OpenWRT since the WRT54g days and have a couple of travel routers that I upgraded myself. But the quality of decent, home grade compatible equipment is pretty dismal, so if you can tell me what boxes you used I'd be curious.

However, I do not want to have to support, flash or manually patch my home Wi-Fi, which currently consists of no less than 5 Airport Extreme base stations connected via Cat 5. But I also don't want it to send data to the cloud or rely on proprietary apps for management (I tolerate Apple's Airport Utlity because it has worked flawlessly for decades).


In the current setup I'm using 3 * 'Xiaomi Mi Router 4A Gigabit Edition' (xiaomi,mi-router-4a-gigabit, ramips/mt7621) as 'main access points' which have thus far worked well. I bought these new specifically for this purpose and never allowed them access to the 'net before flashing OpenWRT. I disable routing/firewall/dhcp on these devices, they are pure access points. I'm also using a number of repurposed devices from different manufacturers - Belkin, Technicolor, Netgear, Asus, D-Link and probably some others I forgot about - for local access points and as local switches, again with routing (etc.) disabled. There are 6 different wireless networks (LAN, guest, ipcam, IoT, OPS and the open but slow 'snigelnät') which are trunked to the APs over VLANs.

I'm running a dual-stack network (IPv4/v6) using DHCPv6 for deterministic IPv6 addresses on hosts, all that is handled by the virtual router running in a container on Proxmox on the server-under-the-stairs. This is also where I run Wireguard (VPN) and adblock.

Maximum wireless speed varies depending on which AP you're connected to, in practice up to about 550 Mbps when using the Xiaomi 4A APs (advertised as AC1200). Range is sufficient for me to have a WiFi connection when I'm in the middle of a 3.5 hectare field on the opposite side of the road, about 150 m and a number of walls plus some trees separated from the nearest AP.


Thanks! I actually like most of the Xiaomi hardware I’ve come across, just never used that model. Have added it to my list of prospective replacements (will be a year or so before I actually worry about doing the upgrade)


Make sure the model they ship is supported before you buy, there seem to be several versions of this device - or devices with very similar names sold as '4A Gigabit Router' - which are not necessarily supported by OpenWRT. I was actually surprised to see this device still being sold on Aliexpress, by now it is a bit dated but it certainly works well as an AP. It is quite cheap, around €30.


Apple is an advertising company too. They conveniently exempt themselves from the tracking restrictions they put on their competitors, like blocking access to device identifiers. You would be a fool to trust them with your privacy.


Apple's primary business model revolves around selling hardware, software, and services rather than advertising. Unlike companies such as Google and Facebook, which generate the majority of their revenue from targeted advertising, Apple earns most of its revenue from the sale of iPhones, Macs, iPads, and various services like iCloud and Apple Music. This fundamental difference in business models shapes their approach to user data and privacy.

Apple has positioned itself as a company that prioritizes user privacy. Over the years, Apple has implemented numerous privacy features, such as App Tracking Transparency (ATT), which requires apps to obtain user permission before tracking their activity across other apps and websites. Apple's privacy policies are often stricter than those of other tech companies, reflecting their commitment to protecting user data.

The claim that Apple exempts itself from tracking restrictions is misleading. While Apple does have access to certain data from its own ecosystem, such as app usage and iCloud data, it does not sell this data to third parties or use it for targeted advertising in the same way that companies like Google do. Apple's advertising business is limited to its own App Store, News, and Stocks apps, and the data used for ad targeting within these apps is based on user interactions within Apple’s ecosystem, with strict limits on data sharing.

Apple provides users with clear choices and transparency about how their data is used. With features like App Tracking Transparency, Privacy Labels, and the ability to limit ad tracking, Apple gives users more control over their data than most other tech companies. Users can choose to opt-out of personalized ads and tracking, which is a level of control not universally offered by other major tech firms.

Apple’s privacy practices are subject to regulatory oversight in various jurisdictions. Any attempt to exempt itself from its own privacy rules would likely face legal challenges and public scrutiny, further deterring Apple from engaging in practices that would undermine user trust.


> Apple provides users with clear choices and transparency about how their data is used.

And this is where this fantasy story went too far. Just a simple search of "Apple dark patterns" will yield years of tricking people into giving away massive amounts of data that they wouldn't if they really knew how the controls worked.

I'll also leave this at: you have no clue how Apple uses your data. To say otherwise is a flat out lie. SaaS is not a panacea because it's Apple and they market "privacy" and/or "security".


While it’s true that dark patterns—design tactics that subtly guide users into making certain choices—are a concern in the tech industry, Apple has generally been seen as more transparent compared to some other companies. For instance, Apple’s introduction of App Tracking Transparency (ATT) was a significant move toward giving users more control over their data. If Apple were primarily motivated to trick users into giving away data, initiatives like ATT would be counterproductive to that aim.

The assertion that “you have no clue how Apple uses your data” oversimplifies the situation. While it’s true that understanding the full scope of data use by any large tech company can be difficult, Apple’s privacy policies and terms of service are publicly available and outline their data practices. Apple’s approach to privacy is built around minimizing data collection where possible, using on-device processing, and keeping data anonymous where feasible. For example, Apple’s advertising platform does not follow users across the web; it uses on-device data and does not share data with third parties.

Software as a Service (SaaS) is a broad category, and it’s true that not all SaaS models are created equal in terms of privacy. However, Apple’s version of SaaS is integrated within an ecosystem that they tightly control, which reduces the reliance on third-party data brokers and limits the potential for data abuse. While it’s always wise to be cautious about data privacy, Apple’s track record—despite some valid criticisms—shows a commitment to privacy that sets it apart from companies whose core business is data monetization.


I was one paragraph in before I realized this is GPT. Why are you replying to human thoughts with AI garbage? Wtf go interact with people in person.


It's accounts like yours that ruin HN. Nice try with the AI generated response.


I wrote that. Took me an hour.

I think it’s snarky accounts like yours that ruin it, frankly. What’s wrong with nerds like you?


I am gonna call you on that. We can choose a plagiarism checker of your preference, would like to see how much ai generated content is in your hour long effort.


No, you didn't. Looking through your history you clearly leverage AI responses a lot. Accounts like yours need to be flagged because what you actually write vs your plagiarism is night and day. If you're going to do this at least spend time mimicking yourself so the post actually looks genuine.


First of all, everything here I either have personal experience with or googled it. No AI. Second of all, there is no plagiarism claims against internet comments. Come on. I am not “claiming” anything. Openly admitting that I found information only. Take away my internet degree.


Plagarism: "Plagiarism is the use of another's work, words, or ideas without attribution."

You clearly copied your response (twice) as it has no personal intonation as do your defensive posts. I guess you'd rather write out the defense of your copy and paste?

I ran your (clearly AI generated comments) through a number of checkers and either you write exactly as AI does very often, or... Yeah. Enjoy the facade!


“You clearly copied your response (twice) as it has no personal intonation as do your defensive posts. I guess you'd rather write out the defense of your copy and paste?”

I really have no idea what you are talking about.


I think you're being overly paranoid. Apple is not an advertising company. They are a hardware company first and foremost, with a content and services business that goes to extreme lengths to ensure privacy.

The Apple routers and access points did zero traffic inspection (other than IGMP) and had absolutely no tracking features. Please do not bring biased, toxic reasoning into the conversation.


Their hardware business is flatlining and they are relying on “services” for growth. Guess what “services” is? Primarily the 30% tax on transactions, but also their fast-growing advertising business.

As for data collection, iOS is only marginally better than Android, and Apple exempts itself from the IDFA controls it imposes on 3rd-party apps.

https://www.tomsguide.com/news/android-ios-data-collection


> I think you're being overly paranoid.

No shortage of paranoid comments here


I think it’s okay to be paranoid in this space. Most of us are playing the role of consumers here. Strictly identifying the data collected, and identifying Apple’s interest/ disinterest in using that data for its own shareholder’s profit is definitely worth looking at from a consumers pov.


With the icloud private relay they say nobody can see both my IP address and the websites I visit. [1]

  - Your IP address is visible to your network provider and to the first relay, which is operated by Apple. Your DNS records are encrypted, so neither party can see the address of the website you’re trying to visit.  

  - The second relay, which is operated by a third-party content provider, generates a temporary IP address, decrypts the name of the website you requested, and connects you to the site.
I wonder whether this disables the surveillance by the wifi companies like Plume.

[1] https://support.apple.com/en-us/102602


I was working with a major telecom years ago to use this tech for fall detection to help with caregiving in older adults. Interesting use case I thought.


Perhaps Plume will be the next company to be sued by Texas...


“It’s no secret that ISPs can monitor which websites you visit” Given a lot of devices use DoH by default, it’s not quite that stark…


DoH means nothing without ECH, which is still vanishingly rare.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: