I've bought an LG Smart TV 5 years ago, read t&c where I was supposed to grant them any data they wanted, decided to disagree and kept all network functions disabled. I was ridiculed by my friends for that. At some point, I thought - maybe I'm really crazy to do so? Who am I, a caveman, a luddite? Oh well, I'm not. Not a bad tv though, many HDMI ports!
Nah, you're not crazy. I'm also someone who actually reads terms documents, because I find that they're often the only thing that will be truthful about a company's intentions.
And keeping it completely disconnected from the internet should be the default, in my opinion.
> This. Why would you even connect TV to the network?
I happen to have a NAS with family pictures I like to display. I can (and do) firewall that thing, but then you hit other issues like the apps you need to show pictures and movies in the first place not to install/run.
I've yet to hear of a reasonable recipe to isolate and secure such connected TVs. And don't get me started on Chromecast or other Android dongles, I've no reason to expect better treatment from Google. Some open source hacked-together box, then?
Yes tv makers were caught doing HDMI fingerprinting. There was a story some years ago about how basically all smart tv makers were sending data to an ad network based in China.
Samsung were openly bragging about this on their website some years ago (for the benefit of their advertising partners) but have recently muddied the waters when I check their site again, couching it in language mentioning privacy and other evasive language:
"Starting in 2014, Vizio made TVs that automatically tracked what consumers were watching and transmitted that data back to its servers. Vizio even retrofitted older models by installing its tracking software remotely. All of this, the FTC and AG allege, was done without clearly telling consumers or getting their consent.
...
"Vizio collected a selection of pixels on the screen that it matched to a database of TV, movie, and commercial content
My in-laws were so proud of themselves. I came home one day and they told me they figured out how to connect my TV to the network so that I don’t have to use my Apple TV if I don’t want.
I had to take a few deep breaths to keep from yelling. I am very happy with my TCL tv but I trust it about as far as I can throw my father in law.
This is quite a mixed set of topics mangled together, which is a pity because IMO a cleaner separation would be more beneficial to get the point across.
1. The Ad data-collecting platform TV-manufacturers are operating, what data they collect and how they use it.
2. The vulnerabilities of the OS in a SmartTV, and the potential issues to exploit them for malicious purposes.
3. The general behavior of the device when connected to your network, with features like voice control, App control, Smart Home etc. enabled, and how it may expose information about yourself.
All the points and scenarios in the video might be valid, but they are not sufficiently grouped into one of the above categories.
Instead, it just mixes them all together to imply that its all the same, weakening the whole investigation.
--
The plain example: Using voice-input for a web-search on the TV [0], make long pauses and observe how it keeps populating the prompt-UI with everything you say.
This is a matter of #3 above, accusing a malicious intent already on such a trivial implementation topic is harming the whole story
I find your "summary" much harder to read and understand, though.
I prefer the original article and the net-benefit of a google-linked video to explain things that already were properly explained, is rather small, at best, in my opinion.
> I find your "summary" much harder to read and understand, though.
Sorry, my grouping of topics isn't supposed to replace the entire research-session. It's merely my observation after watching the actual "investigation video" that they mixed together lots of stuff they discovered into the larger conspiracy that everything is secretly spying on the user to feed a huge Ad-profiling database.
> I prefer the original article and the net-benefit of a google-linked video to explain things that already were properly explained, is rather small, at best, in my opinion
The article was made FROM the video and takes the wrong conclusions and summaries from it. If you want to form an opinion and are a bit technically savvy, you should watch the video instead.
A consumer respecting brand sells products. A Consumer selling brand sells consumers so they can be profiled, analysed for weaknesses and exploited economically in the name of Surveillance Capitalism
I suspect because it's hard to differentiate between ones that actually respect the consumer vs ones that only say so, but are actually lying to your face.
That and not respecting the consumer is more profitable in the short term (only!), which means more marketing money, buying out other brands, lobbying to increase the barrier for entry, et cetera.
Okay. This is insane. First the monitor that uses a windows feature to automatically install a small helper tool with root permissions and then starts showing adds in certain regions. Now a tv that is actually actively snooping around on top of the known fingerprinting. What else is next?
In the previous topic I got ridiculed for not wanting to buy LG anymore because I could use an agent to modify to strip out the offending bits.
But there must be something better than just keeping to buy things that invade our privacy and homes further and further. Which brands aren’t doing this? Sony? They also announced a partnership for the lower end TVs IIRC.
In an age where AI can search vast amounts of data having something in your home or workplace turning what it hears into text looks like a problem waiting to happen.
E.g. As soon as someone proves LG, Samsung, etc. recorded and stored credit card details and knowingly have weak security this is going to be a massive business liability.
That's an easy one to put a compensation figure on but there's probably all sorts of other exploits waiting to happen.
I think the most egregious thing here is that if you don't give the TV a network connection that it will actively search for other ways to get the data back to LG such as open WIFI.
>In an age where AI can search vast amounts of data having something in your home or workplace turning what it hears into text looks like a problem waiting to happen.
That's understating the problem. With or without AI, this should be cause enough to shut down a company or at least their specific product division.
>E.g. As soon as someone proves LG, Samsung, etc. recorded and stored credit card details and knowingly have weak security this is going to be a massive business liability.
They're going to be fine. A slap on the wrist at best.
> E.g. As soon as someone proves LG, Samsung, etc. recorded and stored credit card details and knowingly have weak security this is going to be a massive business liability.
My tinfoil hat believes that they've already accounted for this as the price of doing business. They will have already budgeted for the fines that they might incur, pay them off and continue as normal while people become accustomed to it.
The value of this data to the NSA, Mossad etc is probably the only thing keeping it secure.
Never in human history has a government had the means to simultaneously spy on millions of people, to use everyday private conversations to categorise them into various threats to the state, and better yet these tech companies can still sell the commercially valuable side of this to advertisers.
People could return to burning down enterprises that they find unsavory or detrimental to society, such as they did during the industrial revolution, but this is problematic in that it's violent and not something the modern person often considers as viable. A part of why people consider this unviable now is in-part due to the consequences of these surveilance technologies. It's difficult to accomplish a revolution when everyone is being spied on all the time.
>this is going to be a massive business liability.
No. this is going to go "unnoticed" or at least unactioned. These are surveilance devices - compromising their value as source of surveilance is neither in the interest of industry (who are selling and buying the surveilance) or government (who are buying and acting on it). The age of shame is over. Current world goernments have flourished under the premise of being terrible, horrible, awful, evil enterprises that do bad for the sake of either being bad or enriching the bad - a consumer device with a ToS that says it will spy on you spying on people is nothing now. Laws be damned, because laws mean nothing now. These devices bery well may soon be the only lawfully available devices in the consumer market precisely because of their surveilance capabilities. Governments are reluctanty catching up to the capabilities of digital technologies, and they're finding them more useful now than ever before. We will be burning witches again before we ever prosecute tech companies for doing bad things.
>The age of shame is over. Current world goernments have flourished under the premise of being terrible, horrible, awful, evil enterprises that do bad for the sake of either being bad or enriching the bad - a consumer device with a ToS that says it will spy on you spying on people is nothing now. Laws be damned, because laws mean nothing now.
I'm thinking less about shame, as corporations are dead to shame, and more about proof the TV stored a record of your bank details it got from text to speech.
If that's stored as text inside the TV and you lost money because it was copied by a hacker then you have a monetary value to show loss and a trail of liability you can use to sue LG.
The average user would not realize LG was the reason, if they do they will loose more money and effort; LG's reputation and public image won't be even damaged enough for them to take a notice. You are an ant for them and ants are only powerful if they work together.
>I'm thinking less about shame, as corporations are dead to shame, and more about if you can prove the TV stored a record of your bank details it got from text to speech.
Then they'll get a joke fine, and continue as before. Maybe cut the price for a while, until they reintroduce it with another pretext a few years down the line.
You would think that would matter, that they’re basically violating all known PII/HIPAA/GDPR/National security standards and god knows what else, but I expect at most some class action down the line.
At the same time an average citizen can sue and win against these corporations. I never ended up Suing because all companies settled once I showed the evidence. So try it out. Will get expensive for them to use lawyers against ai and still lose.
My TVs are on the IoT network so that I can control them from Home Assistant, but they're blocked from accessing the internet.
DNS lookups are redirected or blocked (53 redirected to my local DNS resolver, 853 blocked), and DoH is blocked as best effort though it's hard to block HTTP DNS traffic, which again is why the devices are blocked in the firewall.
All streaming is done via AppleTV, which is a platform I trust infinitely more than LG/Samsung/whatever.
All of your blocking still doesn't change the fact that your LG TV is actively trying to scan your local hardware, gathering IP-addresses of devices, wi-fi names and signal strengths, creating digital finger prints of the audio and video projected on your screen, recording audio through the internal microphone, even when the TV is in standby or without an internet connection, saving the collected data locally and uploading to LG Ad Solutions as soon as the TV is connected to the internet.
But it's never connected to the internet, not even for software updates. If the TV isn't connected to the internet there's no reason to update it, assuming the TV works as expected.
It's a trade off I guess. I use Home Assistant to control TVs, so kinda need the access.
Again, what I mean is, even if you're able to block all these things, the company LG is still secretly and actively trying to collect and process user data, without user awareness or consent.
I use Home Assistant to turn on/off the TV via automations, sensors, etc.
I could possibly do it via HDMI CEC, but I have a couple of Sony Bravia TVs that more often than not completely ignores that, so I prefer having control over assuming it happens.
There is sadly no hdmi CEC support on Most GPUs for pcs. So when you want your tv to turn on and off with your pc it is only possible with the tv being reachable from your pc via ip.
I believe LG doesn’t advertise such an api via Bluetooth
Congratulations but I also dislike this type of comment because that is not a solution, a workaround that doesn't happen for 99% of the population.
Soon you won't be able to IoT network or block these devices as they begin to partner with Amazon and the likes that sell Internet for near-by IoT devices. Then your only option then is physically removing / de soldering radios from the board.
And then your neighbor spins up an unprotected network or something like xfinity which they could have a deal with and it connects there and phones home anyways.
And what exactly would they use that particular access path for ?
I could see a threat if the TV had access to the internet and could establish a TLS tunnel or similar from the mothership, and execute commands on my LAN (or IoT network as it stands), and report back. That could establish a command & control channel that could potentially orchestrate an attack on my infrastructure via the TV.
However, reporting that "network X exists and has these devices" over a different network complicates things a fair bit. In theory they could still use the TV as a command and control platform, but it would have to switch networks between my closed network and the open network in order to execute commands and report results. Not saying it's impossible, just very unlikely.
Besides, the TVs are not alone in being cut off from the internet. I have two IoT networks, one for trusted devices (AppleTVs, Sonos, and the likes), and one for untrusted devices like TVs. They run on different VLANs, and anything on the untrusted IoT network can pretty much only talk to itself (client isolation) and the gateway, and there's no internet and no open ports to any other VLAN.
> And what exactly would they use that particular access path for ?
Uploading the weeks, months, or years of locally-stored activity [0] data? Text compresses really well and local storage used to be very cheap.
[0] ...mic voice transcription, how often you use the thing, for how long, and a best guess (because of lack of time sync) at when, "automated content detection" logs [1], names of files you've fed to the thing, -if equipped with a camera- number of people in the room and interesting information about them, etc, etc, etc...
[1] ...assuming that that can be done with data loaded from the factory, which I kinda doubt...
I know its important to put things down to coincidence whenever possible, but a very expensive Bang OLufsen ( I think they use LG ) TV would turn itself off at "the" most interesting split second moments during gameplay , to the point where I thought "if I am being pranked by a friend, does this TV even stream its contents?".
Much to my surprise I found out that many modern TVs do in fact come with dev mode that allow some sort of screen capture.
Safe to say I turned off all the "allow metrics and market/dev modes" and have been happier since.
EDIT> Incase anyone was wondering I did some more research about my model ( im NOT a TV guy ) and came across this regarding what screen content could technically be passed remotely: "Most probable raw grab: ThinQ/SSAP on the LAN after pairing — ~960×540 JPEG.
Live Plus/ACR: most probably sends a fingerprint, not a retrievable raw frame." No idea what it means but thought it might be relevant. Remember Im saying in my case it was a coincidence.
I'm inclined to believe the shutdowns were a bug rather than an extremely patient friend waiting for the perfect gameplay moment. But modern TVs having enough remote-management machinery that the prank theory isn't immediately absurd is not exactly reassuring.
Im not here to feed conspiracy theories and paranoia, its most likely a coincidence, and tied to having "excess metrics and advanced features that indirectly cause a kernel panic that turns the tv off".
But yes, after turning a bunch of unnecessary default options off, my TV never restarted again just as I was making a clutch moment.
So in summary - remember it could just be related to high action moment fps drain, heat, high intensity stuff making the nintendo switch2 compatibility cause a kernel affected restart etc etc etc ( which is documented via the HDMI protocols ) which make it SEEM like something weird is up, but it turns out its a related thing thats not that sus.
That did happen a few times , but Im telling you bro that TV restarted a couple times just as I was about to clutch, like the same second i was about to press a trigger in an otherwise boring 25 minute round more than once, but yes as I mentioned earlier it could be related to other tech aspects.
I don't share your definition of ill intent. The decision to put a (hidden) recording device in people's homes with the express purpose of exfiltrating data is already ill-intentioned of itself, regardless of whatever they planned to do with the collected data.
Look, I am probably more on your side than you are yourself, but this constant one-up-ing out of outrage in comment sections is so incredibly useless and harmful. Can you please stop.
I more than most people deeply understand the rage there, but I've tried to have a conversation here that leads somewhere, and you're dragging it back down to baseline outrage.
This is not how we actually achieve the goals we want to achieve.
Yes, unfortunately the investigative video is implying (or explicitly stating) malice on every detail they discovered, which is harming the overall message IMO.
They hacked the TV OS, then used the TV UI to do a web search with voice-input and observed (still on the UI!) that the voice input didn't stop immediately on silence but kept extending the search prompt with everything said [0].
The OS-hack was irrelevant for this, the whole sensationalism that a listening process is running (and therefore the device is listening to everything) is just drama added to the sober fact that someone started voice-input, the input field is still displayed on the bottom of the UI and keeps getting populated with new input.
There is an important message in this about security hardening, privacy, data protection, but this conspiracy theory that everything is made to spy on you is not helping...
This is the same behaviour as the german secret police in east germany. The difference now its for ads and by tech.
All collected data are probably ai transcribed from audio to text and is fused via data fusion to serve ads. Add collaborative filtering to find similar interests between users.
Mossad would love to know who to de-bank for criticising Israel, United Health Care would love to know who to deny coverage to based on remarks about their back pain.
Makes me glad I bought a Sony TV which has the microphone on the remote - and is compatible with older remotes without a microphone, so the new remote with its microphone and sponsored streaming service buttons gathers dust (without batteries inserted) while I use an old remote.
I could buy a tv in late 2014 and happened to be the last batch of bravia tvs pre android tv. Back then I was kind of bummed out that just a few weeks after that they announced the first tvs with android tv and now i was hooked with a smart-but-not-that-smart tv with a bunch of crappy ads, an unusable web browser and a non-customizable os.
But they stopped updating it years ago, none of its apps work anymore and the only "smart" feature that still works is screen mirroring feature. The tv part itself still works great. Not a 4k oled 120Hz shiny impressive thing but the image quality is still great. What I thought was an unlucky adquisition back then turned out to be a pretty good one.
Apps, browsers and "smart" features are disposable software, but a good panel can remain useful for a decade. Makes you wish manufacturers treated the smart layer as optional from the start.
This sort of blanket data collection needs to be made illegal in every single jurisdiction, and have _very_ robust penalties for anyone found in breach of them.
And those jurisdictions need to have people not susceptible to bribery or extortion by the corporations making those data collection devices. That's a big ask.
True. But corruption by those in positions of power and influence is a problem as old as the ages, sadly. But at least there _are_ rules and penalties in place for those caught so there's an element of risk. Whereas the blanket data harvesting by corporations currently appears to go utterly unabated.
Is all of them, every "smart tv" does it, even after adb, permission restricting or rooting.
Insert a (non infected) usb lamp in your tv and see the lamp turning on when your tv is off. It notifies you about the background activation activity :) Interesting to see when exactly get active (is it keywords or nearby devices or scheduled processes)? Can´t be keywords as that would mean 24/7 active and the lamp says otherwise.
You're not wrong, but you could ask your favorite LLM to interact with the LG API's to switch the input for you. At least for my case, it was ~10 minutes of work to develop a small tray app that looks for a specific USB device and switches the TV input if it gets inserted. I don't really even touch the remote anymore
I will remind everyone again that weev was raided by the FBI, arrested, and had all electronics seized, before getting a chance to defend himself in court, all for the crime of publishing emails he found on unsecured URLs he was able to guess.
But we're allowing 1000x worse things, because what, there's a vague line about it buried deep in some EULA, which means laws no longer apply?
Lets treat them the same. Raid LG, seize all of their electronics, at least in the US (other countries are encouraged to do their own raids), arrest the executives, and after they're all in jail, and digital forensics are poring over their products and servers to find what else they did, they can argue in court how actually all these crimes are legal.
So I have a tv of LG from the same period. I keep it dumb, not connected to the internet and just use an apple TV, so far it's a clean option. And it's always a good idea to have piHole up to, they usually have the block list updated with LG's and Samsungs urls.
The Gamers Nexus video explained that they will connect to nearby open SSID’s to send the data they have collected. So just not connecting it to your network may not be enough.
Fun fact: some (most?) Samsung TVs of the last ~6 years can't complete OOB setup if they're connected to a PiHoled network with the most vanilla PiHole filters
At this point, best to just keep it disconnected. Just use an apple tv or similar. They sold us a spying device masqueraded as a smart TV.
If internet is really required, I'd personally flood such an LG tv with fake data - add a raspberry pi to provide it with looped audio streams for the microphone, fake bluetooth devices, and so on. But it's still probably a drop in a bucket.
PiHole doesn't block IPs. It blocks DNS. The device have at least three ways to bypass PiHole: use external DNS directly, or pin the phone-home servers' IP addresses, or use some other protocols to carry IP resolution.
I'd just open the TV and yank or desolder the mic out. Or use the TV as a dumb monitor -- don't connect it to WiFi or Ethernet. And use an external Kodi/AppleTV/whatever-rocks-your-viewing-boat
I have a rooted LG C4. Beyond blocking things at the DNS level, not accepting terms, not using AI, I wonder if there’s some existing software solution or a documented step-by-step to remove this bloatware/spyware.
I posted two comments on similar threads recently. This is only going to get worse.
> Not long until companies partner with Amazon and others to send traffic automatically through their near-by devices like smart speakers, disconnecting will be impossible.
Not surprised if this is happening already. I don't want to remove radios out my TV..
> Samba, a media intelligence company have several partnerships with manufacturers to take screenshots and collect metadata.
Viewer analytics are valuable to companies like Samba, they aren't the only ones. Laws ASAP, these companies will lobby hard to stop anything of the sort.
These are spy devices. It is sad that the industry has become so addicted to sniffing - the problem I see is that they can no longer stop doing so, as they built an additional network around that yielding money to them.
the only TV I have connected to the home network (guilty, I admit), Sony OLED 65, ARP floods my network about 12-15 hours after "turning off". On a plus side, it doesn't appear to be streaming anything out: no local DNS hits, not enough outgoing traffic for any meaningful audio stream
The choice between privacy concerns and ineptly coded network stack is tough. But that's the choice we're forced to have
Why don’t you just use it as a display and have a more reputable device (e.g a mini pc or an apple tv) feeding it? I’m not forced to give my tv network access at all, since it doesn’t do anything other than display whatever the apple box outputs…
This is (mostly) the way. Samsung TV without networking configured, XBox for everything - which is problematic in its own ways but it's a known quantity. It doesn't prevent it from "helpfully" hopping on a nearby unsecured network but a) I haven't spotted one of those in a while, and b) it hasn't ever been able to get updates to change its behaviour to make it start doing that if it previously wouldn't.
Shares my browsing info with 1745 "partners" with no clear way to opt out (which ought to be opt-in by the way to be compliant with ePrivacy and GDPR).
There is censorship of illegal streaming sites crippling the internet (Cloudflare). People are being freightened from illegal iptv boxes to watch free sports because it could be part of a botnet or residential proxy network. There are million or billion euro fines for social media and service providers like google. There is enforcement against "fast fashion". Yet there is zero effort for iot privacy, not even labels or certification for good devices.
I don't want to be cynical but face it, the EU really only cares about things that generate money for themselves or big internal market players under the disguise of consumer safety and privacy. Obviously that also comes with some good effects but the perverse incentives are enormous from which we must not be blinded by ideology and warm feelings of our politicians being good and working for the people and the common good.
I've bought an LG Smart TV 5 years ago, read t&c where I was supposed to grant them any data they wanted, decided to disagree and kept all network functions disabled. I was ridiculed by my friends for that. At some point, I thought - maybe I'm really crazy to do so? Who am I, a caveman, a luddite? Oh well, I'm not. Not a bad tv though, many HDMI ports!
Nah, you're not crazy. I'm also someone who actually reads terms documents, because I find that they're often the only thing that will be truthful about a company's intentions.
And keeping it completely disconnected from the internet should be the default, in my opinion.
Only give the permissions you want the device/agent/human to use - no more.
Same for anything whether you trust it or not (or somewhere in between).
This. Why would you even connect TV to the network?
It is well known for like 5 years. Smsrt TVs go through your movies library, and upload screenshots and filenames to internet.
Some will start showing ads after firmware upgrade.
> This. Why would you even connect TV to the network?
I happen to have a NAS with family pictures I like to display. I can (and do) firewall that thing, but then you hit other issues like the apps you need to show pictures and movies in the first place not to install/run.
I've yet to hear of a reasonable recipe to isolate and secure such connected TVs. And don't get me started on Chromecast or other Android dongles, I've no reason to expect better treatment from Google. Some open source hacked-together box, then?
No idea what NAS you’re using, but I would recommend the Apple TV box.
Did you know that ethernet can run over HDMI? It's called HDMI Ethernet Channel (HEC).
They do screenshot? Do you have a source so I can read more?
Yes tv makers were caught doing HDMI fingerprinting. There was a story some years ago about how basically all smart tv makers were sending data to an ad network based in China.
Samsung were openly bragging about this on their website some years ago (for the benefit of their advertising partners) but have recently muddied the waters when I check their site again, couching it in language mentioning privacy and other evasive language:
https://www.samsung.com/us/support/answer/ANS10010616/
https://en.wikipedia.org/wiki/Automatic_content_recognition
https://www.ftc.gov/business-guidance/blog/2017/02/what-vizi...
"Starting in 2014, Vizio made TVs that automatically tracked what consumers were watching and transmitted that data back to its servers. Vizio even retrofitted older models by installing its tracking software remotely. All of this, the FTC and AG allege, was done without clearly telling consumers or getting their consent.
...
"Vizio collected a selection of pixels on the screen that it matched to a database of TV, movie, and commercial content
https://arxiv.org/pdf/2409.06203 shows LG and Samsung doing something similar
> Not a bad tv though, many HDMI ports!
that's not a plus, tho
My in-laws were so proud of themselves. I came home one day and they told me they figured out how to connect my TV to the network so that I don’t have to use my Apple TV if I don’t want. I had to take a few deep breaths to keep from yelling. I am very happy with my TCL tv but I trust it about as far as I can throw my father in law.
This is quite a mixed set of topics mangled together, which is a pity because IMO a cleaner separation would be more beneficial to get the point across.
1. The Ad data-collecting platform TV-manufacturers are operating, what data they collect and how they use it.
2. The vulnerabilities of the OS in a SmartTV, and the potential issues to exploit them for malicious purposes.
3. The general behavior of the device when connected to your network, with features like voice control, App control, Smart Home etc. enabled, and how it may expose information about yourself.
All the points and scenarios in the video might be valid, but they are not sufficiently grouped into one of the above categories.
Instead, it just mixes them all together to imply that its all the same, weakening the whole investigation.
--
The plain example: Using voice-input for a web-search on the TV [0], make long pauses and observe how it keeps populating the prompt-UI with everything you say. This is a matter of #3 above, accusing a malicious intent already on such a trivial implementation topic is harming the whole story
[0] https://youtu.be/6IFVTcM28KA?si=oVqX6NtkxPmqh6R-&t=2951
I find your "summary" much harder to read and understand, though.
I prefer the original article and the net-benefit of a google-linked video to explain things that already were properly explained, is rather small, at best, in my opinion.
> I find your "summary" much harder to read and understand, though.
Sorry, my grouping of topics isn't supposed to replace the entire research-session. It's merely my observation after watching the actual "investigation video" that they mixed together lots of stuff they discovered into the larger conspiracy that everything is secretly spying on the user to feed a huge Ad-profiling database.
> I prefer the original article and the net-benefit of a google-linked video to explain things that already were properly explained, is rather small, at best, in my opinion
The article was made FROM the video and takes the wrong conclusions and summaries from it. If you want to form an opinion and are a bit technically savvy, you should watch the video instead.
Funny, published on a site with 1745 'partners' who fully respect our privacy of course
Respect for the consumer has long been gone generally except for a few brands.
I am still wondering why consumer respecting brands are not emerging more and thriving.
A consumer respecting brand sells products. A Consumer selling brand sells consumers so they can be profiled, analysed for weaknesses and exploited economically in the name of Surveillance Capitalism
I suspect because it's hard to differentiate between ones that actually respect the consumer vs ones that only say so, but are actually lying to your face.
That and not respecting the consumer is more profitable in the short term (only!), which means more marketing money, buying out other brands, lobbying to increase the barrier for entry, et cetera.
Because there's no incentive to do it. The consequences of being tracked are outta sight outta mind.
That is why politicians get rich.
But also, people do not generally hesitate in front of an all-you-can-eat bouffe
Okay. This is insane. First the monitor that uses a windows feature to automatically install a small helper tool with root permissions and then starts showing adds in certain regions. Now a tv that is actually actively snooping around on top of the known fingerprinting. What else is next?
In the previous topic I got ridiculed for not wanting to buy LG anymore because I could use an agent to modify to strip out the offending bits.
But there must be something better than just keeping to buy things that invade our privacy and homes further and further. Which brands aren’t doing this? Sony? They also announced a partnership for the lower end TVs IIRC.
Telescreens [1] are here!
War is peace. Freedom is slavery. Ignorance is strength. [1]
Would you like to know more?
[1] https://en.wikipedia.org/wiki/Telescreen
The thought police will be after you now for mocking them!
Yep. LG was reading Orwell and were like. Wow, great idea! Let's do it.
In an age where AI can search vast amounts of data having something in your home or workplace turning what it hears into text looks like a problem waiting to happen.
E.g. As soon as someone proves LG, Samsung, etc. recorded and stored credit card details and knowingly have weak security this is going to be a massive business liability.
That's an easy one to put a compensation figure on but there's probably all sorts of other exploits waiting to happen.
I think the most egregious thing here is that if you don't give the TV a network connection that it will actively search for other ways to get the data back to LG such as open WIFI.
>In an age where AI can search vast amounts of data having something in your home or workplace turning what it hears into text looks like a problem waiting to happen.
That's understating the problem. With or without AI, this should be cause enough to shut down a company or at least their specific product division.
>E.g. As soon as someone proves LG, Samsung, etc. recorded and stored credit card details and knowingly have weak security this is going to be a massive business liability.
They're going to be fine. A slap on the wrist at best.
> E.g. As soon as someone proves LG, Samsung, etc. recorded and stored credit card details and knowingly have weak security this is going to be a massive business liability.
My tinfoil hat believes that they've already accounted for this as the price of doing business. They will have already budgeted for the fines that they might incur, pay them off and continue as normal while people become accustomed to it.
The value of this data to the NSA, Mossad etc is probably the only thing keeping it secure.
Never in human history has a government had the means to simultaneously spy on millions of people, to use everyday private conversations to categorise them into various threats to the state, and better yet these tech companies can still sell the commercially valuable side of this to advertisers.
Advertisers are the reason we have this problem. The only way to stop them is legislation.
People could return to burning down enterprises that they find unsavory or detrimental to society, such as they did during the industrial revolution, but this is problematic in that it's violent and not something the modern person often considers as viable. A part of why people consider this unviable now is in-part due to the consequences of these surveilance technologies. It's difficult to accomplish a revolution when everyone is being spied on all the time.
“Citizens will be on their best behavior because we are constantly recording and reporting everything that’s going on”
- Larry Ellison (Oracle Corporation)
As much as the problem is advertising the government allows it because the government buys the data!
Based on historical records, I would say not much will happen to these companies. Interested to see what the EU will do though
>this is going to be a massive business liability.
No. this is going to go "unnoticed" or at least unactioned. These are surveilance devices - compromising their value as source of surveilance is neither in the interest of industry (who are selling and buying the surveilance) or government (who are buying and acting on it). The age of shame is over. Current world goernments have flourished under the premise of being terrible, horrible, awful, evil enterprises that do bad for the sake of either being bad or enriching the bad - a consumer device with a ToS that says it will spy on you spying on people is nothing now. Laws be damned, because laws mean nothing now. These devices bery well may soon be the only lawfully available devices in the consumer market precisely because of their surveilance capabilities. Governments are reluctanty catching up to the capabilities of digital technologies, and they're finding them more useful now than ever before. We will be burning witches again before we ever prosecute tech companies for doing bad things.
>The age of shame is over. Current world goernments have flourished under the premise of being terrible, horrible, awful, evil enterprises that do bad for the sake of either being bad or enriching the bad - a consumer device with a ToS that says it will spy on you spying on people is nothing now. Laws be damned, because laws mean nothing now.
Spot on.
I'm thinking less about shame, as corporations are dead to shame, and more about proof the TV stored a record of your bank details it got from text to speech.
If that's stored as text inside the TV and you lost money because it was copied by a hacker then you have a monetary value to show loss and a trail of liability you can use to sue LG.
> a trail of liability you can use to sue LG.
The average user would not realize LG was the reason, if they do they will loose more money and effort; LG's reputation and public image won't be even damaged enough for them to take a notice. You are an ant for them and ants are only powerful if they work together.
>I'm thinking less about shame, as corporations are dead to shame, and more about if you can prove the TV stored a record of your bank details it got from text to speech.
Then they'll get a joke fine, and continue as before. Maybe cut the price for a while, until they reintroduce it with another pretext a few years down the line.
At that point network isolation stops looking like a privacy preference and starts looking like an adversarial relationship with a product you own
... product you ownꭞ
ꭞ Terms and conditions apply
You would think that would matter, that they’re basically violating all known PII/HIPAA/GDPR/National security standards and god knows what else, but I expect at most some class action down the line.
At the same time an average citizen can sue and win against these corporations. I never ended up Suing because all companies settled once I showed the evidence. So try it out. Will get expensive for them to use lawyers against ai and still lose.
My TVs are on the IoT network so that I can control them from Home Assistant, but they're blocked from accessing the internet.
DNS lookups are redirected or blocked (53 redirected to my local DNS resolver, 853 blocked), and DoH is blocked as best effort though it's hard to block HTTP DNS traffic, which again is why the devices are blocked in the firewall.
All streaming is done via AppleTV, which is a platform I trust infinitely more than LG/Samsung/whatever.
All of your blocking still doesn't change the fact that your LG TV is actively trying to scan your local hardware, gathering IP-addresses of devices, wi-fi names and signal strengths, creating digital finger prints of the audio and video projected on your screen, recording audio through the internal microphone, even when the TV is in standby or without an internet connection, saving the collected data locally and uploading to LG Ad Solutions as soon as the TV is connected to the internet.
Yeah which is why its imperative that you _never_ connect to the Internet.
But it's never connected to the internet, not even for software updates. If the TV isn't connected to the internet there's no reason to update it, assuming the TV works as expected.
It's a trade off I guess. I use Home Assistant to control TVs, so kinda need the access.
Again, what I mean is, even if you're able to block all these things, the company LG is still secretly and actively trying to collect and process user data, without user awareness or consent.
Do transparent faraday cages exist?
If you're streaming via AppleTV, why do you need to give the TV itself access to the network?
I use Home Assistant to turn on/off the TV via automations, sensors, etc.
I could possibly do it via HDMI CEC, but I have a couple of Sony Bravia TVs that more often than not completely ignores that, so I prefer having control over assuming it happens.
There is sadly no hdmi CEC support on Most GPUs for pcs. So when you want your tv to turn on and off with your pc it is only possible with the tv being reachable from your pc via ip.
I believe LG doesn’t advertise such an api via Bluetooth
Congratulations but I also dislike this type of comment because that is not a solution, a workaround that doesn't happen for 99% of the population.
Soon you won't be able to IoT network or block these devices as they begin to partner with Amazon and the likes that sell Internet for near-by IoT devices. Then your only option then is physically removing / de soldering radios from the board.
Laws needed, like yesterday.
And then your neighbor spins up an unprotected network or something like xfinity which they could have a deal with and it connects there and phones home anyways.
And what exactly would they use that particular access path for ?
I could see a threat if the TV had access to the internet and could establish a TLS tunnel or similar from the mothership, and execute commands on my LAN (or IoT network as it stands), and report back. That could establish a command & control channel that could potentially orchestrate an attack on my infrastructure via the TV.
However, reporting that "network X exists and has these devices" over a different network complicates things a fair bit. In theory they could still use the TV as a command and control platform, but it would have to switch networks between my closed network and the open network in order to execute commands and report results. Not saying it's impossible, just very unlikely.
Besides, the TVs are not alone in being cut off from the internet. I have two IoT networks, one for trusted devices (AppleTVs, Sonos, and the likes), and one for untrusted devices like TVs. They run on different VLANs, and anything on the untrusted IoT network can pretty much only talk to itself (client isolation) and the gateway, and there's no internet and no open ports to any other VLAN.
> And what exactly would they use that particular access path for ?
Uploading the weeks, months, or years of locally-stored activity [0] data? Text compresses really well and local storage used to be very cheap.
[0] ...mic voice transcription, how often you use the thing, for how long, and a best guess (because of lack of time sync) at when, "automated content detection" logs [1], names of files you've fed to the thing, -if equipped with a camera- number of people in the room and interesting information about them, etc, etc, etc...
[1] ...assuming that that can be done with data loaded from the factory, which I kinda doubt...
I know its important to put things down to coincidence whenever possible, but a very expensive Bang OLufsen ( I think they use LG ) TV would turn itself off at "the" most interesting split second moments during gameplay , to the point where I thought "if I am being pranked by a friend, does this TV even stream its contents?".
Much to my surprise I found out that many modern TVs do in fact come with dev mode that allow some sort of screen capture.
Safe to say I turned off all the "allow metrics and market/dev modes" and have been happier since.
EDIT> Incase anyone was wondering I did some more research about my model ( im NOT a TV guy ) and came across this regarding what screen content could technically be passed remotely: "Most probable raw grab: ThinQ/SSAP on the LAN after pairing — ~960×540 JPEG. Live Plus/ACR: most probably sends a fingerprint, not a retrievable raw frame." No idea what it means but thought it might be relevant. Remember Im saying in my case it was a coincidence.
I'm inclined to believe the shutdowns were a bug rather than an extremely patient friend waiting for the perfect gameplay moment. But modern TVs having enough remote-management machinery that the prank theory isn't immediately absurd is not exactly reassuring.
Did it ever turn itself off after you made those settings changes?
Im not here to feed conspiracy theories and paranoia, its most likely a coincidence, and tied to having "excess metrics and advanced features that indirectly cause a kernel panic that turns the tv off".
But yes, after turning a bunch of unnecessary default options off, my TV never restarted again just as I was making a clutch moment.
So in summary - remember it could just be related to high action moment fps drain, heat, high intensity stuff making the nintendo switch2 compatibility cause a kernel affected restart etc etc etc ( which is documented via the HDMI protocols ) which make it SEEM like something weird is up, but it turns out its a related thing thats not that sus.
Most tvs now come with auto off kou have to cancel with a button press, prob just that.
Normally they show a warning, but i just got a new tcl, and it’s warning is very short leading to shutdown if you don’t pause quick enough to reset it
That did happen a few times , but Im telling you bro that TV restarted a couple times just as I was about to clutch, like the same second i was about to press a trigger in an otherwise boring 25 minute round more than once, but yes as I mentioned earlier it could be related to other tech aspects.
Clutch?
See e.g. https://en.wikipedia.org/wiki/Clutch_(sports)
Ongoing discussions:
"216M Spy TVs – The LG Smart TV Problem [video]" https://news.ycombinator.com/item?id=49592375
"LG TVs aren't the only ones spying on you [video]" https://news.ycombinator.com/item?id=49575176
I'm practically certain that there was no ill-intent by LG when conceiving this feature. It was most likely just a convenience thing.
But I am also practically certain, that, eventually, any pile of data will attract ideas you do not want attracted.
I don't share your definition of ill intent. The decision to put a (hidden) recording device in people's homes with the express purpose of exfiltrating data is already ill-intentioned of itself, regardless of whatever they planned to do with the collected data.
Look, I am probably more on your side than you are yourself, but this constant one-up-ing out of outrage in comment sections is so incredibly useless and harmful. Can you please stop.
I more than most people deeply understand the rage there, but I've tried to have a conversation here that leads somewhere, and you're dragging it back down to baseline outrage.
This is not how we actually achieve the goals we want to achieve.
Yes, unfortunately the investigative video is implying (or explicitly stating) malice on every detail they discovered, which is harming the overall message IMO.
They hacked the TV OS, then used the TV UI to do a web search with voice-input and observed (still on the UI!) that the voice input didn't stop immediately on silence but kept extending the search prompt with everything said [0].
The OS-hack was irrelevant for this, the whole sensationalism that a listening process is running (and therefore the device is listening to everything) is just drama added to the sober fact that someone started voice-input, the input field is still displayed on the bottom of the UI and keeps getting populated with new input.
There is an important message in this about security hardening, privacy, data protection, but this conspiracy theory that everything is made to spy on you is not helping...
[0] https://youtu.be/6IFVTcM28KA?si=OCmfai2KXSaQt1Bk&t=2958
I really wish Steve would not have befriended Louis to the degree he has, but.. well.
Or rather I wish Louis would limit the "bulldozing" persona to the context in which it is necessary instead of all contexts ever at any time.
No issue with people being friends. Just issue in standards deteriorating.
___
Is this how Twitter felt like for journalists back in the day? You see a story, and you think "ah yes, that guy's signature"?
End me.
This is the same behaviour as the german secret police in east germany. The difference now its for ads and by tech. All collected data are probably ai transcribed from audio to text and is fused via data fusion to serve ads. Add collaborative filtering to find similar interests between users.
how do you know it is for ads? how do you know it will always be only for ads if it now is?
Why not both?
Mossad would love to know who to de-bank for criticising Israel, United Health Care would love to know who to deny coverage to based on remarks about their back pain.
// Mossad would love to know who to de-bank for criticising Israel
"Criticizing Israel" has moved from edgy subversive to lamely pedestrian in the last few years.
There's no great secret that Mossad needs to unearth by spying on you watching tv.
that's the fear, but it would be reasonable to say that ads are what has gotten us to this point
Makes me glad I bought a Sony TV which has the microphone on the remote - and is compatible with older remotes without a microphone, so the new remote with its microphone and sponsored streaming service buttons gathers dust (without batteries inserted) while I use an old remote.
I could buy a tv in late 2014 and happened to be the last batch of bravia tvs pre android tv. Back then I was kind of bummed out that just a few weeks after that they announced the first tvs with android tv and now i was hooked with a smart-but-not-that-smart tv with a bunch of crappy ads, an unusable web browser and a non-customizable os.
But they stopped updating it years ago, none of its apps work anymore and the only "smart" feature that still works is screen mirroring feature. The tv part itself still works great. Not a 4k oled 120Hz shiny impressive thing but the image quality is still great. What I thought was an unlucky adquisition back then turned out to be a pretty good one.
Apps, browsers and "smart" features are disposable software, but a good panel can remain useful for a decade. Makes you wish manufacturers treated the smart layer as optional from the start.
This sort of blanket data collection needs to be made illegal in every single jurisdiction, and have _very_ robust penalties for anyone found in breach of them.
And those jurisdictions need to have people not susceptible to bribery or extortion by the corporations making those data collection devices. That's a big ask.
True. But corruption by those in positions of power and influence is a problem as old as the ages, sadly. But at least there _are_ rules and penalties in place for those caught so there's an element of risk. Whereas the blanket data harvesting by corporations currently appears to go utterly unabated.
Is all of them, every "smart tv" does it, even after adb, permission restricting or rooting. Insert a (non infected) usb lamp in your tv and see the lamp turning on when your tv is off. It notifies you about the background activation activity :) Interesting to see when exactly get active (is it keywords or nearby devices or scheduled processes)? Can´t be keywords as that would mean 24/7 active and the lamp says otherwise.
I absolutely loathe my LG smart TV. Just switching to another input requires 3 button press.
I hope someone uses their free time to hack the OS and offer a clean and simple interface to make it a “dumb” TV.
You're not wrong, but you could ask your favorite LLM to interact with the LG API's to switch the input for you. At least for my case, it was ~10 minutes of work to develop a small tray app that looks for a specific USB device and switches the TV input if it gets inserted. I don't really even touch the remote anymore
This is automatic liability in California and the EU, correct? Does Illinois consider one’s voice pattern to be a biometric? If so, there, too.
They just won't stop, will they?
They will once they've killed television and they'll get back to the net.
When the first TV ships with a battery to keep running while unplugged, I'm dusting off my soldering iron and my digital circuits handbook.
Wait, do LG Webos TVs have microphones in the TV and/or in the remote? I am aware of the latter only.
All devices in my home sit behind adguard. The TV can try all it wants.
Just don't buy a smart TV. Buy a good "dumb" TV (or just get a good large monitor), then hook it up to a set top box (with TV capabilities as needed).
"Just a good large monitor" costs a fortune.
If anyone could recommend any dumb TV with good panels in EU, you're more than welcome.
[delayed]
If you want a good panel, you're going to have to buy a smart TV.
Just don't ever let it connect to the internet.
... and that's the trick, isn't it. Have you ever tried going into an electrical store and buying a dumb TV any time recently?
[delayed]
I will remind everyone again that weev was raided by the FBI, arrested, and had all electronics seized, before getting a chance to defend himself in court, all for the crime of publishing emails he found on unsecured URLs he was able to guess.
But we're allowing 1000x worse things, because what, there's a vague line about it buried deep in some EULA, which means laws no longer apply?
Lets treat them the same. Raid LG, seize all of their electronics, at least in the US (other countries are encouraged to do their own raids), arrest the executives, and after they're all in jail, and digital forensics are poring over their products and servers to find what else they did, they can argue in court how actually all these crimes are legal.
It's only fair.
Almost 13 years ago: https://news.ycombinator.com/item?id=6759426
SKorean intelligence on China (and Japan). This will not be easily regulated. The intelligence value is huge.
As an owner of a (2020?) LG WebOS TV, to what degree can I fight this? Any point in trying Pihole with targeted blocking of certain IPs?
Vote for politicians that vocally campaign against advertising surveillance.
So I have a tv of LG from the same period. I keep it dumb, not connected to the internet and just use an apple TV, so far it's a clean option. And it's always a good idea to have piHole up to, they usually have the block list updated with LG's and Samsungs urls.
The Gamers Nexus video explained that they will connect to nearby open SSID’s to send the data they have collected. So just not connecting it to your network may not be enough.
I hear this a lot as a rumour but has it actually ever been demonstrated in the wild?
https://en.wikipedia.org/wiki/Capital_punishment
Okay, that is nasty.
Fun fact: some (most?) Samsung TVs of the last ~6 years can't complete OOB setup if they're connected to a PiHoled network with the most vanilla PiHole filters
You can (hopefully) root your TV: https://e.nya.je/getroot/ and then follow a guide like this to disable all the snooping: https://forum.level1techs.com/t/lg-tv-block-mini-how-to/2551...
Disclaimer: I haven't tried any of this myself, I've just been looking into it as I am/was considering buying an LG TV.
At this point, best to just keep it disconnected. Just use an apple tv or similar. They sold us a spying device masqueraded as a smart TV.
If internet is really required, I'd personally flood such an LG tv with fake data - add a raspberry pi to provide it with looped audio streams for the microphone, fake bluetooth devices, and so on. But it's still probably a drop in a bucket.
PiHole doesn't block IPs. It blocks DNS. The device have at least three ways to bypass PiHole: use external DNS directly, or pin the phone-home servers' IP addresses, or use some other protocols to carry IP resolution.
I'd just open the TV and yank or desolder the mic out. Or use the TV as a dumb monitor -- don't connect it to WiFi or Ethernet. And use an external Kodi/AppleTV/whatever-rocks-your-viewing-boat
> don't connect it to WiFi or Ethernet
This is not sufficient (for some of these devices) - they will automatically connect to an unsecured hotspot.
well, if that was the case with my TV and/or if I was worried, I've got a soldering iron and I'm not afraid to use it
I bought Apple TV many years ago and haven’t plugged tv into internet since.
I have a rooted LG C4. Beyond blocking things at the DNS level, not accepting terms, not using AI, I wonder if there’s some existing software solution or a documented step-by-step to remove this bloatware/spyware.
I posted two comments on similar threads recently. This is only going to get worse.
> Not long until companies partner with Amazon and others to send traffic automatically through their near-by devices like smart speakers, disconnecting will be impossible.
Not surprised if this is happening already. I don't want to remove radios out my TV..
> Samba, a media intelligence company have several partnerships with manufacturers to take screenshots and collect metadata.
Viewer analytics are valuable to companies like Samba, they aren't the only ones. Laws ASAP, these companies will lobby hard to stop anything of the sort.
These are spy devices. It is sad that the industry has become so addicted to sniffing - the problem I see is that they can no longer stop doing so, as they built an additional network around that yielding money to them.
the only TV I have connected to the home network (guilty, I admit), Sony OLED 65, ARP floods my network about 12-15 hours after "turning off". On a plus side, it doesn't appear to be streaming anything out: no local DNS hits, not enough outgoing traffic for any meaningful audio stream
The choice between privacy concerns and ineptly coded network stack is tough. But that's the choice we're forced to have
Why don’t you just use it as a display and have a more reputable device (e.g a mini pc or an apple tv) feeding it? I’m not forced to give my tv network access at all, since it doesn’t do anything other than display whatever the apple box outputs…
This is (mostly) the way. Samsung TV without networking configured, XBox for everything - which is problematic in its own ways but it's a known quantity. It doesn't prevent it from "helpfully" hopping on a nearby unsecured network but a) I haven't spotted one of those in a while, and b) it hasn't ever been able to get updates to change its behaviour to make it start doing that if it previously wouldn't.
notebookcheck.net:
> We value your privacy
Shares my browsing info with 1745 "partners" with no clear way to opt out (which ought to be opt-in by the way to be compliant with ePrivacy and GDPR).
"We value your privacy" → "Your private data is valuable" (I guess)
I mean, I’m not disagreeing, but it’s a bit rich for a site that logs data to 1,745 “partners” to be complaining too much.
Clearly the penalties for this are not high enough, because the scumbags keep doing it.
Vizio TVs were caught taking screen grabs and phoning those home years ago.
GDPR compliance lawsuitssss in 3...
I really hope they do and slap them with the 4% of their total global annual turnover.
Somehow the EU only appears to target big wealthy service providers. I wonder why.
Please bring your actual argument instead of insinuating stuff.
Anyway, the EU's reasons seem to be entirely legitimate to me.
There is censorship of illegal streaming sites crippling the internet (Cloudflare). People are being freightened from illegal iptv boxes to watch free sports because it could be part of a botnet or residential proxy network. There are million or billion euro fines for social media and service providers like google. There is enforcement against "fast fashion". Yet there is zero effort for iot privacy, not even labels or certification for good devices.
I don't want to be cynical but face it, the EU really only cares about things that generate money for themselves or big internal market players under the disguise of consumer safety and privacy. Obviously that also comes with some good effects but the perverse incentives are enormous from which we must not be blinded by ideology and warm feelings of our politicians being good and working for the people and the common good.
CMS has a public tracker of GDPR fines (https://www.enforcementtracker.com/) listing over 3000 cases, most are companies HN readers have not heard of.