1. It saturated the local network with 1TB of metadata sniffing scans, not the network uplink to the outside world.
2. It does so because, as Keurig notes, it’s collecting data about your household in order to let Keurig sell it to advertisers.
WTF!! When did we land in the middle of a Black Mirror episode?
I'm half convinced the first run of the LHC split the timeline and we've landed in the evil one.
With just a little bit of interaction with the modern internet, the profiles created are stunningly accurate. Age, gender, political ideology, favorite food, relationship status, how many kids you have.
All this stuff gets slowly collected, aggregated and shared amongst data brokers.
People would care so much more if they knew just how invasive advertising actually is. All to try and convince you to drink one more coke or grab one more cheeseburger.
Maybe I should be port scanning it to make sure?
330M people in the country, you can run that entirely though a remote FBI office.
and the people using the data are gonna be the local cops; FBI ain't flying out to chase a couple of basic-ass assault charges or thefts.
email snooping, hand full of highway cameras at known bottlenecks, border crossings -- these are abstractions to most people. the flock cameras in their neighborhood are not, and cannot be absractions.
If people didn't care then why do so many companies have to coerce/deceive users into using their product?
Convenience my ass - the alternative to "convenience" is not participating in modern society, which isn't a decision at all.
Ahem
This depends on the country:
- In Germany, many people are very suspicious about such privacy invasions.
- In Singapore, on the other hand, people seem to very accepting of public surveillance if it serves public safety.
- In China, of course, public surveillance is also huge (at least in the big cities). I don't know how Chinese citizens think about that.
And thanks to surveillance, you never will.
World only survives, in realities where this particular creature in containment is alive. I’ll see if I can dig it up.
> Reactive Action: None taken; event fully consistent with long-term probability models.
heh. love scp humor.
But thanks for an hour-long break from work nevertheless.
SCP Wiki should itself be classified an Euclid-level threat (TV Tropes is obviously Keter class).
https://en.wikipedia.org/wiki/Quantum_suicide_and_immortalit...
People can work around patents, or pay for licensing them etc, if they really want to do something.
At least a decade ago! The first TVs with Automatic Content Recognition shipped in 2013[0]. There was also a brief panic in 2024 about air fryers spying on people[1].
And of course practically every website you visit is doing a full session recording with mouse movements and key presses captured.
[0] https://en.wikipedia.org/wiki/Automatic_content_recognition
[1] https://www.theguardian.com/technology/2024/nov/05/air-fryer...
I worked at a major media buyer agency “big 5” in advanced analytics; we were a team of 5-10 data scientists. We got a firehose on behalf of our client, a major movie studio, of search of their titles by zip code from “G”.
On top of that we had clean roomed audience data from “F” of viewers of the ads/trailers who also viewed ads on their set top boxes. Basically any internet connected device you get is probably doing whatever it can to sniff mac addresses of your network at the least.
From a previous comment of mine:
> … my Insignia TV (best buy store brand) with fire tv built in is basically unusable. Echoing a previous comment I made too, about “smart tvs” and the “streaming sticks”: Hey, have you ever thought of why even the $149 Black Friday loss-leader no-name-brand TVs all have Amazon Fire, Roku, or are now "Smart" in some way? Certainly isn't because they need to incentivise you to connect it to the internet so it acts as a Nielsen-esq measurement device of all media you view on the screen via digital fingerprints that exist in all commercial media and advertisements. [1][2]
Doesn't Google basically make this kind of data public? I know I've seen maps by state of what people are searching for, this is barely different.
Point being, it seems absurd to compare this to snooping on people's private networks by third parties
And yes, it's for the reasons those of us who have been in the tech field for a while would guess: it's "smart". It comes preloaded with apps for several streaming services, from which it surely gets a cut. It probably displays ads if allowed to connect to the internet. No doubt it reports what you watch.
Well yeah at the very least, that’s Google Analytics and/or similar alternatives.
Most individual websites outside of Google/Facebook/Amazon don’t get any data other than what you do on their website, so it doesn’t seem quite as creepy to me as a device on your home network port scanning and sniffing other traffic.
Google and Facebook can and do ‘spy’ a lot, of course, but otherwise the browser does protect you from most trivial spying by random sites. Not that that’s reason to feel any safer; the few people actually spying on what you do everywhere on the web are the ones with the most resources. This is all going to get way weirder with AI logs, I’m guessing.
And the first store clerks at the time that shout that "all people have agreed on that, period, complaints are non appropriate because society decided".
A small step for senseless humanity, a giant leap for the beast with big promises (that we are still seeing in development).
April 29, 2016. It explains so much.
Lovey example: https://frescocooks.com/platform/marketing-and-engagement
Air Fryers selling data: https://abc7news.com/post/certain-air-fryers-app-connected-a...
Student in NZ protesting it: https://www.consumer.org.nz/consumer-rights-and-campaigns/da...
Hope your TV isn't connected to the internet: https://www.cnet.com/tech/home-entertainment/tv-spying-yes-h...
The first thing that Meta did after Brexit was moving its UK's user data to the US.
The FUD (never laughter) came from the scummy US ad-tech industry; the people whos very salleries depend on invading our privacy.
You will find many of them posting (and downvoting GDPR posts) here on HN to spread their FUD.
Sadly the real answer is much less dramatic: we did this entirely to ourselves, voluntarily, purely out of lazily taking the path of least resistance offered us by companies that don't have our best interests in mind.
I'd convergence was about 10 years back. Whenever the David Cameron pig story broke.
The majority of people just chose to turn their blind eye towards those developments and dismiss the warnings as conspiracy theories.
"Smart" devices have been pulling this shit for years. If you're surprised by this you weren't paying attention!
The EFF, Doctorow, et. al. were warning us that this was going to happen, over and over again for a really long time. Then they were saying it was beginning to happen for a really long time. Well guess what, the thing they were saying was going to happen happened!
We really need laws protecting consumers from "data collection for advertising". It should be a default no with a requirement for explicit opt-in /and with no legal way for companies to charge less for the advertising model/. In fact, customers who agree to the advertising model should be able to get profit sharing revenue.
There’s no way Keurig is has the intention of paying the kind of costs required to collect a terabyte of data every two weeks for millions of people who own their coffee makers.
There must be some kind of bug here. I imagine if you unplugged it and plugged it in again the data usage would settle down.
Now I'm left wondering what this traffic actually is - assuming probe (arp/icmp) packet size of 64 byte, that's 17kpps. I don't think an ESP32 class Internet-of-Trash chip can even do that. Even bulk transfers rather than small probes would be pushing it.
Perhaps this thing found some fellow-traveler device streaming video on a port it happened to connected to?
... the linked xit says it "broadcast 1TB of data". So maybe some protocol with a much larger packet than icmp, spammed in a hard loop without any delay?
But still must be a bug.
What kind of processor does this thing have ?
Still seems buggy.
Manager: We might miss something. Since scanning doesn't cost us anything, better do it a thousand times a second!
Real world example: þe Windows registry DWORD time periods seems to invite 10^-3s granularity for totally inappropriate timescales. Perhaps its considered a "best practice" by the dick heads that decide to do these things, who knows? Why bother considering how a sysadmin might actually want to use the knobs and dials and what is an appropriate value for a parameter.
I could probably find a better example but this is recent: Smoothwall has an agent (IDEX) that you install on a Windows domain controller and one of its functions can be to harvest DHCP data and pass it onto the firewall so that it can track sessions. The upload period is a registry DWORD value.
I fixed a "problem" by stopping IDEX trying to upload data a thousand times per second. I will also point out that switching on this functionality and the periodicity setting is only applied by editing the registry - there is no GUI for this. The dReal world example -ocs are clear that you should initially set 1000 as the period.
For me that sort of thing comes under the heading of "you are holding it wrong", potential victim shaming and rubbish engineering.
What kind of mad keyboard compose effort would conjure up a thorn? I used it very deliberately.
Thorn used to be a letter of the English alphabet and I fancied using it to imply "ye olde ..." (y replaced thorn in that sort of thing)
Nowadays, and for quite a lot of the past, people like to riff on "ye olde shoppe" and the like to imply "ye olden dayes".
The problem, as I don't really see it, is that a possible cost cutting measure in printing seems to have swung back and changed the English alphabet. I don't really buy the official explanation for the loss of thorn. I think it simply wandered off and got bored, it looks quite like a p too. I gather that it originally sounded slightly different to "th" but English has largely lost that distinction.
I used an actual thorn, because I can!
This works only up to a point. Now it is costing them something.
The traffic volume just sounds like a bug to me.
Closed source software/hardware is a data exfiltration device first, and the thing they're sold for secondarily.
TVs, Blurays, set top boxes, MS Windows.. All of them are the same.
Selling devices to consumers is a solved problem. The problem we're currently trying optimise solutions for is selling consumers to the advertising companies.
Even the act of engineering rate limiting costs you more than just having this run wild over your customers networks because the vast majority of people buying these machines do not have the inclination or skills to detect this activity.
With this particular company, everything else they do is malicious so I won't ever give them the benefit of the doubt.
I tried to use a reusable pod in one of their machines the other day and when I shut it the handle broke off leaving me rather confused. Turns out in the closing head of the machine they stuck in 4 big metal spikes to destroy anything put in there. There is absolutely no reason to do this, none, other than being dicks. Had to get out the epoxy and repair the handle of a friends machine.
So yea, screw them.
The frequency etc. leading to 1TB is probably ignorance, but that doesn't matter as it is consequence of malicious scanning either way.
I understand why a TV would keep track of what I’m watching so they can sell the data. I think it should be illegal. It’s horrible. My TV isn’t connected. But the reason they would do it fits in my brain. I can see how they got there.
How a coffee machine got to running network probes… nothing. It seems like some sort of Internet of Things DEFCON presentation topic made up by putting random words together.
So to think that on top of that they were purposefully causing so much traffic on the local network is just a few steps too far for me to think that part was intentional.
They're explicitly taking advantage of their customers' trust, and deserve to go bankrupt.
Yes, it's malicious and completely unnecessary, but incompetence has potentially made it a PR problem.
This may be working exactly as designed, as it costs them effectively nothing to constantly scan.
We had a similar thing, the other team wouldn't back down.
We ended up implementing a kind of rate limiting internally.
If the previous request (from that IP) was more than 4.5 seconds ago we let the check request through as normal.
If the previous request (from that IP) was more recent than that we just returned a cached "there is no update" payload that had a TTL of 60 seconds.
We told them this and left it up to them, they soon changed their polling frequency.
It might not seem to be anything (people will assume private network traffic is free) but there is a cost - it's capacity that could be used for other purposes, eg. home alarms.
Here that means no lawyers, no discovery, $100 to file in plain language, and a company employee (not a company lawyer, or a contractor, or a temp employee) must attend or they default.
$15k damages.
Reasons it could happen? Imagine grandpa has a tech come out 4 times, because his network is super slow. EG, this thing pounding his wifi for its scans.
Grandpa gets reimbursed for the four techs who came out, that's it.
Grandpa gets his money back. The company? Well, it has to spend money talking to a lawyer, because even though a lawyer can't attend small-claims court, they still consult.
They also have to send an employee to small-claims court, just have to deal with it. In the end it costs the company thousands of dollars maybe even over ten grand. It costs you a hundred bucks and you get your money back. That sort of asymmetry is beautiful, and if everybody availed themselves in small claims court, it would be far better than any class action lawsuit.
Grandpa is definitely not getting $15k in damages, and Keurig can deal with this with their in house lawyer that they're already paying a salary for. They're definitely not shelling out big bucks here. It'd be cheaper for them to let the default judgement happen than to actually show up.
Let everyone file that claim for a single geek squad visit.
Please show me how this is suboptimal? Especially with LLMs to write the demand letter, and walk you through the process.
And 'using their in house lawyer' still has time cost, as does dealing with the routing and pondering the service letter. And accounting paying up. There is no aspect of your 'worst case' where it's bad. It's still all pluses. And if as I suggest, lots and lots of people do it, then they end up with a loss on that product.
If each case is $1000, or even $500 payout, how much profit does that take? Profit on 100 units? 50? If a product is horrifically bad, and everyone runs to small claims court, that's disaster for a company.
> If each case is $1000, or even $500 payout
How many people are going to spend $500 on service techs coming out to their house? So far we've got a report from one guy who figured it out with no damages at all, and therefore no case for a small claims court. Since it was found to be defective 10 days after first use, it's probably still eligible to be returned for a refund, so even the cost of the machine isn't eligible.
> If a product is horrifically bad, and everyone runs to small claims court, that's disaster for a company
This much I can agree with for sure. While it is definitely bad, I don't think flooding small claims courts is going to be a viable strategy in this particular case.
For whatever reason I didn't finish that sentence, and just said 15k. Sorry about that.
Where I am, you can get back the cost for sending a registered letter by courier to have it served, signature required. Also for the demand letter. You can get money back for filing, the $100 for example. Lots of little incidentals.
To me, it's when the damages are smallest, that small claims court is the biggest benefit. Losing $30, suddenly becomes a bill of $200, after it goes through small claims court.
But anyhow, I'm just happy if you like small claims court to some degree. I just think we should all use it more.
Right now companies are somewhat limited in how much use they can get out their horde of private and personal information, but AI is changing that rapidly. As long as you don't mind a huge rate of error (and companies don't because it all becomes "good enough" at a large enough scale) it's basically perfect for the task of digging through endless amounts of information and spewing out bullet points.
Not in my house. What is even the point of connecting a coffee machine or a washing machine to the internet? I think my washing machine advertised that I could download new washing cycle programs in the app. Who on earth cares?
None of these are worth the spying that these companies do though.
I have all of my IoT devices on separate Wifi network(s) and VLANs and almost all of them are isolated so they can't talk to each other, plus I occasionally look at how much data they are sending/receiving from the Internet (some is expected obviously, and it differs by device).
Doing this requires a considerable amount of admin work and IT knowledge though. It also requires something a step above most consumer grade or supplier provided networking equipment.
I've never spotted anything egregious like the coffee maker in the OP but if I did I'd be making sure other people knew about it and the device itself is either firewalled off properly or replaced by a brand that isn't a security risk.
As someone who has done this, it's a one-time cost (as long as you're not the sort who simply can't stop tinkering with it and ends up totally rebuilding it like once a quarter (don't ask me how I know)) and -if you have even just a shaky understanding of how to do it- it's not _that_ large of a cost.
> ...and IT knowledge though.
I definitely agree that doing this requires quite a bit of IT knowledge... but it's all stuff that's pretty easily learnable for anyone who's interested in technical stuff and/or technically-inclined.
For folks who are looking to do this on their home LAN, I have some hardware manufacturer recommendations:
All of this VLAN work will be entirely pointless if your switches can't be programmed to enforce the separation, so one will need "managed" switches of some kind. I'd recommend anyone who wants to try to do this to have a look at Mikrotik switches... they are inexpensive and definitely more than good enough for a fancy home LAN.
Mikrotik also sells routers and WiFi APs. I can't comment on the quality, as I have slapped together my own router PC and use OpenWRT Ones for my APs... but I've found their switches to be more than good enough for my fancy home LAN. Perhaps their routers and AP are equally good?
Mikrotik publishes pretty comprehensive documentation here [0]. If you want to dick around with the Mikrotik management CLI for RouterOS -which is their name for their fancy management software- you can install the x86 version of RouterOS in a VM by booting a VM from one of the x86 install images at [1]. They also have a much simpler management software that you can run on all of their switches called "SwOS" -documented here [2]- but that doesn't have any x86 installation media so you can't play with it on your PC.
[0] <https://manual.mikrotik.com/docs/introduction>
[1] <https://mikrotik.com/download?architecture=x86>
[2] <https://manual.mikrotik.com/docs/bridging-and-switching/swos...>
What is the point of activating a washing machine remotely if you aren't there to put your laundry inside? What is the point of activating your coffee machine remotely if you are not here to drink it? Even when you have to fill water in the machine and grind coffee beans, and wait for the machine to preheat the water.it takes less than 3 minutes to prepare an espresso.
Looks like nmap OS detection can use ~90kb per host per attempt.
Coffee machine scans network? Nope.
Coffee machine reports things about your network? Nope.
TV does ACR? Nope.
TV reports things it incidentally learns about your listening habits? Nope.
TV transmits any microphone data or things derived from mic data that aren't explicit user commands? Nope.
Companies who collect this data even though it's illegal want to sell it or use it for marketing or transfer it to anyone else? Nope.
Company A provides an SDK to company B that does this kind of thing and company B sells the product? A is liable, civilly and criminally, and B is also civilly liable to the extent that they should have and did not exercise due diligence to prevent it.
Company A, company B, and/or the end user have some contract shifting liability? Nope. The parties that the law said are liable are liable, cannot use the contract to avoid liability, cannot use the contract to recover money they have paid as a result of this liability, and cannot enforce arbitration provisions.
Anyone tries to use a contract that is considered illegal under this law? That party becomes responsible for their opposition's legal fees even if they are ultimately found not liable for some other reason.
Police wants to buy this data? Sure, they're welcome to buy what's legally available, except that they, like everyone else, will have a hard time getting the data because it's illegal for anyone to acquire it or sell it.
It's high time to get this done. We've got this and the recent evidence of LG doing all kinds of worse crap and it really should be possible to get some legislators on board.
I understand your feeling of despair. Of course I do. But you don't have to make other people despair. History has shown us where we end up when enough people despair.
For certain definitions of corrupt, with almost no exceptions, all politicians in neoliberal democracy are corrupt, because they serve the needs of Capital rather than people.
There's some interesting things happening with DSA in the USA but it feels like plugging a thumb in a dam.
I'm hardly killing democracy. More like poking a rotten corpse with a stick.
I don't despair, btw, I don't rely on the continuation of liberal democracy for my happiness. I'm waaaaaaay left of that.
If marketers cannot pay Google, Meta, etc to show their ads to people whom pervasive surveillance indicates are the appropriate targets, then they will pay companies (probably still Google and Meta and very likely still American companies) to show ads to people selected by other means. Everyone’s retirement account will be just fine.
For that matter, consider who some of the biggest offenders are right now. LG and Samsung are Korean. Sony is Japanese. (But Vizio is American and seems to be owned by Walmart.) Maybe reducing surveillance capitalism will make it harder for some of these foreign companies to extract money from the US.
There’s also the national security aspect. Right now, we expect foreign corporations to extensively spy on us. Sure, a law would not necessarily stop foreign powers from spying on us, but at least if we banned the general practice, then foreign powers who do spy on us might get noticed.
With all the hacks going on, I can't imagine why any company would even want to collect anything if they have a business model that works without it. I would think selling coffee makers and coffee pods would easily be a business model that works without data harvesting. Companies made whole businesses out of selling coffee makers alone for decades.
https://help.earnapp.com/hc/en-us/articles/38191916327441--W...
I think Bright Data is similar but I didn’t find their authoritative numbers. It doesn’t help that my ad blocker blocks their entire domain.
Yeah, sure, the terms of service probably say that they can do that. That's still in "unconscionable" territory. And courts do not like unconscionable contracts. If it's unconscionable, it's invalid (if I understand the law correctly).
Is this why everybody wants to make appliances with wireless?
Customers are gonna get lost in the sauce and skip right past all of that and toss the packaging.
Which raises in my mind the obvious defense, which is that if you try to put four or five of these devices on your network they'll be too busy interfering with each other for them to actually spy on anything.
Let the wiretaps wiretap the wiretaps. Keeps 'em busy, makes 'em feel like they're doing something important.
> What is my purpose?
You wiretap the wiretaps wiretapping our wiretaps.
> Oh my god.Legislators are cheap to purchase
Why not? iirc some of the smart TVs have been shown to find open wifi networks on their own and upload data. (I'm not sure about that though. But it's plausible and undoubtedly will be implemented some day).
I could also see some kind of partnership with ISPs to use their "public" WiFi hotspots[1]. This seems more likely since it's (probably) harder to honeypot but requires making regional deals.
[1] https://www.highspeedinternet.com/resources/is-your-router-a...
Why you would give a coffee maker access to your WiFi is the real question,
Besides, did you see how he was dressed?
Since most appliances now contain a general-purpose computer, it would be unfair to say that a device is incapable of hacking or hosting malware, because any device with the given sensors and radios and capabilities can be essentially reprogrammed at any time.
So, if we're looking at smart TVs with cameras and microphones and Wi-Fi and Bluetooth and all the connectors, or if we're simply looking at a an ordinary network device, they all fall under the umbrella of general purpose computer, and there is no way to trust their maker, or some equally capable programmer, not to turn them malevolent in some future update.
I don't view this as an issue of terms of service or of software or of your manufacturer. I view this as an existential and fundamental problem with dropping general purpose computers into your home and behind your DMZ.
Consumer operating systems like Windows and Apple have all kinds of countermeasures against this malicious use. But without the proper introspection and without the proper safeguards, a device that looks special purpose but is in fact general purpose is far more dangerous.
Sensors/access is unavoidable, otherwise the device doesn't actually do anything useful. The point is it sets the scope for what the device is able to affect. When people say "set up a separate IoT VLAN" (that still has Internet access) this is basically what they're addressing - how a device can access other devices they may care about more.
Internet access is the catalyst that's created this whole dumpster fire - I don't care about the proprietary software on my keyboard/mouse/UPS/monitor/GPU/etc to nearly the same extent. I've got some TP-Link plugs that I control local network only. They don't get Internet access, so no updates, telemetry backhaul, etc.
The authority to update/configure/change that software is the crux. With proprietary software, there are no cuddly kittens period. Here we've got a case of a "legitimate" company choosing to be a bona fide attacker to increase their bottom line! The harm was exacerbated by a bug causing it to run amok, but even without the bug they are deliberately violating trust.
But even libre software can fall to security holes as well. Meaning you want to centralize the attack surface as much as possible, for administration's sake of keeping updated. "Internet" of things is basically the direct opposite of this - postulating many illegible fine-grained links between devices on different networks. Whereas really need more like the Home Assistant model, where peripheral devices may communicate over the network, but it's only ever over the local network. Think how ethernet is set up when used in industrial control networks (or at least how it should be set up, hehe).
I don’t actually think that applies to coffee makers spying on people though. People shouldn’t be expected to understand how computer networks or ad tech spying works in the same way that literally any child or idiot should know the difference between a lion cub and a house cat.
How do you feel about thermostats? Are some things worth it? I've had a "smart" one for the past five years, part of a new furnace install, that I've stubbornly refused to connect to my wifi. Of course this means if we forget to turn the heat down while no one's home, there's nothing to be done about it.
That, plus nobody in their right mind would buy American (vs French, Italian, German, Dutch...) when it comes to coffee. (yes, Starbucks is a thing here, but I'd argue people who are into _coffee_ don't go there, people go there for other reasons.)
The device is dead simple. No advanced electronics. Nothing complex that can break. Just a coffee maker fine-tuned to near perfection.
The only flaw it has is the handle for the pot. I've resorted to replacing the plastic handle with a fancy walnut one I made myself. I needed that because we tilt the pot sideways to fill the reservoir with water (because of the placement on the kitchen counter and the cabinets above), and that plastic handle is not designed for sideways stresses.
Like the people who reply to nigerian emails have already been pre-qualified by 1) ignoring the misspellings and 2) replying.
Limiting the quantity of data which is transmitted, received or sent, an appliance that a person purchases.
Makes me think of DraftKings. You take your average 20 something sports fan - drinking beer, watching the game. And, on the other end of that smartphone display exist some of the most complex algorithms ever designed by teams of mathematics / statistics PhDs and it's deliberately built around targeting... this one guy from Florida who is pretty sure his team will be up by 7 at halftime.
Maybe it's more of a morbid joke, but it makes me laugh to think about.
It's an accurate explanation.
so if you know that a user is having an affair, you might want to serve divorce lawyer ads (I'd imagine those are very expensive) or something.
this kind of data though is just like a cog in the machine, but it can e.g. give enough info to know how many people likely are in that household, and so on. useful when combined with other signals
It can also correlate it with geolocation data. Google, for eg, sniffs all broadcasted SSIDs with their StreetView cars. If you can pick up on a SSID (or any of the MAC addresses of the other devices), you can buy the data set that includes it which further pinpoints demographics given the neighborhood AMI.
You can also build behavioral profiles patterns based on things like, for eg, if a baby monitor model is present or a robot vacuum, if certain devices only connect at certain times, etc.
I think the general rule for adtech is that profile guesstimates just need to be around 70%+ fidelity to determine if a sale can be made.
Lastly, you can also just sell the data on the gray market. The more datapoints, the higher the price. Most consumer product companies do that since we have little-to-no data privacy laws and the people who seem the most aware of it also are generally very apathetic and disinterested in advocating for them.
For example, your aged mother's phone will get pinged within X meters of an urgent-care facility, or she'll do some web-search about "hip pain", and then all the adult children start getting ads about elderly-parent-care.
Or perhaps the pervy-panopticon decides some phone-on-wifi events look like adultery, and both suppposed spouses start getting ads for divorce lawyers, private investigators, or track-covering products. (Bonus if certain specialized "adult" toys are detected on Wifi or Bluetooth...)
it's probably even more dystopian now with phone apps vacuuming up every last dreg.
Scale it up - make that millions of homes. Now there is godlike strategic value. Esp when "borrowed" by 3 letter agencies.
If you have even very crude data from somewhere else for the targeting, improvements in attribution tech are actually the more important factor. The adtech company mostly doesn't even care who you are, just whether the ad turned into a purchase or not, and that's where a lot of the invasive tracking comes from. They'd be perfectly happy with a quickly changing "identity" if they knew it was reliable and stable between ad and purchase.
I don't know if it has a microphone, to be clear. Just answering your question
Where is this shown? I see it repeated all through the HN comments but I don't see it in the X thread.
The person who discovered this says he didn't even open Wireshark and capture a few packets, which would have immediately revealed something about the situation.
This shit needs to be banned, now!
That still doesn't make any sense. If they want to collaborate to build an advertising profile, your public IP is all you need. Otherwise if they're not collaborating, what's the plan, find 0days in random IOT devices and hack them? I might be concerned about random chinese IOT devices doing that, but not devices from western companies.
Data brokers are buying from multiple sources because maybe a home has a keurig but not an LG tv. Or an LG tv and not a keurig.
The plan for the likes of Keurig is "These data brokers will give us free money for data from our coffee machines? Where can we sign up!". It doesn't even matter if the money translates to $0.01 per unit sold. That's probably the most disgusting part.
Right, but OP's premise is that putting everything on the same LAN is somehow even better for the manufacturers/data brokers/ad networks/whatever, which doesn't make any sense. The only thing that actually matters is a device with internet connection.
Client isolation would help, but it also breaks some devices.
Are there decent daemons that allow me to allowlist which broadcast traffic to permit?
Ideally it'd be compatible with IPv6-only clients on my LAN.
I feel like we could build a custom reflector/firewall that would make selective isolation possible.
I've heard that they put it in IoT devices, free Android apps that people use on their TVs, free phone apps, games, prob lots more.. The companies advertise it like its super safe only legit normal people borrow the internet from these people but then in fine print it'll say its not our responsibility etc.
What I have been wondering is - since they don't seem to care or check what people are using the "residential ip's" for, what happens when someone does a bunch of illegal stuff on some random person's home IP and ends up raided by cops?
I feel like the world is going in these directions.. the excuse is always "well, they clicked Yes on the Terms of Service! They agreed to it!"
It is a question many devs miss. what happens when I put this in the wild and I now have hundreds of them.
In this case it is probably scanning aggressively. Just incase you plugged in a new devices in the past 100ms. Then some sort of filter with data compression (hopefully) and then sending its exfiltrated data back home. Honestly, not a cool thing to do and makes your customers NOT trust you. I had an old LG TV that was doing this 15 years ago where it would send every button press back to LG. I unplugged it. It agressivly scan its empty socket.
This is either outright false or at least highly misleading. Keurig says they may sell information about your coffee brewing habits to third parties (i.e. your usage of the coffee machine itself), but nowhere does "Keurig note" that they collect other data about your household through network scans and sell that to advertisers.
I'm not even sure which tweet you were referring to that implied that. In any case, there are tons of responses here that are interpreting your quote as saying Keurig admitted they do network scans to acquire info about your household to sell to third parties, and that (the idea that Keurig says they do this) is flat out false.
its LGs glass in LG household, and now Keurigs kitchen
Off topic, but an odd and dubious upside to AI is that it provides an actually valid reason for this mass data collection. Before AI, as you note it was for advertisers, but what are they actually doing with it?
The promise was that with all this data, advertising would be perfected. I seem to remember fears back in the day that it could end up being a form of mind control, with this perfect understanding of you an advertiser could sell you anything, and you'd willingly consume adverts as entertainment they'd be so perfectly tailored to you. Not something any of us would want I'm sure, but that was the promise for advertisers. The opposite ended up happening. Nobody wants to use the internet without an ad-blocker, when you're forced to use Youtube or something without an ad-blocker you're counting down the seconds until you can skip it, and the rest of the time you don't even notice they're there, let alone any kind of mind control. Of course you do get thinly veiled advertisements as entertainment, but none of them use mass data collection, they're really not much different to how tv shows used to get made to sell toys in the 80s.
The reason I bring this up is for the question; what is this mass data collection for? We (really) don't want it, advertisers are either unwilling or unable to use it and it costs a tonne of money and effort. The obvious, and disappointing, reason is that we all need to pretend it works or the internet as we know it collapses, for better or worse. That plus AI being the new excuse I suppose.
Because the article is also full of 238 advertisers.
Good lord.
But why do they need to collect 1 TB? Sounds like a lot of redundant/doublicated entries then for a small network?
The people that said LG isn’t the only company doing invasive data harvesting is sadly correct.
How did we as a society let it get to this point?