An engineer got curious about how his iLife A11 smart vacuum worked and monitored the network traffic coming from the device. That’s when he noticed it was constantly sending logs and telemetry data to the manufacturer — something he hadn’t consented to. The user, Harishankar, decided to block the telemetry servers’ IP addresses on his network, while keeping the firmware and OTA servers open. While his smart gadget worked for a while, it just refused to turn on soon after. After a lengthy investigation, he discovered that a remote kill command had been issued to his device.

    • Tenderizer@aussie.zone
      link
      fedilink
      English
      arrow-up
      5
      ·
      5 days ago

      He did. Where he said the article looked AI generated and so he wasn’t going to waste any time with it.

  • spaghettiwestern@sh.itjust.worksOP
    link
    fedilink
    English
    arrow-up
    56
    ·
    edit-2
    7 days ago

    My robot vac will only operate when connected to the Internet so it’s only allowed to communicate when actually in use. As soon as it returns to the charger Internet access is automatically blocked.

    Unfortunately the manufacturer has deliberately made this as inconvenient as possible. If communication is blocked for more than a few hours the vacuum loses all maps and will no longer even load saved maps from the Tuya app. To use it the vac must be powered down and the app killed. Only then can a saved map be restored.

    It’s too bad it’s so useful.

    • mal3oon@lemmy.world
      link
      fedilink
      English
      arrow-up
      13
      ·
      6 days ago

      For me the worst part is that someone developed the functionality to monitor and track, until the signal is lost, and if so, kill. It’s really crazy how daring this is.

  • percent@infosec.pub
    link
    fedilink
    English
    arrow-up
    9
    ·
    6 days ago

    I wish companies would at least offer a “no data collecting/selling” price option. Like, how much would they make from selling my data? Just give me the option to pay that extra amount so I can buy a vacuum without thinking about how it’s spying on me.

    • Smoogs@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      6 days ago

      Do they not just a cheaper version that could come without wifi or Bluetooth? I usually get that option where available for any products. because I’m a cheap ass.

      • FlashMobOfOne@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        6 days ago

        There are older models you can get that work that way. They’re just less convenient in that you have to clean them out yourself. I had one for a long time, but I wanted one that is self-emptying.

    • deathbird@mander.xyz
      link
      fedilink
      English
      arrow-up
      12
      ·
      6 days ago

      My concern is that they’ll include the equipment for spying on you, and just enable it later.

      I bought a Hue because it said “no online account required!” Later they changed their mind.

      I want the promise plus open standards and a base of libre software. I want them to tie themselves to the mast.

      • percent@infosec.pub
        link
        fedilink
        English
        arrow-up
        4
        ·
        6 days ago

        Yeah, good point. Owners of Samsung “smart” refrigerators started seeing ads on them recently.

        I’m sure there was some sort of legal terms that users had to agree to to enable that, but it still feels like a scam. Some amount of those fridge owners would not have bought the fridge if they knew there would be ads on it at any point in time.

        • deathbird@mander.xyz
          link
          fedilink
          English
          arrow-up
          1
          ·
          5 days ago

          I mean, if I felt I could control the little computer in a smart fridge without expending excessive effort to do so, I might be interested in getting one myself. Absent other concerns, a tablet integrated into my fridge could be handy to monitor the appliance, make quick or even automated grocery list updates, etc. Not earth shattering, but still marginally useful.

    • Grass@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      1
      ·
      7 days ago

      I don’t think any compatible machines can be acquired in my region any more. The only one I saw semi recently had a revision a few years ago but no packaging or model change to match so you can’t verify if its the older model that works or the newer one that doesn’t.

  • notsure@fedia.io
    link
    fedilink
    arrow-up
    7
    ·
    7 days ago

    …when i ‘buy’ something, should i not own and be able to use it and all functions until the end of it’s mechanical processes?..

  • stiffyGlitch@lemmy.world
    link
    fedilink
    English
    arrow-up
    2
    arrow-down
    1
    ·
    7 days ago

    what…? how much money did that Roomba cost for him to spend that much time and effort on recoding it?!

  • aceshigh@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    ·
    7 days ago

    As a layman, can someone explain what the ramifications of smart devices sharing your data is. I know it’s bad, but I don’t understand why it’s bad and how it’s used against you.

    • badgermurphy@lemmy.world
      link
      fedilink
      English
      arrow-up
      9
      ·
      6 days ago

      The problem that is created by a person’s private data being collected against a person against their will is primarily a philosophical one similar to the “principle of least privilege”, which you may be familiar with. The idea is that those collecting the data have no reasonable need for access to it in order to provide the services they’re providing, so their collection of that information can only be for something other than the user’s benefit, but the user gets nothing in exchange for it. The user is paying for the product/service they get, so the personal data is just a bonus freebie that the vendor is making off with. If the personal data is worthless, then there is no need to collect it, and if it does have worth, they are taking something of value without paying for it, which one might call stealing, or at least piracy. To many, this is already enough to cry foul, but we haven’t even gotten into the content and use of the collected data yet.

      There is a vibrant marketplace among those in the advertising business for this personal data. There are brokers and aggregators of this data with the goal of correlating every data point they have gotten from every device and app they can find with a specific person. Even if no one individual detail or set of details presents a risk or identifies who the specific person is, they use computer algorithms to analyze all the data, narrowing it down to exactly one individual, similar to the way the game “20 questions” works to guess what object the player is thinking of–they can pick literally any object or concept in the whole world, and in 20 questions or less, the other player can often guess it. If you imagine the advertisers doing this, imagine how successful they would be at guessing who a person is if they can ask unlimited questions forever until there can be no doubt; that is exactly what the algorithm reading the collected data can do.

      There was an infamous example of Target (the retailer) determining a young girl was pregnant before she told anyone or even knew herself, and created a disastrous home situation for her by sending her targeted maternity marketing materials to her house, which was seen by her abusive family.

      These companies build what many find to be disturbingly invasive dossiers on individuals, including their private health information, intimacy preferences, and private personal habits, among other things. The EFF did a write-up many years ago with creepy examples of basic metadata collection that I found helpful to my understanding of the problem here:

      https://www.eff.org/deeplinks/2013/06/why-metadata-matters?rss=1

      Companies have little to no obligation to treat you fairly or even do business with, allowing them to potentially create a downright exile situation for you if they have decided you belong on some “naughty list” because of an indicator given to them by an algorithm that analyzed your info. They can also take advantage of widely known weaknesses in human psychology to influence you in ways that you don’t even realize, but are undeniably unethical and coercive. Also, it creates loopholes for bad actors in government to exploit. For example, in my country (USA), the police are forbidden from investigating me if I am not suspected of a crime, but they can pay a data broker $30 for a breakdown of everything I like, everything I do, and everywhere I’ve been. If it was sound government policy to allow arbitrary investigation of anyone regardless of suspicion, then ask yourself why every non-authoritarian government forbids it.

      I know that’s a lot; it is a complicated topic that is hard to understand the implications of. Unfortunately, everyone that could most effectively work to educate everyone on those risks is instead exploiting their ignorance for a wide variety of purposes. Some of those purposes are innocuous, but others are ethically dubious, and many more are just objectively nefarious. To be clear, the reason for the laws against blanket investigations was to prevent the dubious and nefarious uses, because once that data is collected, it isn’t feasible to ensure it will stay in the right hands. The determination was that potential net good of this kind of data collection is far outweighed by the potential net negatives.

      I hope that helps!

      • aceshigh@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        6 days ago

        That’s an interesting article. The biggest insight is that it can go around hippa for example.

    • Sir_Premiumhengst@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      ·
      7 days ago

      A detailed room-mapping scan is basically a wealth report disguised as vacuum telemetry: square footage, room count, layout complexity, “bonus” spaces like offices or nurserie; all of it feeds straight into socioeconomic profiling. And once companies have that floor plan, they’re not just storing it; they’re monetizing it, feeding it into ad networks, data brokers, and pricing algorithms that adjust what you see (=and what you pay) based on the shape of your living space.

      And a mapped floor plan also quietly exposes who lives in the home, how they move, and what can be inferred from that.

      • aceshigh@lemmy.world
        link
        fedilink
        English
        arrow-up
        0
        arrow-down
        1
        ·
        7 days ago

        Isn’t this information already available? Like if I’m house shopping I know how many rooms the house has and the area of the house.

        • BussyCat@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          ·
          6 days ago

          You know rough dimensions you don’t have a robot going through and literally mapping every item on the floor, high traffic areas , details about amount of people that live there, possible pets, and then tying it to your IP and then selling that to advertisers.

          The crazy thing isn’t that they do that it’s that you have to pay money for an item that then does that without your permission and if you attempt to stop it they brick your item that you paid hundreds of dollars for

          I don’t know for certain if they sell your data (but they probably do) but you can use a wifi router and how it reflects in a room you can fully map a room with enough accuracy that you can tell what a person is typing on a keyboard which is kind of terrifying if you think about it

            • BussyCat@lemmy.world
              link
              fedilink
              English
              arrow-up
              2
              ·
              6 days ago

              They sell it, some of it is sold to advertisers but recently companies like palantir have been buying these large collections of data, de anonymizing it and then they can use it to develop profiles about people which they can then sell to the government

              And that’s what they admit to doing

              Once your data is out there it’s essentially impossible to get it back

    • Lvdwsn@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      7 days ago

      You might get some snarky comments, but the way I envision it is that the fuller of a picture companies can get of you (when you’re running a vacuum, when you’re driving, when your lights are on and off, etc.) the more data they have to try and run predictive analytics on your behavior and that can be used in a variety of ways that may or may not benefit you. At this point it’s mostly just to get you to buy things they think you’ll buy, but what happens when your profile starts to match up with someone who commits crimes? Maybe you get harassed by the authorities a little more often? Generally the lack of consent around how the data is collected and how it’s used is the problem most people have.

      • UnderpantsWeevil@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        ·
        7 days ago

        what happens when your profile starts to match up with someone who commits crimes?

        I’d dismiss this as fanciful ten years ago. But we’ve got ICE agents staking out grocery stores and flea markets looking for anyone passably “illegal”. Palantir seems to have made a trillion dollar business model out of promising an idiot president the ability to Minority Report crime. And then you’ve got the Israeli’s Lavendar AI and “Where’s Daddy” programs, intended to facilitate murdering suspects by bombing the households of relatives.

        I guess it wouldn’t hurt to be a little bit more paranoid.

    • JustinTheGM@ttrpg.network
      link
      fedilink
      English
      arrow-up
      1
      ·
      6 days ago

      One aspect to consider is exactly what data these devices are exfiltrating from your network. You usually can’t see the contents of the telemetry sent, but given that a LOT of smart devices have cameras and/or microphones, do you really trust that your IoT devices are not sending back audio and or video recordings of the inside of your house?

    • underisk@lemmy.ml
      link
      fedilink
      English
      arrow-up
      1
      arrow-down
      1
      ·
      7 days ago

      Email me the blueprints to your house, your address, name, and your favorite hobbies and I will tell you the answer.

  • FosterMolasses@leminal.space
    link
    fedilink
    English
    arrow-up
    11
    arrow-down
    13
    ·
    6 days ago

    Jesus christ, just vaccuum your own house already. This is the largest tradeoff I have ever seen for the minor inconvenience of a single household chore.

  • Rhoeri@lemmy.world
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    4
    ·
    6 days ago

    This shit is two months old. How many times is it going to recirculate?

  • whoisearth@lemmy.ca
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    3
    ·
    7 days ago

    Play stupid games win stupid prizes.

    I have a standard vacuum. I spend about 10 minutes a day vacuuming. Miele has no telemetry whatsoever lol

    • Darkenfolk@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      2
      ·
      7 days ago

      Yeah good for you, but that’s hardly the point now is it? There is nothing wrong with automating stuff like this and expecting it to work without bullshit like the post happening.

      • whoisearth@lemmy.ca
        link
        fedilink
        English
        arrow-up
        0
        arrow-down
        1
        ·
        6 days ago

        The point is it’s stupid and people who want to automate 10 minutes out of their day are equally stupid

    • UnderpantsWeevil@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      7 days ago

      I gotta say, I’ve never really found the appeal of the self-propelled vacuum cleaners. They’re incredibly finicky and prone to getting snagged on surfaces. They don’t have particularly good suction and their waste storage is minimal. Tons of moving parts that wear through easily over time. Belts, fans, and wheels all get worn away from the device’s heat and exhaustive regular use.

      The time savings is minimal and the expense is extraordinary. I just don’t think its worth the trouble.

      • stiffyGlitch@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        7 days ago

        I used to have a Roomba in my apartment. I had a small step that was about 2 inches off the ground, and the Roomba kept falling off of it. It got caught on a small area rug that I had; it was pretty fluffy, so that it kept getting caught on the floofs was valid. but the Roomba could not clean up my cats litter. it just ran over it. absolutely no suction power in that thing. I eventually sold it on Facebook for 15 dollars. I paid about 400 dollars for it to do nothing at all. I then purchased a Dyson for 500 dollars. I still have it. it works perfectly.

    • zalgotext@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      4
      ·
      7 days ago

      Ugh. Stop shaming people for wanting to automate mundane tasks. No one’s playing a stupid game here, the problem isn’t robot vacuums. The problem is that manufacturers insist on holding features hostage on the basis that you connect said vacuum to the Internet, so they can harvest (and then sell) your data. Be mad at that, not at normal people wanting to make a boring chore less burdensome.

      • mic_check_one_two@lemmy.dbzer0.com
        link
        fedilink
        English
        arrow-up
        1
        ·
        6 days ago

        Yup. A good robot vacuum is an amazing quality of life thing if you have lots of furry pets. They’re not great for deep cleaning, but they’re fantastic for daily maintenance. Just have it run every day after you leave for work, and you never start to accumulate fur. You just need to touch up the corners and edges every now and then.

        The real issue is that the makers seem absolutely laser-focused on packing as much data collection into the things as they possibly can. There’s no real reason for it except capitalism.

        Imagine making fun of people for using a dishwasher or a clothes washer/dryer. Those are tasks that can be easily automated, so why wouldn’t you? Until recently, manufacturers were happy to ship those things without the invasive data collection. Pretty much everyone would agree that a washing machine beats spending 6 hours a week hunched over a washboard and hot water basin. And a clothes dryer allows you to do the laundry even when it has been rainy and cold for six fucking weeks, which would make a clothesline impractical. The automation isn’t the problem. An automated vacuum is no different, except for the fact that it has wheels. The problem is the manufacturers shoehorning data collection into fucking everything.

      • whoisearth@lemmy.ca
        link
        fedilink
        English
        arrow-up
        0
        arrow-down
        2
        ·
        6 days ago

        Disagree. My experience is they still don’t get everything, can’t do furniture or corners well or under furniture. They’re stupid. They’re expensive and if you really can’t spend 10 minutes or less to vacuum your house daily or every other day it speaks volumes on the type of person you are.

        I stand by what I said. More money than brains.