By Jeremy Hsu on September 24, 2024


Popular smart TV models made by Samsung and LG can take multiple snapshots of what you are watching every second – even when they are being used as external displays for your laptop or video game console.

Smart TV manufacturers use these frequent screenshots, as well as audio recordings, in their automatic content recognition systems, which track viewing habits in order to target people with specific advertising. But researchers showed this tracking by some of the world’s most popular smart TV brands – Samsung TVs can take screenshots every 500 milliseconds and LG TVs every 10 milliseconds – can occur when people least expect it.

“When a user connects their laptop via HDMI just to browse stuff on their laptop on a bigger screen by using the TV as a ‘dumb’ display, they are unsuspecting of their activity being screenshotted,” says Yash Vekaria at the University of California, Davis. Samsung and LG did not respond to a request for comment.

Vekaria and his colleagues connected smart TVs from Samsung and LG to their own computer server. Their server, which was equipped with software for analysing network traffic, acted as a middleman to see what visual snapshots or audio data the TVs were uploading.

They found the smart TVs did not appear to upload any screenshots or audio data when streaming from Netflix or other third-party apps, mirroring YouTube content streamed on a separate phone or laptop or when sitting idle. But the smart TVs did upload snapshots when showing broadcasts from the TV antenna or content from an HDMI-connected device.

The researchers also discovered country-specific differences when users streamed the free ad-supported TV channel provided by Samsung or LG platforms. Such user activities were uploaded when the TV was operating in the US but not in the UK.

By recording user activity even when it’s coming from connected laptops, smart TVs might capture sensitive data, says Vekaria. For example, it might record if people are browsing for baby products or other personal items.

Customers can opt out of such tracking for Samsung and LG TVs. But the process requires customers to either enable or disable between six and 11 different options in the TV settings.

“This is the sort of privacy-intrusive technology that should require people to opt into sharing their data with clear language explaining exactly what they’re agreeing to, not baked into initial setup agreements that people tend to speed through,” says Thorin Klosowski at the Electronic Frontier Foundation, a digital privacy non-profit based in California.

https://www.newscientist.com/article/2449198-smart-tvs-take-snapshots-of-what-you-watch-multiple-times-per-second/ (paywall!!)

  • Slovene@feddit.nl
    link
    fedilink
    English
    arrow-up
    91
    arrow-down
    3
    ·
    edit-2
    3 days ago

    THIS is piracy. Along with all the other personal data selling.

  • Zementid@feddit.nl
    link
    fedilink
    English
    arrow-up
    45
    ·
    3 days ago

    Theoretically I could display highly illegal stuff and they would distribute it making them complicit?

    Can the API be hacked to flood their servers with petabytes of cat pictures?

    What is happening with the data? Where are the data savers?

  • dan@upvote.au
    link
    fedilink
    English
    arrow-up
    33
    arrow-down
    1
    ·
    edit-2
    2 days ago

    Don’t let your TV connect to the internet. I have mine on my wifi so I can control them using Home Assistant, but they’re on an isolated VLAN with no internet access.

    Edit: Of course, this only works if you use an external box for streaming, like an Nvidia Shield, Apple TV, Google Chromecast TV or whatever they call it now, etc.

  • 0x0@programming.dev
    link
    fedilink
    English
    arrow-up
    29
    arrow-down
    1
    ·
    edit-2
    3 days ago

    Buy a computer monitor, a projector or a commercial display instead, they tend to be dumb.

    Alternatively, don’t connect your TV to the internet (bear in mind some are wireless). Unplug it from the wall when not in use.

    As if Microsoft’s Recall wasn’t enough…

    • JordanZ@lemmy.world
      link
      fedilink
      English
      arrow-up
      13
      ·
      3 days ago

      I don’t think my TV has ever been connected to the internet. As a safe guard to ensure that it never is I banned its wired and wireless MAC address from my network. So even if someone did plug it in…nothing.

      • KamikazeRusher@lemm.ee
        link
        fedilink
        English
        arrow-up
        6
        ·
        3 days ago

        I’ve jokingly said this before, but just wait until manufacturers start adding 4G/5G to TVs explicitly for ads and telemetry…

        • rustyredox@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          ·
          2 days ago

          Just like modern cars… I wish there was some kind legislation that would limit phone-home telemetry to emergency service telecommunication frequencies, and be opt-in only. That way any OEM operating under commercial cellular frequencies would thus be unlicensed, and subject to FCC violations and import bans. Like what OnStar was originally pitched as; only auto dialing to 911, and 911 only, if you were unresponsive after airbags deployed. OEM couldn’t use the telecommunication frequencies for anything other than networking with emergency service endpoints on the same VLAN.

          Anything recorded by the vehicle would be required to stay on the vehicle due privacy regulations, like the black box recorder for warranted forensic investigations. OTA updates could also be distributed offline for users to download and flash via USB, like any motherboard bios, so transactions would be write only.

        • JordanZ@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 days ago

          There is usually two types of MAC randomization and they both apply to wireless. One is pre-auth and is part of the IEEE 802.11aq Pre-Association Service Discovery spec. It makes it harder to track a user just because they got in range of an AP.

          The other is when they actually connect to an SSID. Win10 and mobile OS’s started supporting this but it maintains a relationship between a MAC/SSID pairing otherwise you would have all kinds of network/auth weirdness if it didn’t.

          Regardless if I noticed a device on my network behaving poorly by randomizing its MAC on every connection then I’d swap my network over to a grant list of MAC addresses and it can happily knock itself offline as much as it wants. Utilize a guest networks for visitors to avoid the headache of list management when a friend stops by and wants WiFi.

          I can say I’ve never seen that behavior across all my devices though.

  • L0rdMathias@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    34
    ·
    3 days ago

    “They found the smart TVs did not appear to upload any screenshots or audio data when streaming from Netflix or other third-party apps, mirroring YouTube content streamed on a separate phone or laptop or when sitting idle. But the smart TVs did upload snapshots when showing broadcasts from the TV antenna or content from an HDMI-connected device.”

    The world is owned by a big club, and you’re not in it.

  • oce 🐆@jlai.lu
    link
    fedilink
    English
    arrow-up
    16
    ·
    edit-2
    3 days ago

    “When a user connects their laptop via HDMI just to browse stuff on their laptop on a bigger screen by using the TV as a ‘dumb’ display, they are unsuspecting of their activity being screenshotted,”

    But if you never connected the TV to the internet, it’s not able to upload anything right?

      • tal@lemmy.today
        link
        fedilink
        English
        arrow-up
        29
        arrow-down
        2
        ·
        edit-2
        3 days ago

        Thing is, it’s getting pretty cheap to build radios into devices, and companies are doing that and bridging them to whatever Internet connectivity they can reach, not just your own. You don’t necessarily have to personally plug something into an Ethernet socket to make a device Internet-connected.

        From back when Amazon Sidewalk was rolling out:

        https://www.statuscake.com/blog/what-is-amazon-mesh/

        This time, however, the big news is Amazon mesh, a network to connect users and their devices. The tech giants have called this project Amazon Sidewalk+ with the idea first being made public back in 2019 where they announced they wanted to extend and expand the connectivity of their customers.

        Why did Amazon do this?

        According to Amazon, the main reason was to provide a better service for their customers whilst using their devices. Although there has been some backlash by those in the safety and security space, the idea seems to be very safe and simple.

        How will Amazon mesh work?

        The Sidewalk project will create a network mesh between all the connected devices so it can increase the connection field around the devices. It will be able to do this by using Low-energy Bluetooth and 900MHz radio signals to pass data with the connected compatible devices. By doing this, the network can extend the reach of the signal and thus it will be able to cover a larger area to allow devices to connect.

        Here is an example of how this will work: imagine if you have a compatible device at the end of your garden such as a light which you normally can’t control with your phone. With the extended network, that light could connect to a neighbour’s device and by doing this it will be connected to the network, and you will have the ability to then use your phone to control the light.

        There has been some concern regarding how much data the network will use for those who agree to be part of it and Amazon have estimated that the data usage could be around 400-500mbps a month. For most people, this is such a small amount that it won’t even be noticeable.

        How can the mesh network be used?

        Another use for this mesh is for users around the network to connect and possibly use the mesh to perform other tasks such as a Ring doorbell (Amazon-owned) to be installed in the part of the house where the usual Wi-Fi signal doesn’t reach. This provides customers with a great alternative to the far more expensive Wi-Fi extender mesh products on the market.

        As is normal in situations like this, many users are concerned about the security of this project. According to what Amazon has released regarding how it will work so far, there will not be any security concerns as the connections will not identify which device was connected meaning that if your Ring doorbell extends the network to a nearby device, the system will not mention that this device was connected to that particular Ring doorbell. However, people need to be aware that Amazon itself can collect this data and the way the users interact with the network.

        https://www.theguardian.com/technology/2021/jun/01/amazon-us-customers-given-one-week-to-opt-out-of-mass-wireless-sharing

        The feature works by creating a low-bandwidth network using smart home devices such as Amazon Echoes and Ring security cameras. At its simplest, it means that a new Echo can set itself up using a neighbour’s wifi, or a security camera can continue to send motion alerts even if its connection to the internet is disrupted, by piggybacking on the connection of another camera across the street.

        But the company’s plans have caused alarm among observers. Ashkan Soltani, a former chief technology officer of the US Federal Trade Commission, told the tech site Ars Technica: “In addition to capturing everyone’s shopping habits (from amazon.com) and their internet activity (as AWS is one of the most dominant web hosting services) … now they are also effectively becoming a global ISP with a flick of a switch, all without even having to lay a single foot of fiber”. The feature may also break the terms and conditions of users’ internet connections, which do not allow such resharing, warned Lydia Leong, an analyst at Gartner.

        Users can disable Sidewalk in the settings section of the Alexa or Ring apps, but have until 8 June to do so. After that, if they have taken no action, the network will be turned on and their devices will become “Sidewalk Bridges”.

        Amazon is not the first company to look to create such a network. Apple has taken a similar approach with the company’s range of AirTag item trackers, which can connect to the internet through any compatible iPhone they come into contact with, not simply their owner’s. And BT, through a long-term partnership with Fon, ran a service from 2007 until 2020 that allowed broadband customers to share spare bandwidth in a public wifi network.

        When you have companies creating their own radio networks, they can use someone else’s Internet connection to move data.

        For expensive devices, like cars, it also makes economic sense to have a dedicated cell modem and service phoning data home. But it’s not the only route.

        Point is, you don’t have a monopoly over granting your devices Internet access any more.

        • wise_pancake@lemmy.ca
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          1
          ·
          3 days ago

          Yeah I remember when they rolled that out… it does not give me hope for the future of privacy.

          Canada needs to really ramp up our privacy laws, I’m not crazy about GDPR specifically, but there needs to be something more substantial here.

          • tal@lemmy.today
            link
            fedilink
            English
            arrow-up
            1
            ·
            edit-2
            3 days ago

            I’m not really gung-ho about mandatory approaches either, like with licensing, but for an optional approach:

            • I have to be able to assess a device and its drawbacks with a reasonable amount of knowledge and time spent researching it.

            • There has to be at least one option on the market that does what I want.

            For cars, at least, we’re really getting to the point where it’s not practical to get a new car without a cell data link that phones home.

            And trying to stay atop of the privacy issues for all classes of device out there can’t be a full-time job, or it’s not reasonable to expect people to make informed purchasing decisions. Like, I should just be able to say that I don’t want a device that broadcasts any persistent unique IDs in plaintext over a radio, not have to research whether the current crop of smart automobile tire pressure valves has a protocol that exposes that information or not…

            I’d like to avoid Europe’s prescription-heavy regulatory route, but the way things are now in the US isn’t my ideal either.

            • flappy@lemm.ee
              link
              fedilink
              English
              arrow-up
              1
              ·
              3 days ago

              My hot air station has a reeeealllly long cable.

              So long. It’s the best. Unlike my…

        • Monument@lemmy.sdf.org
          link
          fedilink
          English
          arrow-up
          8
          arrow-down
          1
          ·
          3 days ago

          Well. That’s it. Get the flamethrowers. Time to burn down the Amazon.

          No. Not the one that’s already burning. The other one.

  • Daemon Silverstein@thelemmy.club
    link
    fedilink
    English
    arrow-up
    16
    arrow-down
    3
    ·
    3 days ago

    That means they’re violating HDCP (High definition copy protection)? Do streaming services such as Netflix and Disney, as well as movie studios such as Universal, know this?

    • dubyakay@lemmy.ca
      link
      fedilink
      English
      arrow-up
      10
      arrow-down
      3
      ·
      3 days ago

      Did you go beyond the headline?

      They found the smart TVs did not appear to upload any screenshots or audio data when streaming from Netflix or other third-party apps, mirroring YouTube content streamed on a separate phone or laptop or when sitting idle. But the smart TVs did upload snapshots when showing broadcasts from the TV antenna or content from an HDMI-connected device.

      • Takumidesh@lemmy.world
        link
        fedilink
        English
        arrow-up
        9
        arrow-down
        1
        ·
        3 days ago

        So an HDMI connected device that is streaming Netflix is getting screenshot?

        I mean, even if it wasn’t a streaming service, but let’s say, video game content, or a blu ray, that is still a violation, and of course, if I’m playing content I made, then it’s violating my copyright.

      • seejur@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        ·
        edit-2
        3 days ago

        Does it means that it broadcast my chrome browser if connected through HDMI? If I check for a password in the password manager in chrome, it fucking sends my password to Samsung?

        • dubyakay@lemmy.ca
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 days ago

          Yes and no. Supposedly the resolution is not in 4K or even 1080p, but something much lower that is still enough to identify content, like shows, movies and ads, but not enough to make out minute detail.

        • andrew_bidlaw@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 days ago

          It may be them either not trespassing their territory (as a part of a deal or as a precaution) or TV apps sharing\telegraphing that info without the need of screen cap analysis as they work on TV itself and may as well be special modified apks. At least, they differed

          Laptop sends only it’s video and audio outputs, apps’ code executes at it’s hardware, so TV needs a workaround to know what you are watching. And as it’s incapable of such analysis itself, it channels that data to it’s real owner.

        • dubyakay@lemmy.ca
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          1
          ·
          3 days ago

          No, the point here is that if you use the “smart” features, which includes running apps from their appstore, like Netflix or Disney+, it will not send the data. But if you connect your laptop via HDMI and then play Netflix in your browser, it will, because it’s not smart enough to recognize and differentiafe video and audio data coming in through that port. I don’t think it matters if it’s a DRM enabled browser or not. It should be acting as a second monitor only in those cases, nothing more.

        • dubyakay@lemmy.ca
          link
          fedilink
          English
          arrow-up
          2
          ·
          edit-2
          3 days ago

          Says who?

          You are allowed to take screenshots of Netflix, even under the DMCA on DRM protected material. You are not allowed to use it commercially though. Personal use only.

      • Daemon Silverstein@thelemmy.club
        link
        fedilink
        English
        arrow-up
        3
        ·
        3 days ago

        Exactly. HDMI contains HDCP when HDMI is streaming something copyrighted, such as Netflix app/in-browser. While they allegedly don’t record Netflix app on TV, they’ll be recording Netflix if it’s been streamed from computer via HDMI.

  • tal@lemmy.today
    link
    fedilink
    English
    arrow-up
    11
    ·
    edit-2
    3 days ago

    I’d rather pay for pretty much all products up-front with money at purchase time rather than pay with my data.

    Not gonna tell other people what to do, but for myself, whether it’s my car or television or search engine or whatever, I’d rather just pay the bill rather than having the manufacturer or service provider go data-mining my data to figure out how they can make money from it.

    I think that YouTube is a great service. YouTube Premium, though, is ad-free. What I want isn’t no-ad stuff, but no-log policies. And there aren’t a lot of manufacturers selling privacy. And it’s hard to compare services and products based on that.

    I’ll go one more step. I don’t want to go read through privacy policies and figure out what the latest clever loophole is. We had to deal with that kind of legal stuff back prior to standardization around a few open-source licenses, and it sucked.

    And I don’t want to deal with privacy policies that change and maybe don’t do what I want.

    What I want to do is look for a privacy certification, and let the certification agency deal with that.

    • melroy@kbin.melroy.orgOP
      link
      fedilink
      arrow-up
      1
      ·
      3 days ago

      2000 dollar/euro premium price for Samsung S95D isn’t high enough?? No… we already pay up-front with money. This is just a very nasty trick by Samsung & LG.