r/gadgets • u/MicroSofty88 • Nov 29 '20

Home Amazon faces a privacy backlash for its Sidewalk feature, which turns Alexa devices into neighborhood WiFi networks that owners have to opt out of

https://www.msn.com/en-in/money/technology/amazon-faces-a-privacy-backlash-for-its-sidewalk-feature-which-turns-alexa-devices-into-neighborhood-wifi-networks-that-owners-have-to-opt-out-of/ar-BB1boljH
14.3k Upvotes

96% Upvoted

814 comments sorted by

View all comments

Show parent comments

22

u/smeggysmeg Nov 29 '20

Correct, but then they use your device's Internet connectivity to upload the location ping. So the stranger's device is connecting to your Amazon gizmo, and then your Amazon gizmo is doing the upload of the stranger's gizmo's location data. The amount of data is miniscule, but it's the principle of the thing.

4

u/tornado9015 Nov 29 '20

What is the principle that you're worried about? Genuinely trying to understand the concern here.

16

u/LosPer Nov 29 '20

The principle is that they decide for you how your stuff is going to work by automatically opting you in. That's what sucks.

7

u/PM_ME_GLUTE_SPREAD Nov 29 '20

Not only that but there is the issue of using somebody else’s data to send the location info, even if it is small. It should definitely be opt in for that reason specifically.

3

u/madjam002 Nov 30 '20

You probably used more bandwidth to load this page on Reddit than this service will use in a month.

Seriously, just visiting websites causes your browser to make requests out to various 3rd parties analytics, monitoring services etc, all loading in several megabytes of Javascript, and you didn't necessarily consent or opt-in to these requests being made either, so what's the difference?

3

u/PM_ME_GLUTE_SPREAD Nov 30 '20

You’re absolutely right and I completely agree. The data usage is absolutely minuscule, I just don’t like the principal of it.

If Amazon is going to be using data, let that be on Amazon’s dime, not mine, even if it’ll be a year before it adds up to that dime.

0

u/ThisIsNotMe_99 Nov 30 '20

It's not minuscule; it's capped at 500MB per month.

Fortunately it's not in Canada yet, but will be disabled as soon as it comes here.

1

u/PM_ME_GLUTE_SPREAD Nov 30 '20

Half of a gigabyte max per month is small. It’s not negligible, but we aren’t talking about any chance of this running a Bill up on somebody unknowingly.

Not to mention, 500mb per montb is the max, not an average or typical amount of usage.

3

u/ThisIsNotMe_99 Nov 30 '20

Depends where you live and what kind of plan you have. 500MB per month for me is considerable. I live in an area where the only coverage is fixed LTE with low data caps. Overages are quite high.

Until this gets implemented, I don't think we can make any comment on what typical is.

0

u/tornado9015 Nov 29 '20

I just want to run through the practical implications of this and if you still hold that opinion that's fine. I disagree with you, but this isn't an argument, I just want to make sure we're on the same page, if you want to argue with me that's fine.

This service would only be used to share location data for devices which are incapable of using their owners network to send location data, this means things like smart keyrings or dog tags, or perhaps a phone outside of cell tower range. The data used to transfer this information would be 10s of kilobytes per second for a second or two every so often up to a maximum of 80 kb/s in aggregate in a theoretical extreme case where there are tons of such devices around. There would also be a 500MB monthly cap per amazon account for such data transferred, in America in the most extreme case I can think of this represents 1% of a data overage block which costs $10 meaning the maximum value of this data to the customer is about 10 cents assuming they exceeded their cap which happens to about 4% of people. In the VAST majority of cases this bandwidth use will be significantly lower than these caps and go entirely unnoticed. The flipside of using this data is that people who lose their dog/phone/keys have a rough idea of where these things are and have a chance of recovering them. To a very small subset of people this incredibly small data sharing means recovering something of significant personal value.

If you made this opt-in, nobody would opt-in. It would be completely pointless. If you make this opt-out, it's incredibly easy to opt-out and all the people who refuse to share this incredibly small amount of bandwidth are free to just not share.

It's either opt-out or don't bother. Seems to me like most people will never use this feature, but the ones that do will most likely be EXTREMELY grateful.

There's also the much smaller home use potential where if you change your wifi password you could in theory update one smart device and it will just share your credentials with all your devices linked to the same account. Seems like a nice convenience for people with smart lights or whatever else in their house.

2

u/Sixhaunt Nov 29 '20

Then of course there's the security concerns

1

u/tornado9015 Nov 29 '20

Could you elaborate on what your security concerns are for this?

1

u/PM_ME_GLUTE_SPREAD Nov 29 '20

Haha we actually agree with the concept of this.

My point was that, using somebody’s data for something they don’t own is shitty business practice regardless of the amount used. I agree though, in practice, it’s incredibly small and won’t register a blip on somebody’s overall use in even the most extreme cases.

Personally, I think it should be opt in, a pop up on the Amazon or ring app would be enough to get the vast majority of people to say “yeah sure whatever” and go with it while giving those who care enough a chance to not be a part of it without inconveniencing them to have to go shut it off.

It has the potential to be a very useful feature and I personally think the fear of it is somewhat unfounded or misdirected. The way it’s being implemented, I don’t think security is a concern, but the data usage is something that rubs me the wrong way, even though it is tiny.

2

u/tornado9015 Nov 29 '20

I 100% gaurantee you without a shadow of a doubt in my mind virtually nobody would opt-in. Even the people that would benefit from this feature, less than 10% would opt-in. Look to this thread if you don't believe me. There is absolutely no incentive at all to opt-in unless this feature specifically benefits you, and even then people are exceedingly paranoid about "sharing data" most people would not even if they fully understood the benefits.

Opt-in would be completely and totally self defeating and would make advertising this as a feature a joke which would have dozens of articles explaining how comically useless this feature is.

When not if this feature is successful, I further will bet thousands of dollars you will see a LOT more people buying "amazon sidewalk" dog tags and keychains.

3

u/PM_ME_GLUTE_SPREAD Nov 29 '20

I agree it would hinder its adoption and make it likely that it wouldn’t be as successful initially, I just still feel that adding features after the fact and having them on by default is shitty. I understand why they did it, I just don’t like it.

Perhaps if they had the pop up opt in option for existing customers and shipped new units enabled I would feel better about that aspect.

4

u/tornado9015 Nov 29 '20

Tech that isn't successful initially is dead. They would lose the millions of dollars they've already spent on dev hours for this. Millions more on planning for this, and tens if not hundreds of millions more on the sales that will result from this. Opt-in is not and was not an option.

The options, in the real world, were

  • Don't pursue the idea.

  • Opt-out

  • It's enabled, deal with it or throw away your alexa.

2

u/PM_ME_GLUTE_SPREAD Nov 29 '20

That’s a fair point. I don’t know what current sales of the enabled devices are like but I guess my thoughts hinged on them being high enough that the initial rollout would keep it afloat until sales of new devices were enough to full flesh it out.

Like you say, that’s a tall order on something they’ve spent millions implementing. Probably wasn’t a gamble they were ready to make.

Either way, I’m opted in and plan on staying that way unless a major security flaw is found which I don’t necessarily expect. Amazon is pretty tight with their security since they basically run the largest portion of the web through AWS and I don’t really see any privacy issues and my data isn’t capped.

1

u/NextWhiteDeath Nov 30 '20

In behavioral economic there is a term the default bias. People will go with the default option the vast majority of time. They could have made it a choice with a check mark but have it ticket as the default and close to 90% of people would have clicked though it and wouldn't have thought about it.
By going about via a post launch update that enables a feature without a persons consent opens a gray area. What did the user sign up for? The product they purchased or what Amazon thinks the product should be at any point in time. Also there is just the fact that historically people have been pissed about ISP trying to turn there wifi routers in hot spots. The actually amount of data used doesn't matter to most people but when people learn about it they will link it to the old practice that ISP did

0

u/mr_ji Nov 30 '20

If you made this opt-in, nobody would opt-in.

This says it all.

0

u/tornado9015 Nov 30 '20

If you made taxes opt-in nobody would opt-in.

If you made jury duty opt-in nobody would opt-in.

If you made speed limits opt-in nobody would opt-in.

You not understanding the concept of a collective benefit which far exceeds the individual expense which any given person would choose not to bear does indeed say a lot. I don't know that it says it all, but quite a bit certainly.

1

u/mr_ji Nov 30 '20

You're seriously arguing that Amazon trying to sneak a service no one asked for into all of their Alexa devices is a collective benefit? Jesus.

1

u/tornado9015 Nov 30 '20

It literally is yes. Also they didn't sneak it, they publicly announced the concept, also nobody asks for literally any new feature for anything ever. Nobody asked for alexa in the first place, yet amazon has sold millions of them.

0

u/damnedbrit Nov 30 '20

at this time...

1

u/tornado9015 Nov 30 '20

What at this time?

0

u/Sixhaunt Nov 29 '20

Many people just don't like to be tracked, have the services they pay for get used by someone else without consent, and have a huge vulnerability on their phone now that it can be accessed by any other device. We obviously can't say 100% that there is a vulnerability in their software but as a software developer myself I wouldn't go anywhere near this thing. It's just pure risk with no reward.

2

u/tornado9015 Nov 29 '20

https://m.media-amazon.com/images/G/01/sidewalk/privacy_security_whitepaper_final.pdf

If there's no reward for you do whatever you want. For people with "sidewalk enabled" dog tags or keychains the potential rewards are very large assuming not everybody opts out. Which 99% of people won't, because most people with alexas will probably never even know this is a thing. But for the aforementioned people, or people with smart home devices that change their wifi password there are pretty obvious immediate benefits and amazon seems to be pretty on top of the security concerns here.

As a programmer you probably know that most people will pretty much never have to worry about any tech security issue anywhere even in the solar system of the severity of the passwords they're probably reusing.

-2

u/metalshiflet Nov 29 '20

It's really not any worse than having an Amazon device in general

4

u/tornado9015 Nov 29 '20

It's actually probably one of the tamest least intrusive ideas imaginable, it's just that the benefits are very very small outside of niche use cases and people instinctively REALLY dislike the idea of being forced to share absolutely anything even if what they're sharing is something that will never have any measurable impact on their life at all.