Hacker News

> So they are claiming that ACR is done entirely through audio processing, and no visual data from the screen itself is used? That...doesn't seem plausible.

It's probably easier to do and every bit as accurate as just using a screenshot.

And it's still exactly what I don't want them doing. There's literally zero reason for LG to be building an advertising profile on me because I was foolish enough to buy one of their TVs. This isn't something that makes their products better, it's spying.

Here's how it's been done in the past

https://www.cameronmacleod.com/blog/how-does-shazam-work

Audio is a bit easier to turn into a fingerprint for identification vs video. Video has a lot of smaller subtle changes that happen from things like compression which make it a lot harder to identify. It's why youtube still hasn't figured out piracy, but they'll knock you immediately if you play 5 seconds of copyrighted music.

> So they are claiming that ACR is done entirely through audio processing, and no visual data from the screen itself is used? That...doesn't seem plausible.

Wrong. They claim it doesn't record video. Recording means saving permanently - live processing is not recording. ACR is processing the video output live.

Notice what they don't say at all. ACR is just one type of spying. A completely separate feature records what you say from the microphone. They only claimed ACR doesn't do that, which we knew. They did not claim the TV doesn't do that.

This is a carefully crafted PR statement, to avoid saying any lies while making it sound like the accusation was wrong, but it does not actually say the accusation was wrong. We can infer that the likely reason it doesn't say the accusation was wrong is that the accusation is right. Instead, it says several other things, which sound like they are refuting the accusation but are actually refuting other things that nobody said.

As usual, the key to explain the discrepancy between LG's claims and the paper 2024 is in the wording. Read carefully: LG claims it "does not collect screenshots, screen recordings, video recordings, voice recordings, or other audio recordings from the TV.". IOW they are making the technical distinction between "fingerprinting" and "screenshots or recordings".

And specifically, they are not confirming or denying that video fingerprinting are done.

What I think is likely is, as the paper states, that they fingerprint both audio and video. Upload both to their servers. But they end up using only the audio fingerprint for ACR. In this situation, neither LG's statement, nor the paper's statement, nor the GamerNexus folks's claims are incompatible with each other.

It even makes sense from a technical standpoint: it is far easier to uniquely identify content by audio than by video, as a fingerprint of a few milliseconds of audio is pretty darn ideal, compared to fingerprinting even a single video frame which has hundreds of ways it could be compressed depending on codecs, bitrate, resolution, etc.

I can’t speak to how LG does this now but I ran an agency that built Smart TV apps and built one of the first ACR powered apps on LG about 10 years ago. We were working with a company called “Cognitive Networks” which later was bought by Vizio and is now their Inscape product. At that time one use case wasn’t just tracking but actual interactive “sync to broadcast” apps (you can still do this, no one does, and I don’t know why)

At that time during testing Cognitive could literally see what we were playing on our TV (not full video but the frames used for fingerprinting)

They don’t use Cognitive anymore for obvious reasons and there are several audio based ACR solutions but they always had issues with sections of video without much audio to work off of so we’re always considered inferior. They are fine for usage data however.

Anyway my $0.02

> So they are claiming that ACR is done entirely through audio processing, and no visual data from the screen itself is used? That...doesn't seem plausible.

It apparently is.

Do you know the Nielsen Ratings? That's exactly how they know what people are watching these days. I've been contacted by them to be one of their subjects. They ship you a device that listens and recognizes based on content. They look for certain "fingerprints" in the audio and match against that - it's not capable of recording our conversations, etc (or so they claimed).

Does it matter? Whether they are doing it on device or in the cloud, they are still recording what their customers say and collecting data on it without their consent.

To me, this is really an admission.

No, I think they’re saying two separate things:

- ACR uses audio fingerprinting

- ACR does not collect screen recordings

Both can be true if the TV hashes the frames locally and ACR “collects” the hashes.

Tom's response: "Sounds good, please don't take offense at me adding https://github.com/furkan-bayrak/lg-tv-blocklist to the PiHole. Can never be too safe, right?"

Get saavy...? More like "will require trust that manufacturers are honest" -- which I won't believe for a miliesecond.

From reading other responses, it seems there is an assumption the image itself is fingerprinted. The digital content is encoded, there is essentially a barcode on your TV screen with lines running horizontally that you cannot see with the human eye. The encoding is picked up as the signal, it does not need to see or recognize if that is your favorite actress on the screen.

The thing which depresses me the most is all these so-called smart TV's are giant Arm computers that run malicious software. Imagine if we could re-flash your TV with Linux or whatever.

Well, not that Apple is doing it all their fans will claim it's ok

> That...doesn't seem plausible.

In what way? Dramatically lower processing and signature complexity. Audio signature matching is trivial and extremely well known. I see absolutely nothing implausible about this, and it seems a robust, viable solution.

> This paper from 2024 investigated both Samsung and LG and found that they both capture screen images for ACR, and send the resulting hash (not the raw content) back to the manufacturer for identification.

That paper found no such thing. That paper actually demonstrated that they have no clue how the ACR happened, they just demonstrated that playing content yielded content IDs. It is more likely they were witnessing audio ACR happening, exactly as LG described.

How they spy on people isn't the issue.

Spying on people without explicit consent (in a situation where you can say no without penalty) is the issue.

on-device transcript of audio recording is not audio recording ;)

The key problem is content identification, not how it is done. Seems like they are doing "look over there!" thing.

After doing some investigation into my Bang Olufsen after some tech not working right apparently Dev mode on it allows "Most probable raw grab: ThinQ/SSAP on the LAN after pairing — ~960×540 JPEG. Live Plus/ACR: most probably sends a fingerprint, not a retrievable raw frame."

As per HN thread last week

> ACR uses audio fingerprinting technology

so they aren't even denying listening in on everything?

Has that paper been replicated?

this is clearly an "anonymization" claim.

What is anonymous: we record all the hashs from all the programs people are watching to identify people watching the same thing.

What is not anonymous: we hash all the content in the world, along with hashing the content people are watching, and reconstruct what they watched.

> We're going to have to get saavy in pulling apart the distinction between

We probably shouldn't: doing any of this horseshit is a good reason to return a product. We should start doing that en mass until they get the idea.

In any case, "We don't record continuously" is still recording. They should not be recording at all!

Yes. Another example:

> If no wake word is detected, the audio is processed locally, promptly deleted, and is not transmitted to LG servers.

This statement could still be true when:

* The audio transmission is to non-LG servers (e.g., Alphonso).

* The audio isn't transmitted, but the text transcription is.

As someone who hasn’t owned a television in decades, why would a TV even need a microphone in the first place?

How many other household devices have a microphone whose primary function is orthogonal to recording audio?

> The majority of the problem is also simply the ability to record.

Exactly, and recent announcements like Apple normalising always on recording, even wrapped in “big promises” on privacy, deserve a lot more attention and strong regulation.

Even some updates will trigger the acceptance screen from time to time, with a second scare confirmation shown when I reject. If my wife or kids were shown that screen when I’m not around they would accept it.

even if you reject, later on some app from their store won't work until you accept

From Nov 2013, but still related:

LG Smart TVs logging USB filenames and viewing info to LG servers https://doctorbeet.blogspot.com/2013/11/lg-smart-tvs-logging...

HackerNews discussion (178 comments): https://news.ycombinator.com/item?id=6759426

Why would anyone connect their TV to the Internet? It’s been known for years that it spies, although maybe not to this extent. Or are these TVs auto connecting open WiFi or the neighbor’s Xfinity WiFi?

And Steve says LG is full of shit. Thanks Steve. https://youtu.be/ToP9xfLDSME

> everything was opt-in

Opt-in used to mean that it was disabled until you explicitly click somewhere to enable it.

For like a decade, the "opt-in" to ACR was included in the ToS agreement needed to use any smart features. Then at least some brands made the opt-in separate, but made it look like a recommendation engine or "help us improve your experience" agreement.

LG adopted the "Maybe Later" dark pattern for opt-in to ACR, at least in some markets. Though I guess you never know for sure with A/B testing.

LG is contradicting themselves here. In order to detect a wake word then they must be collecting or recording ambient conversations.

I don't know how LG TVs do it, but e.g. many smartphones use a dedicated ASIC/audio processing chip that does not really record anything, but specifically listens for the wake word and discards all other audio to save power/battery life. I think this distinction is relevant, because there is a huge privacy difference between streaming a live audio stream to the cloud to detect a wake word and a specialized audio processor that has a small buffer only for detecting the wake word, where the audio does not leave that processor.

Theoretically, you could call that few-second buffer recording, but I don't think that would be collecting/recording ambient conversations to most people, since it's ephemeral and does not leave your device.

The question, of course, is what happens in LG TVs.

>LG is contradicting themselves here. In order to detect a wake word then they must be collecting or recording ambient conversations.

No, it's arguably accurate because "record" implies it's being persisted. Otherwise something as simple as a sound meter (which needs a microphone to operate) is "recording".

Seems like these weasels are using the James Clapper definition of the words “collecting” and “recording”.

> In order to detect a wake word then they must be collecting or recording ambient conversations.

There's a risk here that we will talk-past one another while using different meanings of the same words, so let me offer a scenario:

AcmeTV has an isolated component which taps microphone input, records to a 5-second ring buffer, and on "Wakey-Wakey" triggers an alert flag. Assume it works perfectly accurately.

Would you accuse AcmeTV of "recording or collecting ambient conversations" on the basis of that component constantly reading microphone data?

Personally I wouldn't, because it's not the same kind of "recording" we consumers are concerned about.

I don't know how LG is doing it, but I suspect that they are taking the same approach for wakewords as Alexa does/did. When I worked for Alexa, it was public knowledge that we used relatively inexpensive and low power chips dedicated to wakeword detection, and those would wake up the main chips if they believed that they heard the wakeword. To my understanding, we did this because doing cloud-based wakeword detection was considered incredibly expensive and wasteful, and there are vendors with pretty decent and inexpensive wake word detection chips.

Then, when the system was more awake, it would attempt to figure out whether the wakeword was real or not (e.g. sometimes certain words and word pairs have a very similar sonic signature to 'Alexa'), and if it felt confident enough then it would begin streaming audio to the back end for significantly improved voice recognition.

Since Amazon took (and as far as I know still takes) voice privacy incredibly seriously, voice recordings and data were treated as essentially radioactive waste, deleted as soon as legally possible, and secured against even internal Alexa developer access.

I personally don't have the same level of confidence in security with LG, who seem to think they don't have as much to lose as far as customer trust goes and might as well exploit the heck out of the systems they have. I suspect that problem, which Amazon has so far pretty successfully avoided for the most part, is self-correcting over time.

>Hi LG

Fuck that. Dystopian shit with people yelling brand names in their homes.

Edit: I forgot people already be yelling Alexa/Siri/Google. I can't imagine a future when you have to yell to each brand in your home. "Hey Sony, turn on the PS7. LG what's on the fridge? Samsung, start the cycle in the dishwasher".

> But what scares me is when every device comes with their own esim and cellular radio.

Cars already do, and the solution is well-known: find the bug, and squash it. Yes, your car will still work, and you cannot be denied warranty because of this. The cellular modem is more or less accessible depending on the make and model.

Same here, I registered the domain [0] moments after watching the GN video. It's serving an oled-safe screensaver with some, uh, relevant content.

[0] https://weowntheglass.com

You shouldn't be really scared until all devices follow the pattern of the iPhone (and maybe new flagship Android phones too, I'm not in that camp).

New iPhones are expensive, more than $1000. Yet most people who get them finance it through their cellular carrier, usually 2 year plans, so it's just $30-$50 tacked on to the monthly cellphone bill. So ... no one cares unless it's going to double their bill.

Let's say the RAMopocalypse and other AI-driven chip pressues drives everything up even more; let's say now-cheap TVs are now $2000 or $3000. No biggie. Your cellphone company can offer you an eSIM-locked TV with bundled network and services, on a 5 year plan with free lifetime service and replacement, adding just $30-$40 to your bill for 5 years. Maybe it will include something like Family Tracker Life360 Intercom as a value-add - talk to your children to/from the TV to/from any phone on your plan, anywhere, anytime. Safety, etc.

Same thing with your laptop, home IoT/security devices, etc.

If ATSC 3.0 dies and gives way to 5g Broadcast, it'll be another enabler for something like this.

That's when the real lock-in will happen.

When you buy a BIC pen, you own all content created with that pen, not BIC. This needs to be applied to all other tools; computers, TVs, AI agents, ...

With out the user the content would have never been created. Users are the content creates and now the push to remove their owners ship of their actions and move it to the wealthy.

Greed begets more greed.

They don't need that - look up Amazon Sidewalk.

Technically when you turn the TV on for the first time, ACR is not enabled. Ergo, not enabled by default.

Sure, to use the TV you need to go past the EULA screen. And the button right in front of you, pre-selected - is agree to all terms. And after pressing OK, you now have ACR turned on. But you did that, it wasn't on by default.

Okay I can take my soul sucking corporate hat off now.

https://youtu.be/6IFVTcM28KA?t=1370

They at least use a pattern where you need to accept terms of use & privacy policy when you download an app. Same screen has option to accept other agreements like ACR. However by default "select all" option is highlighted so people will often click that.

Slightly earlier on video they state that certain ad related things got turned on automatically during software updates.

I bet it's inadvertently enabled if you want to watch Netflix within 5 minutes of powering on the TV and rush through its setup

it turns on when you agree to the 197 page arbitration agreement

source: i made it up

Could just be enabled with a simple update post-unboxing to make it compliant with that statement. Off by default but enabled as soon as it connects.

Why don’t you read LG’s actual statement, which states that it “requires separate explicit user opt-in consent and can be disabled at any time through the TV settings.”

Remember when Amazon deleted books from customers' Kindles (eBook reader), and the book they decided to remotely burn was .. 1984 from Orwell.

I was alive for that but had forgotten about it…wild.

Yep and they were fined a paltry 6 million dollars or so. For actively distributing and infecting users with malware. This on annual sales exceeding $3B.

That case sure put Mark Russinovich on everyone’s radars, at least.

Good times.

First time hearing of this

Wow. I hope Gamers Nexus sues for defamation.

It is not enabled by default, but conveniently it's toggled on if you accept the ACR terms of service - including if you select "agree to all" - during TV setup and/or when downloading or updating any apps.

A few months ago, my Roku TV started displaying these weird popups, saying something like, "Looks like you're watching college basketball. Did you know Roku-TV also has college basketball?" - something like that. Well, for the Roku device, yes, there was a setting I could disable, but (1) Roku pushed this 'feature' and made it default without my knowledge/consent, and (2) the config setting says the popups will stop, but it doesn't mention the data collection; my assumption is they're still collecting that data for their own data analytics purposes.

Wired wrote an article in 2017 [1] on whether it's possible/probable to do that. Technology has evolved a lot since then, so it's a lot more feasible, but the article describes how far metadata alone can go.

For example, let's say an ad network knows your and your friends' location, and knows you've met because you've been close together frequently, or are using the same wifi network. You talk about perfumes, then later one of them looks up perfumes on their phone. Google would usually have access to this much metadata, and will likely serve you perfume ads because of your friend who later looked it up.

This doesn't directly answer your question though. The answer would be - it's possible, but a lot is possible without that.

[1] https://archive.is/OyuUO

I don't know, but I suspect the battery drain would be substantial. I wonder if there is a different explanation: maybe one of your friends searched for information on the topic while you were on the same hotspot/in the same location and that (along with existing relationship graphs?) allowed them to target you? That's how I'd do it, I think.

There is a real possibility that either something you saw triggered the conversation and/or that you remember the ad because you spoke about it. It’s enough to linger on an ad for the platform to recognize your interest and serve you more ads like it.

It's technically possible but very unlikely. Running TTS continuously is a big battery drain and slows down the rest of the phone while you're using it. Google has a live TTS service for hearing impaired which I've run for a while to test it, and even with it practically built into the OS it's sucking up battery like you'd expect it to.

It's more likely that this is all due to external forces. Having your device on the same network, in close enough proximity to detect each other, for instance, combined with one of your friends having Googled the stuff you were talking about.

Or just basic data collection. There's the classic story about how supermarkets know you're pregnant before you do, just based on the groceries you buy (no, not pregnancy tests). Ad networks buy and collect a humongous amount of information about everyone and serve ultra specific targeted ads based on nothing more than pattern matching based on what the rest of humanity is doing.

It's impossible to rule out that the thing did run a 24/7 TTS service, but I think the depressing fact that ad networks don't need to listen to our conversations to know what we're talking about is more probable.

You don't need monitoring for that to work. Just something like "Hey, Google". The device knows a bunch of keywords and when it hears them it's bingo. As long as your laptop and phone are logged into the same local network with the same public IP they'll get the same ads.

And your phone most likely already listens all the time to catch an "Hey, Google" (or something similar).

No phone has ever been caught doing that. But TVs and phones have been caught collaborating. What brand is your TV?

Good read: https://www.amitracked.com/learn/is-my-phone-listening-to-me

I think the disappointing reality is that those ad networks have enough access to the content of your attention (and therefore what you talk to your friends about) that the technical cost and risk of surreptitious audio monitoring just isn't necessary.

People always dismiss this as FUD but it's been happening to me more than ever. I know in many cases it is more likely that firms are acquiring purchase histories and location data but that doesn't explain other incidents.

For example, last week I was complaining to my spouse about shoulder pain and how I was afraid I may need another surgery. YouTube has suddenly starting flooding my feed with videos about "shoulder exercises to avoid surgery." I hadn't searched any of those terms, purchased anything or visited an orthopedic, so I don't know what else could possibly explain it.

More like "a capitalism fever dream"

This is just straight up false.

OLED productions costs have fallen, and the yields have gotten better — displays of all kinds have gotten cheaper, not just TVs; OLEDs have started showing up in products they haven’t before for cost reasons, etc.

The manufacturers make some profit on the data they harvest, sure; but the biggest BOM costs of TVs have definitely also dropped sharply.

I don't need the TV to be cheaper. I can afford to make up the difference for whatever few hundred dollars extra they would earn selling my data. But the expensive ones do this stuff, too.

This is the way. My TV tries its hardest to get me to connect and whenever I turn it on, it doesn’t fail to remind me that I’ve disabled the microphone and that I should turn it back on. But as soon as the Apple TV takes over all is good.

Any chance someone one day will make a spyware-free OS I can run on my LG TV? It was pretty expensive and hardware wise is quite nice. Would love to be able to keep using it

Has someone qualified that removing the wireless hardware leaves the device functional?

This would be a nice public service for gamers nexus that happened to buy a lot of these devices. :P

I can say from experience in several devices (but not an LG TV) that removing dedicated bluetooth chipsets so far has left devices functional. ... but some things implement their bluetooth as part of the ESP32 that is the whole kit and kaboodle, so you can't remove it.

As to why someone would remove these components -- in addition to the explicit spying LG is doing, there are companies dragnet collecting BTLE device identifiers <> gps collecting, including collecting them via phone apps. This means that if you have any BTLE devices that are frequently with you or otherwise connected to your identity it may be possible for a threat actor to determine your location(s) from largely unregulated commercial databases.

I don't use BTLE at all, so this 'functionality' is a pure risk to me.

That is one thing AI companies try to do, make it impossible to do any kind of piracy or reverse engineering through their "safety alignments". And it's pretty reliable.

by the way, Intel's Quark chip is installed at least 3 times on each chipset and can run on a Minix OS when plugged in to the power and off:

from: https://web.archive.org/web/20201201175708/http://blog.ptsec...

Highly efficient" is 25mW at 33MHz. According to the Wikipedia page, it can run even when the PC is off but plugged in or connected to battery. an ARM Cortex M0-4 will use even less power in idle. All it needs is a tiny capacitor and bootrom and a secret flash storage to record audio and upload it once internet becomes available

"The Intel Management Engine always runs as long as the motherboard is receiving power, even when the computer is turned off. This issue can be mitigated with the deployment of a hardware device which is able to disconnect all connections to mains power as well as all internal forms of energy storage. The Electronic Frontier Foundation and some security researchers have voiced concern that the Management Engine is a backdoor.

Intel's main competitor, AMD, has incorporated the equivalent AMD Secure Technology (formally called Platform Security Processor) in virtually all of its post-2013 CPUs."

https://en.wikipedia.org/wiki/Intel_Management_Engine

There are countless low or passive power audio devices since the Thing that can record and upload/bounce audio to receiveing devices: https://en.wikipedia.org/wiki/The_Thing_(listening_device)

Don’t give your TV internet access, and use an Apple TV.

Leave it offline.

Any guide to doing this?

The US agreement says it too. They make you agree to them collecting it. It says they listen to everything that's said in the vicinity and you agree to inform any guests to your house that they're being recorded at all times. But nobody reads that.

they detail, but no one reads that anyways

Also debunked in the Gamer Nexus video. The TV will scan for public wifis and connect. Watching the video, it also seemed like a "missed opportunity" for LG to not create a mesh network of LG devices that would help eachother connect to the internet. So the LG device on your neighbours wifi might help your not connected TV to some tasty internet access. Or at least to unload its cache of A(V)CR fingerprints.

LG is truly an adversial party in all of this.

I don't think it's unreasonable to think that the television would search for unsecured wi-fi or other ways of connecting to the internet without user input.

I'm not sure if any TVs currently do this, but they could connect to unsecured public WiFi without the user doing anything, if one were available with no password. Fortunately such networks aren't that common most places, but it's not a big leap from the sketchy things LG and other companies do. They could also put SIMs in them if they wanted. Again, I don't know that any do that, but I wouldn't put it past them. I'm not that paranoid, but I don't trust them to be up front and ethical.

A TV not on the Internet is basically worthless these days, unless you have a third-party streaming device like a Fire or Shield--and then you're just moving the trust point from the TV itself to the streaming device, and the same concerns exist. Do you trust Amazon any more than you trust LG?

I’ve had TVs that had important firmware updates that improved hdmi/atmos/etc compatibility

Agreed. I leave my tv disconnected from the internet, and connect my Apple TV instead… the default UX on most tvs is so much slower and add-riddled than Apple’s

It might be reasonable for a new source you don’t pay for to make money from advertising. Not so, the company that sells you a tv

What are you talking about? The linked article is from Tom’s Hardware…

Yes. The Gamers Nexus video points out that in some cases LG makes more money from selling your behaviour to ad partners, than on the hardware itself.