Smart TVs are like "a digital Trojan Horse" in people's homes(arstechnica.com)
arstechnica.com
Smart TVs are like "a digital Trojan Horse" in people's homes
https://arstechnica.com/gadgets/2024/10/streaming-industry-has-unprecedented-surveillance-manipulation-capabilities/
40 comments
You can get a large monitor with no smart tv features and just use it like a tv, however those are also starting to disappear and be replaced by “smart monitors”
Sceptre sells 4k tvs that are not smart, though they have been hard to find as of late. [1]
[1]https://www.sceptre.com/TV/4K-UHD-TV-category1category73.htm...
[1]https://www.sceptre.com/TV/4K-UHD-TV-category1category73.htm...
Thank you. I've been looking for a link to TVs that are still dumb.
Just buy a smart tv but don't connect to wifi?
I'm sure this will soon be solved using the hack of accessing shared Wi-Fi fabrics that some ISPs now offer (as in, the thing where the router will offer a generic network such as CoxWiFi, and allow random people to pay to use your WiFi; even if you don't have it, maybe your neighbor does)... and even then, new IoT longer-range WiFi services can act as a backstop.
Or inexpensive cellular modems.
Someone in the future will make decent money converting smart tvs to dumb tvs.
Someone in the future will make decent money converting smart tvs to dumb tvs.
Its already happening with Amazon Sidewalk and LoRa bands.
Some of the larger ISPs are also piping cell phone communications to VOIP at the edge using built-in features in the modems, and these are hopelessly insecure by regulatory action.
Take a look at the Cypher-Con talk on cable modems. Pretty damning. (https://www.youtube.com/watch?v=_hk2DsCWGXs)
Some of the larger ISPs are also piping cell phone communications to VOIP at the edge using built-in features in the modems, and these are hopelessly insecure by regulatory action.
Take a look at the Cypher-Con talk on cable modems. Pretty damning. (https://www.youtube.com/watch?v=_hk2DsCWGXs)
Just don't have any visitors in your house either, as they might connect it to their cell phone hot spot to watch one of their Netflix shows or similar when you're not looking.
As much as you think this scenario is paranoia, your visitors will think you not connecting your TV is just as paranoid.
As much as you think this scenario is paranoia, your visitors will think you not connecting your TV is just as paranoid.
It literally isn't good enough anymore. Smart TVs try to phone home in many ways. Thanks to things like Amazon Sidewalk, they can jump on that network for connectivity without your knowledge if it's available nearby.
Some TVs have modular pcie devices in them. You could probably just take the off but with my guess, it would send the TV into panic mode and not boot-up without the device.
The last smart TV I had flashed an annoying light if there were no wifi connection.
Cover the light, I thought!
...the annoying light is adjacent to the IR receiver.
Cover the light, no remote.
Is this intentional?
Cover the light, I thought!
...the annoying light is adjacent to the IR receiver.
Cover the light, no remote.
Is this intentional?
Probably not international in context. Most IR receivers go behind a special semi-transparent plastic. That's also the cheapest place to put an LED. I think there are films you can get to block non IR light. Some tvs also have a connection to add an external ir receiver.
How do you use it then? A Roku is more secure?
Roku TVs "phone home" a lot. I had one with pihole blocking it's collection, but they still updated my menus to suggest garbage for me. I wasn't willing to let the device go un-patched and still be on my networks, so there was probably still data getting back to them. A computer is easier to secure but still has all the same issues by default. The difference is that a computer isn't designed to spy on you. Netflix in a browser is still going to tell Netflix about your viewing habits, but at least it doesn't tell Roku via screen scraping as well.
Nvidia shield is what I use on all my TVs.
Same here. Nvidia shield with FDroid sideloaded and a custom launcher is pretty solid.
No Ads with the custom launcher.
I don't have to be logged into anything I don't want to be, the devices are... not excellent but probably the best you can get right now for the price range.
Media format compatibility is good. Bluetooth connectivity exists for peripherals (incl audio bars and headphones). It has USB ports to take a thumbdrive or other android support peripherals (incl USB audio DACs).
Good support for CEC and the remote has IR support for controlling other hardware (ex - I can make it work with my Epson projector just fine).
I don't really like the toblerone remote form factor - and it should be against the law into include dedicated streaming service buttons (netflix... blegh), plus every now and then I have to reboot the device. But generally speaking... if one died I'd probably buy another as the replacement.
No Ads with the custom launcher.
I don't have to be logged into anything I don't want to be, the devices are... not excellent but probably the best you can get right now for the price range.
Media format compatibility is good. Bluetooth connectivity exists for peripherals (incl audio bars and headphones). It has USB ports to take a thumbdrive or other android support peripherals (incl USB audio DACs).
Good support for CEC and the remote has IR support for controlling other hardware (ex - I can make it work with my Epson projector just fine).
I don't really like the toblerone remote form factor - and it should be against the law into include dedicated streaming service buttons (netflix... blegh), plus every now and then I have to reboot the device. But generally speaking... if one died I'd probably buy another as the replacement.
What about smart monitors?
common advice is to never connect your smart TV to the network. Only use the HDMI inputs.
Reasonable advice. However it's worth keeping in mind that HDMI supports Ethernet passthru so it too can be used to connect out.
Technically true but this feature never had much update and I believe hdmi ARC and this are mutually exclusive/use the same wiring path?
Anyway I think the real threats will be:
1) Aggressive wifi search connecting itself, including deals with ISP routers to allow them to bypass you or even other devices.
2) Time-bombs causing the TV to become non-functional or degraded if you don't connect it to the internet, after the warranty or return window has expired
3) In-built 5G modem connectivity (everyone says this is to expensive but manufacturers could cut bulk deals and could limit the bandwidth usage, even just sneaking in firmware updates has a lot of abuse potential)
Anyway I think the real threats will be:
1) Aggressive wifi search connecting itself, including deals with ISP routers to allow them to bypass you or even other devices.
2) Time-bombs causing the TV to become non-functional or degraded if you don't connect it to the internet, after the warranty or return window has expired
3) In-built 5G modem connectivity (everyone says this is to expensive but manufacturers could cut bulk deals and could limit the bandwidth usage, even just sneaking in firmware updates has a lot of abuse potential)
Almost nothing supports HDMI Ethernet, it is the use of extra signal path on the cable to provide an ethernet link between two devices. Both devices have to support the extra signals and one of them has to be able to route, so it's basically someone's bright idea that barely has any support.
2) I've designed a system like this for a TV rental company, although legally a general retail TV manufacturer wouldn't want to do this because it causes reputational damage.
3) There's material cost for the modem and then there's a subscription cost for the connectivity. Either of which would reduce their profitability.
I spent a decade working in consumer electronics, working with all the major brands you know well, many of the white companies who make the components and the ODMs who make the boxes that will get a brand stamped on them by whoever is buying it.
Ultimately the TV business is barely profitable, most big brands sell TVs as something of a loss leader so that they can sustain their brand name. You spend each night with a Samsung, LG or Sony remote in hand looking at their product? Then they're winning in their eyes. Also because of the relatively high value of the TV it sustains their overall turnover without actually contributing to profitability. When a manufacturer launches a new TV they get about 8 months to make a profit on it, after that they're probably losing money because of downward pressure by retailers to drop the price. That's driven by consumer demand for cheaper rather than better products by the way, consumers have some responsibility for the state of the market.
The Smart apps systems cost the TV manufacturer, they have to supply the servers and infrastructure. They may make a small commission if a customer signs up to a streaming service on their device, but otherwise your general use of Smart technology costs them money every day.
Ultimately, most TV manufacturers have zero interest in spying on you. LG's biggest blunders can all be traced back to a lack of care and due diligence in their handling of data. Most of the time the 'mass data collection' is just accidental, someone in the development team thought it would be a good idea to collect data and some researcher is horrified by how much data gets sent back. Sometimes, someone gets the idea that viewing data could be used to put ads on the product, but ultimately they're not interested in what you watch, they're interested in grouping you into an advertising bucket so they can suggest you watch another movie with a Hemsworth in it.
I'm not saying that there shouldn't be oversight, and that these companies don't do stupid things for money, but ultimately there's never malice, or a desire to spy. Most of the overreach is incidental to the overall goal.
If someone doesn't want to use smart TV tech, then I'd advise them to not connect the TV to the network. There are set-top boxes out there that can do the job easily enough, and some of them might not even spy on you. One thing to remember is that many Android boxes you buy online, especially the "IPTV" ones, are riddled with malware. So don't think that by disabling Samsung and going to Kodi, you're making yourself safer.
2) I've designed a system like this for a TV rental company, although legally a general retail TV manufacturer wouldn't want to do this because it causes reputational damage.
3) There's material cost for the modem and then there's a subscription cost for the connectivity. Either of which would reduce their profitability.
I spent a decade working in consumer electronics, working with all the major brands you know well, many of the white companies who make the components and the ODMs who make the boxes that will get a brand stamped on them by whoever is buying it.
Ultimately the TV business is barely profitable, most big brands sell TVs as something of a loss leader so that they can sustain their brand name. You spend each night with a Samsung, LG or Sony remote in hand looking at their product? Then they're winning in their eyes. Also because of the relatively high value of the TV it sustains their overall turnover without actually contributing to profitability. When a manufacturer launches a new TV they get about 8 months to make a profit on it, after that they're probably losing money because of downward pressure by retailers to drop the price. That's driven by consumer demand for cheaper rather than better products by the way, consumers have some responsibility for the state of the market.
The Smart apps systems cost the TV manufacturer, they have to supply the servers and infrastructure. They may make a small commission if a customer signs up to a streaming service on their device, but otherwise your general use of Smart technology costs them money every day.
Ultimately, most TV manufacturers have zero interest in spying on you. LG's biggest blunders can all be traced back to a lack of care and due diligence in their handling of data. Most of the time the 'mass data collection' is just accidental, someone in the development team thought it would be a good idea to collect data and some researcher is horrified by how much data gets sent back. Sometimes, someone gets the idea that viewing data could be used to put ads on the product, but ultimately they're not interested in what you watch, they're interested in grouping you into an advertising bucket so they can suggest you watch another movie with a Hemsworth in it.
I'm not saying that there shouldn't be oversight, and that these companies don't do stupid things for money, but ultimately there's never malice, or a desire to spy. Most of the overreach is incidental to the overall goal.
If someone doesn't want to use smart TV tech, then I'd advise them to not connect the TV to the network. There are set-top boxes out there that can do the job easily enough, and some of them might not even spy on you. One thing to remember is that many Android boxes you buy online, especially the "IPTV" ones, are riddled with malware. So don't think that by disabling Samsung and going to Kodi, you're making yourself safer.
> Ultimately, most TV manufacturers have zero interest in spying on you.
Then where did ACR come from, and why do more and more TVs ship with it nowadays?
Then where did ACR come from, and why do more and more TVs ship with it nowadays?
Lets not forget that any "Smart" TV that has voice control can probably record audio in your home at any time.
https://www.schneier.com/blog/archives/2015/02/samsung_telev...
Any "Smart" TV that has a camera to see who is watching (to customize content and ads) does just that...
https://www.schneier.com/blog/archives/2015/02/samsung_telev...
Any "Smart" TV that has a camera to see who is watching (to customize content and ads) does just that...
I became fully aware of this when a few months ago, my Xiaomi smart TV turned on by itself and displayed an AD to subscribe to Netflix (I did have the Netflix app installed because I had an account a while ago, but I had already unsubscribed, I simply forgot to uninstall the app).
Needless to say, from that moment onwards, no wifi and no ethernet for the TV. I got an Xbox with Kodi connected to it. I am not saying the Xbox is immune to data harvesting (probably they collect a fair bit), but feels less intrusive and obnoxious than the whole package of the smart TV.
Needless to say, from that moment onwards, no wifi and no ethernet for the TV. I got an Xbox with Kodi connected to it. I am not saying the Xbox is immune to data harvesting (probably they collect a fair bit), but feels less intrusive and obnoxious than the whole package of the smart TV.
What they're attempting to do seems fundamentally impossible to me. Personalization requires there is a specific person tied to the output. With phones and PCs, that's a fairly reasonable assumption. With a television, it quite often isn't. Services allow you to create individual "who is watching" profiles, but the reality at least for my family is no one uses those. We all watch from the same account and same profile. We also watch together, in which case there is no answer to a question that assumes only one person can watch at a time. Sometimes, no one is watching and the stream is simply left on while everyone is sleeping or out of the house and autoplay is streaming to an empty room. Sometimes, we leave things on intentionally for the cats. My wife has ADHD and puts something on only to walk away two minutes later, but it's still on.
In some extremely dystopian future that I'm sure is coming quickly, a television may be equipped with video surveillance capability that can identify eyeballs in real time and decide exactly what animal is viewing what part of the screen and estimate from bloodflow in the face and pupil dilation the extent to which they care and are paying attention, but we're definitely not there yet.
Right now, this is still just snake oil they're selling to ad buyers. Why I get almost all fast food, beer, and insurance ads, even though I don't drink, haven't eaten fast food since 2002, and haven't changed insurance providers since 2008.
In some extremely dystopian future that I'm sure is coming quickly, a television may be equipped with video surveillance capability that can identify eyeballs in real time and decide exactly what animal is viewing what part of the screen and estimate from bloodflow in the face and pupil dilation the extent to which they care and are paying attention, but we're definitely not there yet.
Right now, this is still just snake oil they're selling to ad buyers. Why I get almost all fast food, beer, and insurance ads, even though I don't drink, haven't eaten fast food since 2002, and haven't changed insurance providers since 2008.
The title and subject sound like they are about smart TVs, but the example problems sound like they are about streaming in general, which might be streamed from my cable box, or on my computer monitor. Are the streaming issues really limited to the smart TVs?
I think everything spies these days, I don’t know why the government is not just cutting all of that off with privacy laws. They’re attacking the heads but this stuff is like a hydra. Just pass a comprehensive law against data harvesting and pro-privacy.
Because governments are on it too, big time. It's not just about surveillance politics, or big businesses in some surveillance economy, or credit card purchase data leaked everywhere, or Echelon, or platforms spilling their (our) guts. It's about surveillance everything.
Because it's not an option if you're McKinsey, a data broker, a private security firm, or anyone contracting them. Data collection is an obligation, a requirement. They need to know about what's everyones up to, even if it's only through real time metadata.
Face recognition cameras everywhere, automatic photo radars, license plate readers at busy corners, everything going through apps in potentially always operating and recording pocket pcs we call smartphones, with potential trojans everywhere, in potentially everything. TV's are just one evocation of the disease, mainly directed at old folks, because nobody else cares about TVs and cable subscriptions anymore.
Anyone with just an once of understanding about how computer networking actually operates will actively put up all sorts of firewalls and air gaps around anything they own, because why not.
Anyone else, who shrugs at geek talk, is nothing but fair game, and will remain until someone suddenly pulls the rug from under them. Think massive actionable intelligence used against large parts of a population in a war, or a conscription, or a coup, or a full scale invasion, or whatever. Anything less will only be laughed at and dismissed.
You're offering a comprehensive law against that? That's not enough, far from it. Pass anything, I guaranty you the hydra will still be well and thriving anyway.
Because it's not an option if you're McKinsey, a data broker, a private security firm, or anyone contracting them. Data collection is an obligation, a requirement. They need to know about what's everyones up to, even if it's only through real time metadata.
Face recognition cameras everywhere, automatic photo radars, license plate readers at busy corners, everything going through apps in potentially always operating and recording pocket pcs we call smartphones, with potential trojans everywhere, in potentially everything. TV's are just one evocation of the disease, mainly directed at old folks, because nobody else cares about TVs and cable subscriptions anymore.
Anyone with just an once of understanding about how computer networking actually operates will actively put up all sorts of firewalls and air gaps around anything they own, because why not.
Anyone else, who shrugs at geek talk, is nothing but fair game, and will remain until someone suddenly pulls the rug from under them. Think massive actionable intelligence used against large parts of a population in a war, or a conscription, or a coup, or a full scale invasion, or whatever. Anything less will only be laughed at and dismissed.
You're offering a comprehensive law against that? That's not enough, far from it. Pass anything, I guaranty you the hydra will still be well and thriving anyway.
Would like to second this …
The linked report has a lot to say specifically about smart TVs as well as specific streaming services and platforms. Smart TVs are a major part of the problem, but far from the only thing to be concerned about.
Right. It's no more acceptable for Amazon, Google, Apple, or Roku to have my data than the TV brand. But it's hard getting away from all of them.
I’m paying Apple to watch things, and sync them been my devices. I don’t see how Apple could not have “my data”.
There isn't any way to allow certain streaming services via a firewall whitelist, but block all the extraneous connections a TV might make is there? (As the TV manufacturer might use the same CDNs/IP ranges as legitimate services?), ideally without hacking about with the TV itself.
Or would it be best just to never connect the TV to a network and use a computer to access streaming services.
Or would it be best just to never connect the TV to a network and use a computer to access streaming services.
Yes, generally that concept is possible. I don't know of software that makes a whitelist firewall easy to use. You also run into problems when your streaming provider updates ip addresses or cdn DNS names, which can be frequent. The other issue with this is that the streaming provider that you pay might also be adversarial. You may want to allow some of their traffic but not other. So you end up maintaining some kind of list that can break your streaming experience if you don't maintain it.
As content providers consolidate on shared infrastructure (AWS, gcp, etc) the chances of good and bad actors using the same IP increases. This decreases the effectiveness of firewalls that operate on ip:port matching. Most firewalls do this.
Realistically, what you probably want as a tech savvy consumer is home network level DNS blacklist. It is not a firewall and it doesn't technically block traffic. It does prevent traffic from leaving the device if the DNS the device wants to send to is blacklisted. This exists (pihole) and can be added to a network fairly quickly. Bad actors could bypass your DNS or use known ips directly. Whitelisting dns would also work with the caveat that you'll need to update the list frequently and I don't think pihole was designed for this.
All of that is fairly complicated. A wireless keyboard and mouse and HDMI cable are cheap and laptops are plentiful. You will have the same adversarial content provider issues with a laptop, though. Scriptsafe and ublock can help. Laptops actually shut down when you tell them to. Your tv is probably on even when the screen is off.
I made this decision recently when I inherited a Sony TV with a house. It has not been connected to a network and I use a laptop to stream. I also run pihole, scriptsafe, ublock, and I pay for most of my streaming providers. They're still getting data on me, but less than most people.
As content providers consolidate on shared infrastructure (AWS, gcp, etc) the chances of good and bad actors using the same IP increases. This decreases the effectiveness of firewalls that operate on ip:port matching. Most firewalls do this.
Realistically, what you probably want as a tech savvy consumer is home network level DNS blacklist. It is not a firewall and it doesn't technically block traffic. It does prevent traffic from leaving the device if the DNS the device wants to send to is blacklisted. This exists (pihole) and can be added to a network fairly quickly. Bad actors could bypass your DNS or use known ips directly. Whitelisting dns would also work with the caveat that you'll need to update the list frequently and I don't think pihole was designed for this.
All of that is fairly complicated. A wireless keyboard and mouse and HDMI cable are cheap and laptops are plentiful. You will have the same adversarial content provider issues with a laptop, though. Scriptsafe and ublock can help. Laptops actually shut down when you tell them to. Your tv is probably on even when the screen is off.
I made this decision recently when I inherited a Sony TV with a house. It has not been connected to a network and I use a laptop to stream. I also run pihole, scriptsafe, ublock, and I pay for most of my streaming providers. They're still getting data on me, but less than most people.
it's actually quite easy to set up for netflix for example: https://github.com/AdrianCX/pico_hole
no need to overcomplicate, your concerns are valid but we're not there yet. Above has worked fine for 2+ years as is.
no need to overcomplicate, your concerns are valid but we're not there yet. Above has worked fine for 2+ years as is.
Telescreen and you have to pay for it. "The future is so bright I don't need my eyes to see it."
Papers? Is this your usual way home from work comrade?
The cool thing is when you buy it and the manufacturer decides to assault you months down the line with software updates against your will that add malicious advertising and bullshit to your TV.
Love that predatory bullshit, and it keeps on happening with every TV platform.
Love that predatory bullshit, and it keeps on happening with every TV platform.
I told my boomer elders NOT to plug in the smart TV. They just can’t resist the temptation of convenience.
EVERYTHING is a damn smart tv now