Headphones are collecting too much personal data (2019)

https://www.soundguys.com/headphones-are-collecting-too-much-personal-data-21524/

by teddyh • 6 years ago

493 403 6 years ago

Is there a true app that, preferably open source, that can disable the all microphones, confidently, for all apps, without having to physically disable my microphone as Edward Snowden suggested?

teddyh2• 6 years ago

If one app can turn the microphone off, can another app turn it back on?

toomuchtodo2• 6 years ago

Depends on the permissions model of the OS, and if you trust the OS. Hence why Edward Snowden and Bunnie Huang developed the Introspection Engine [1].

It’s reasonable to assume that if you can’t audit and review the code of the app and the OS, you can trust neither and need safeguards at lower levels of the stack.

[1] https://www.tjoe.org/pub/direct-radio-introspection/release/...

monadic22• 6 years ago

How can you trust the hardware is not recording?

I’ve never felt better about connecting “dumb” headphones.

retrac• 6 years ago

Only a slightly related tangent, but most headphones and other loudspeakers can be very effective microphones when wired into the right circuit.

While speakers are often wired directly to a one-way DAC, that's not always the case. Sometimes the analog lines are all fed into a multiplexer and it can be routed to a ADC. Sometimes it's wired to a general purpose IO pin.

In such cases, reprogramming could turn that speaker into a microphone. I wonder if anyone has exploited this in the wild yet.

jacquesm5• 6 years ago

You can do the opposite of noise cancellation too: determine the back emf from the speaker compared to the audio input, that will give you the audio in the room. So you can use the same circuit both to drive the speaker and use it as a microphone. As good as undetectable until you trace the circuitry of what looks like an ordinary amplifier. The difference is on the order of a few mV but that's more than enough.

My personal favorite is the laser attack that turns any shiny surface into a microphone. When it's not on it literally isn't there.

layoutIfNeeded• 6 years ago

No need to use a laser if there’s an incandescent bulb in the room: https://www.wired.com/story/lamphone-light-bulb-vibration-sp...

rightbyte• 6 years ago

If you have noise cancelling there is allready mics right?

mixermachine• 6 years ago

Most bluetooth headphones already have a mic ^^. At least the ones I own and the ones I found after a short Amazon search.

segfaultbuserr• 6 years ago

See SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit https://arxiv.org/abs/1611.07350

If you are a hacker who removed microphones from your computer but is worrying about this exploit, fortunately, a simple mitigation is possible - just put an audio amplifier or unity-gain buffer between the speaker and the audio output port, so the audio signal cannot travel back to the audio chip. Any "Hi-Fi" headphone amplifier can be used, but a $0.5 opamp is enough - a daughterboard can be tiny enough to fit inside a laptop.

Bluecobra• 6 years ago

Ahh, this is real reason why the phone manufacturers want to get rid of the headphone jack. I was so naive to think it was only about DRM/licensing.

gruez• 6 years ago

Isn't this really only an issue if you use the companion app? I doubt the usb-c/lightning/bluetooth headphones can exfiltrate data if you don't have the companion app installed.

Lio• 6 years ago

You also can't get firmware updates if you don't install the companion app and allow them to spy on you.

dangoor2• 6 years ago

There were two things that happened when Apple got rid of the headphone jack: (1) they added water resistance, (2) the phones got thinner. Plus, Apple had seen the trends heading toward wireless headphones.

They still included a dongle to give you a standard headphone jack.

While Apple could likely have gotten their water resistance even with the headphone jack, they couldn’t have made the phones as thin. People may disagree with the product choice, but I don’t see any reason to think that those weren’t the real reasons.

walls• 6 years ago

The phones are thicker now than they ever were with the headphone jack. In fact, the 7 was the last version to get thinner.

https://i-cdn.phonearena.com/images/articles/301929-image/iP...

formerly_proven4• 6 years ago

the phones got thinner

No. They didn't.

iPhone 5: 7.6 mm thin, 6: 7 mm

iPhone 7: 7.1 mm

While Apple could likely have gotten their water resistance even with the headphone jack, they couldn’t have made the phones as thin.

Except that's a pretty obvious lie. Not just that the phones did not get thinner (or lighter), they stayed around the same thickness (+- 0.5 mm), while getting larger, much heavier and much more expensive. But also the thinnest Android phone with a 3.5 mm jack is just 5.1 mm thick, for example. Sony even made a waterproof phone that's 6.5 mm thin and still has a 3.5 mm jack, which is thinner than any iPhone ever.

Everything about this argumentation is wrong or an outright lie. The only reason they did this is because they could moneygrab through accessoires better when they eliminate standardized I/O.

coliveira• 6 years ago

They "had seen the trends heading toward wireless headphones" or they wanted to create the trend and sell their own headphones? The second explanation seems much better.

jimmaswell• 6 years ago

The Samsung S10 line is water resistant with a headphone jack just fine.

snvzz5• 6 years ago

As usual, if there's no headphone jack, I won't buy that device. Privacy isn't even the deal breaker there. Latency and the ability to use my favourite set (Sennheiser HD600) are.

ubercow134• 6 years ago

Can a phone reasonably drive such high-impedance headphones anyway?

wiredfool• 6 years ago

I like my grados, but my old sennheisers were perhaps a bit more comfortable.

baal80spam• 6 years ago

Imagine seeing such article title 10 years ago...

What happened to the world?

taytus• 6 years ago

Companies finally figured it out that nobody cares about privacy.

skummetmaelk• 6 years ago

And that data is money.

Nextgrid• 6 years ago

Lack of regulation and non-existent enforcement of existing regulation.

People are used to the government being there to prevent companies from doing bad/dangerous stuff. It’s why you can buy any food at any supermarket and be reasonably confident it won’t poison you or be full of cyanide.

People expect the same when it comes to technology companies, and I once did too - I expected that big companies would’ve already got in trouble if they did something bad so it must be safe. The problem is that is far from the truth.

unethical_ban2• 6 years ago

Re: Personal fitness and menstruation history - Is that shocking? They're earbuds, but they're marketed as fitness buds that track personal data. It looks like Fitbit for your ears. Fitbit and Apple Health (or whatever it is called) does these kinds of things as well.

Re: Bose collecting all that stuff

I can see "why" they would want all that, in order to optimize their sound output of their buds to the kind of music and environments for which they are used. That should, of course, be opt-in, but I don't think it is evil.

Do I necessarily like the latter example? No. I believe, like the "cookie policies" that exist on many websites, there should be "Needed permissions" and "Please thank you" permissions, and they should incentivize the consumer to help them out. Amazon does this on their Kindles: $20 off if you let them run ads on the lock screen.

But if all the manufacturers do this, then what competition is there to push them to change?

amelius• 6 years ago

I can see "why" they would want all that, in order to optimize their sound output of their buds to the kind of music and environments for which they are used.

I can't see why they would need so many samples. Wouldn't using the data from (say) 100 Bose employees be sufficient to cover most noisy environments these buds are used in?

floatingatoll• 6 years ago

If you're trying for perfection, then not even remotely, no. The type of data provided by "one million users" will uncover issues that "one hundred users" simply never can.

I believe it was iOS 10 or 11 developer betas that would, on each beta update, run a trial APFS conversion process against the phone's internal filesystem, check the result for consistency, and then discard the replica and report success/failure w/ logs — so that Apple could find the issues that they couldn't find at 'one hundred users' scale.

renewiltord7• 6 years ago

There's a famous Bose bughunt article that proves this not to be the case. I can't find where they posted it on a blog or something but here's the forum link:

https://community.bose.com/t5/Around-On-Ear-Headphones/Bose-...

eigenvector• 6 years ago

Ordinarily when you pay $350 for headphones it is assumed that the vendor has already invested money in doing R&D to make them work properly and isn't planning to do testing on you without telling you or compensating you for it, to enable the functionality you already paid for.

I bought headphones, I did not sign up for a research project.

We went from paying for software to getting it for free in return for our data and now we're apparently giving over our data even for physical devices that we pay top dollar for.

godelski• 6 years ago

ow we're apparently giving over our data even for physical devices that we pay top dollar for.

This is the thing that really bugs me. I don't like the user is the product aspect but I can at least understand it in a free setting. In a high case luxury setting where you aren't even getting a discount? That's just absurd. All they've done is increase their bottom end, give you no choice and no discount.

mnm12• 6 years ago

What sound algorithm uses menstruation data to optimize sound output?

unethical_ban2• 6 years ago

"Fitbit for your ears"

Seems pretty clear it is advertised to do more than play audio.

lostmyoldone• 6 years ago

I see this as only another example of how markets with too little, or the wrong kind of regulation so easily creates anti consumer, or anti environment, etc behavior.

... Which makes total sense from a market efficiency point of view, at least as long consumers doesn't have perfect information and the time to stay informed about almost everything. Which isn't true, and people won't be, especially since the most basic decision theory that we can derive from our behavior would go almost entirely counter this.

... Which isn't strange at all as the number of new or changing facts that could affect our living situation probably didn't change as much from 150000 years ago, as changed last week alone.

Sometimes I think one of, or maybe the most damaging lie of our century is that we are generally capable of individual, rational thought for everyday decisions. We really are not, not to any significant fraction.

Almost all our decision are derived from observation of very few instances, judging based on survival instincts, and social cost/benefits.

In contrast much of rules regarding eg advertising and much of economic theory seems predicates that everyone has the time and energy to figure out which toothpaste company also are not totally exploiting some workers in some country five shell companies and thousands of miles away. But I digress.

baochan• 6 years ago

How exactly does a headphone app have access to your alcohol use and menstruation history? Where is it pulling this data from?

wbkang• 6 years ago

It's one of the data types apple health can collect. The headphones app probably asked for all possible types of healthkit data.

lrnStats• 6 years ago

If that stock takes a tumble, you can bet their marketing is going to drop the privacy branding.

Everyone knows their customers are highly susceptible to marketing, it would be a gold mine.

caymanjim• 6 years ago

They don't. The app may ask for it, and there may be some benefit to the user if they provide it, but it's not like the headphones magically acquire any of the data the author is complaining about.

If people want to give their personal information out, that's up to them. I personally limit what information I share, and I get annoyed when devices or apps try to sneakily get more information than I'm willing to intentionally provide, but this article is silly.

The younger generation has grown up without a sense of personal privacy, and they're largely ok with it. They will happily give away personal details in exchange for a "free" app or product, and they bend over backwards to expose their entire lives via images and videos on social media. There's always mock outrage when someone "discovers" that the reason the Internet is free is because someone is selling personal data to drive advertising, but everyone knows that. Most people just don't care.

saurik• 6 years ago

They care. It exudes as a cynicism about the world and continual jokes about talking to the FBI agent assigned to watch them. They (as are we) are just powerless to prevent it as every single service and every single platform and apparently every single product is collecting data on us. And since the value of services and platforms and, sadly, even products goes up as more people are using them, the arguments of "don't use these products and vote with your dollars" that people constantly push are nonsensical: you can value your privacy but also value having a romantic partner, and most people these days use dating apps to date; you can value your privacy but also value getting invited to the birthday party, and most people these days invite everyone to their party on a social network; you can value your privacy but also value being able to travel, and so unless you want to be the one insane person in your friend group who doesn't use Lyft/Uber and never knows when the public transportation is running late and takes forever to book hotels (and always ends up spending a lot more when you do)... well, you are going to use a bunch of apps that do a bunch of data collection.

People care. They have no choice.

ktr• 6 years ago

Has anyone had any experience with new Bose headphones? If you use the Bose Connect app, I believe what the author wrote is accurate. But that app doesn’t work on the newer headphones (at least, not the ones I have). Instead I need to download the “Bose Music” app which doesn’t seem to give you the same options for privacy. And if you don’t use that app, the headphones are much less useful (eg, no hardware controls to switch which device you are connected to).

aragorn92• 6 years ago

Why do you think they made a new app to begin with? the piracy policy is the same, its just after the media hype died down they saw no reason to add the opt out

RealStickman_4• 6 years ago

piracy policy

Not sure if this was intentional, but it made me chuckle.

bryanmgreen• 6 years ago

That being said, if anyone has unused corded Apple EarPods and the 3.5 to lightning dongle, hit me up!

t0mmyb0y• 6 years ago

Why in the world would anyone need headphones that need personal info?

heavyset_go3• 6 years ago

Everyone, including headphone manufacturers, are trying to get in on the gold rush that is turning their customers into fonts of personal data that can be sold to the highest bidder.

zelly2• 6 years ago

I see this sentiment mentioned a lot, but who actually pays for this data? Is there a company I can call that will buy my amorphous "user data"? What are their names?

qppo• 6 years ago

I don't know if this counts and I haven't seen it outside of research projects, but 3D spatialization (that's worth a damn) basically requires it be tuned for the user's particular head geometry.

joshvm• 6 years ago

The top end Sony headphones actually ask for a photo of your ears to do exactly this. It's only for use with the fancy spatially aware apps - pretty much only Deezer does this at the moment?

I signed up for a free trial (and I did send a photo of my ears), but I couldn't tell the difference and the HD library was so small it didn't seem worth paying monthly for it.

formerly_proven4• 6 years ago

Looking at my collection of Beyerdynamic cans... they collect data?

njloof• 6 years ago

(2018)

api• 6 years ago

Everything spies on you. There's money in it.

I've come to believe that this can only be fixed with legislation and regulation. There are no technical fixes that could practically be deployed as there is far too much "attack surface" and anyway there is zero incentive to deploy them.

In the meantime: install as few apps as possible on phones, be careful about IoT and personal assistance devices, and use Apple or Linux (not Android) based systems as they seem to have the best record for security and privacy.

heavyset_go3• 6 years ago

iOS exploits are cheaper than Android exploits because they are so plentiful. Plenty of apps on iOS have been caught activating the camera or snooping on the clipboard on iPhones.

RealStickman_4• 6 years ago

If you use Android you have to install a custom rom though to guarantee your privacy.

qmmmur• 6 years ago

Mine don't because they're hard wired into whatever device I use.

starky• 6 years ago

Exactly, it will be a cold day in hell before I buy a pair of headphones that I have to charge on order to make them work or have any "smart" features.

Larrikin• 6 years ago

I broke down when I finally found good noise cancelling headphones that will continue working without battery. The annoying part now is that layering pass through audio of the outside world on top of what I'm listening to has become pretty nice.

kkapelon3• 6 years ago

I was like you, until I tried wireless headphones outside and was amazed.

For some activities like running having no cables to deal with is a great experience (that you should try at least once)

karmakaze• 6 years ago

Glad I've been using analog earbuds under non-connected noise-cancelling 'over-earphones'.

phatfish• 6 years ago

The only thing that annoys me about this setup is noise of the wire brushing against clothing etc. Or if you eat with them on.

With music playing the removal of external noise is enough for me. They do well enough blocking distracting noise used as simple ear plugs too. At least the ~£20 Sennheiser ones I use do.

im3w1l• 6 years ago

Are these associated apps mandatory for getting the headphones working or are they just value adds?

Godel_unicode4• 6 years ago

Just value adds, you can listen just fine without them. You might lose (in the case of the headphones that lead to the article) some fitness tracking features, ANC or EQ fine-tuning, or other additional functionality but they'll work just fine for audio.

httgp• 6 years ago

To add to this list, they also let us upgrade firmware.

acd• 6 years ago

I tend to use passive headphones with 3.5mm jack, they have no electronics in them except the small speakers. They do not collect data. They are also used by musicians when doing audio mixing so its should sounds neutral and good.

That the headphones does not have electronics and batteries means they will last longer and thus be be better for the environment.

jcims• 6 years ago

I can’t prove if everything you said is true or not but I like the way you lay it out there. :)

tdons• 6 years ago

I (and many other engineers I know) do this too, and for a good reason. It's a simple system.

Same reason I don't use WiFi at home but ethernet: it's simple.

xcambar• 6 years ago

It's a simple system

Even though I get your point and I am convinced you're using "simple" aptly, I will nitpick the obvious: passive headphones can be deceptively simple or a marvel of engineering.

If you didn't get the chance to listen to some music through proper audiophile headphones, I do recommend to spend some time at the closest audio retailer and live the experience.

secondcoming• 6 years ago

You have LAN ports in your bathroom?

JumpCrisscross2• 6 years ago

they will last longer and thus be be better for the environment

This isn’t necessarily true.

My wireless headphones have been with me for years. My wired earbuds are cheap enough that I can lose or damage them without care. The former are far better for the environment.

organsnyder• 6 years ago

Of course it's not a universal rule. But apples-to-apples, with a wired vs. wireless set of similar construction, cost, and intended use, the wired will outlast the wireless, solely due to the battery (not to mention the other complexities inherent to a wireless set).

atoav• 6 years ago

My Sennheiser HD25 have been with me for 10 years and I stepped on them, dropped them used them outside in the rain, in sub zero degrees and three times a week while jogging.

10 years of that is a heavy thing to survive. In fact I know hardly any object that would have survived this long.

gambiting• 6 years ago

The problem is that your wired headphones might break if you're not careful, but if you don't then they will work essentially forever. Your wireless headphones on the other hand will break at some point because the tiny lithium battery inside them will eventually stop holding charge. It's not a question of if but when.

perl4ever• 6 years ago

Seems to me that the baseline assumption should be if you spend more, net, on the wireless (or wired) headphones, the environmental impact is probably greater. A million reasons can be given why the cost isn't exactly proportional to the environmental impact, but any time someone starts by assuming it's unrelated, I think they are probably not making good decisions.

ck425• 6 years ago

Well duh. Obviously if you buy cheap headphones and constantly replace them that's bad for the environment. The grandparents point was that if you buy good wired headphones and use them for the same amount of time you'd use wireless ones it's far better for the environment.

Kye• 6 years ago

All my MDR-7506s needed after 3 years was new ear pads.

djkoolaide• 6 years ago

Going on 10 years with mine. There's a reason 7506s are loved by engineers around the world. Every part is user-serviceable.

pwdisswordfish23• 6 years ago

There is an even easier analysis. If you were designing your own headphones just for your own use, would you have them collect personal data? If your answer is no, then choosing headphones that do not collect data is a logical choice.

The author cites some idea of "trading" ongoing collection of personal data^1 for features but I can't see how that applies here, assuming the user has already paid for the product, e.g., he has already paid for the headphpones.

1. This does not appear to be a one-time, voluntary submission of data by the purchaser. For example, submitting one's name and a product serial number in order to register for a warranty.

MereInterest2• 6 years ago

I'd put it a bit differently. If I were designing headphones for my own use, would I have them collect personal data and then give that data to somebody else. I like collecting statistics about myself, because they are interesting. For example, tracking exactly when I go to sleep, start my commute (pre-corona, that is), go on errands. But that is data that is for my use, and not something that I would trust in somebody else's hands.

For headphones, I could see tracking the usage by day, and by time of day. I could see tracking the average volume, the dynamic range, the frequency ranges used. How often do I spend listening to music, to conference presentations, to movies? Those would be fun data to have, but not something that I'd want under the control of a different party for privacy reasons.

IncRnd• 6 years ago

Me, too! I use the $1 ones from Dollar Tree. They are easy to replace, come with microphones if desired, and work just as well on calls as expensive solutions. They don't always last as long, but purchasing 10 at a time fixes that.

These little earbuds are commodity items.

askvictor• 6 years ago

Also, for phone calls and conferencing, wired headsets have neglible latency, compared to bluetooth, which is likely at least 100ms. In itself, this isn't terrible, but add the other latencies in (e.g. wifi, inter-city network). Our brains do a great job of compensating, but I'm starting to think that this compensating comes at a cost (headaches, tiredness), especially if you're on conferences all day as many are in remote work.

square_usual2• 6 years ago

Bluetooth latency is awful if you play rhythm games. I just can't handle BT headphones even on casual mobile rhythm games.

renewiltord7• 6 years ago

If it results in lower prices, I'm fine with this. But they should be clear about what they're collecting.

bitwize4• 6 years ago

For now, Bose QuietComforts appear to pair just fine with Bluetooth without requiring the Bose Connect app, so that's how I've been using them. I'm afraid that non-smart headphones will soon go the way of non-smart TVs.

thoughtstheseus• 6 years ago

If anyone thinks this is concerning wait until LIDAR becomes a standard feature.

lysium• 6 years ago

"Bose Connect app was found to be tracking what users were listening to and sending that data back to the company to be sold".

I did not know that!

josteink6• 6 years ago

You buy the most expensive headsets in the premium-end of the consumer-segment, and yet you’re still not the customer.

Utterly disgusting.

myth20186• 6 years ago

Drugstores in Brazil are doing it and that concerns me A LOT.

Their modus operandi is to ask you your CPF (it's like an SSN, but not that secret and powerful) and, if you refuse to tell them, you are not eligible for some discounts which can reach 40% in some more expensive items.

Customers happily agree to give their CPFs, completely unaware they are of the potentially disastrous consequences, and we are not even offered something resembling a privacy policy.

Think of the uses of such data. Health insurers could use them to detect and even predict health issues. One could estimate menstrual cycles and even the size of your genitalia.

A Brazilian data protection law is about to become active within the next weeks, but honestly.. such data shouldn't even be collected at all.

I'm looking for support for a bill to forbid drugstores to collect CPFs and to offer any sort of discount to people who identify themselves, but I believe this should be more publicized before being discussed for voting by the Congress. The more active drugstores on the "data business" are part of huge chains and their lobby will definitely be massive. Society should be aware of that and counterbalance for such lobby.

someguyorother• 6 years ago

How do they know the CPF you give is really yours (or exists at all)? Do they also insist that you use a credit card?

rlayton2• 6 years ago

This is a good point. I often "misspell" private information if its not an official form. If someone had more motivation, they could do a "different-secure-number-per-provider" trick and work out who leaked the information.

myth20186• 6 years ago

There are commercial services which allows companies to query government's database to check a given CPF's situation.

But they usually don't confirm that the number you give actually belongs to you. I always give a bogus, yet valid number (123.456.789-09). It's usually mapped to a customer, so somebody has already had the same idea or it's the remainders of a test database. They frown sometimes (actual CPFs follow very distinct number patterns) but didn't complain so far.

They don't insist that you use a credit or debit card, which are much more common than cash over here. I couldn't confirm yet, but I suspect that they have access to some identification of yours whenever you use a card, so I usually pay in cash, which is pretty annoying because they never have change.

slim• 6 years ago

I think the partido pirata can help with this issue. contact them :

http://partidopirata.org

myth20186• 6 years ago

Thanks!

m463• 6 years ago

That's an interesting thought. The european GDPR and I think the california CCPA have some sort of clause that says if you decide not to allow, you have to be treated the same.

But loyalty discount cards and your drugstore example should have a way to get the discount without giving up your anonymity. This would be better for society.

myth20186• 6 years ago

Good to know about such clauses in GDPR and CCPA. I didn't take the time yet to read our own law in detail. I've read that it's gotten much inspiration from GDPR, but the articles I've read so far didn't mention such clauses, being more focused instead on aspects regarding data storing and sharing with third-parties.

I'm going to read it thoroughly within the next days.

myth20186• 6 years ago

I can't see other way than entirely forbid drugstores from having loyalty/rewards programs based on personal identification.

They would be allowed to ask for your information when buying through app/web, but could never give you discounts or incentives of any sort for buying through such platforms.

And that wouldn't mean they couldn't have a loyalty program: they could give customers stamps on paper cards, paper seals and alikes. It may sound archaic, but some big supermarket chains use this method regularly and it works pretty well.

catchmeifyoucan• 6 years ago

I use Bluetooth headphones, but almost never use or bother to set up the associated app. So hopefully Bluetooth pairing alone isn’t enough. Looks a lot of these details are collected through a companion app.

_trampeltier• 6 years ago

Yes me too. I really never install such apps, because they are always bad in many ways. I just wanna a bluethoot speaker or headphone. I really don't care for the mostly useless fancy software things. And most of the times, it's even possible to use these things also with a 3.5mm jack

IshKebab• 6 years ago

Sometimes these apps are necessary though. For instance you can only turn the Google Assistant button off on Sony headphones in their app, there's an additional (better!) noise reduction mode only available through the app, firmware updates are through the app, etc. (I get the firmware updates because I'm vaguely hoping that one day they will fix the hilariously annoying flaw that they turning them on always activates noise cancellation.)

Polylactic_acid3• 6 years ago

When I got my bose headphones they would not connect as bluetooth headphones until I installed the app. After that they would but I still had to sign up and accept location access the first time.

kayodelycaon• 6 years ago

I see a number of people saying this but I was able to pair mine without an app. Installing the app didn’t require location access.

There’s also several people saying their experience was like mine.

It’s pretty obvious different people are getting two distinctly different experiences with the company. It’s not a spectrum, just one or the other. That is strange and I wonder was the cause of that is.

ddingus• 6 years ago

Not mine with the simple wire.

The digital video transition has been a net good, though I will say analog output is easier, takes fewer resources, but those are plentiful. No worries.

Audio isn't the same. All existing gear remains relevant.

The data collection is something I hate viscerally.

Also why I do not stream music.

monksy4• 6 years ago

The article should have buried sony for how egregious they are. They require the app to collect location information, and ear. https://www.sony.com/electronics/support/articles/00233341 I'm not sure what else they collect.. but those are the 2 bad ones.

They've got a few settings that are software controlled (one being the bluetooth's internal volume) What happens if you get a software update and you open the app on a plane without wifi? You can't use it because it requires the internet to get the latest _required tos_ to use your headphones. You can't proceed further without being forced into an agreement. Clicking "don't accept" pushes you back to the tos screen.

mandelbrotwurst5• 6 years ago

Geez, that's brutal. I'm glad I'm seeing this....it never crossed my mind that this sort of thing would be something that might get built into headphones.

If I want to avoid this sort of thing, I'm thinking / hoping it's sufficient to simply avoid headphones that require an app.

Does that seem right?

monksy4• 6 years ago

I mean you can't really avoid it. It's pushed on to you and theres no clear understanding about how tied the headphones are until you buy it.

The WH-1000MX are very good headphones, but sony gonna shit the bed. (PSN anyone)

josteink6• 6 years ago

If I want to avoid this sort of thing, I'm thinking / hoping it's sufficient to simply avoid headphones that require an app.

Or just get one with a good old 3.5mm jack.

Beyer Dynamic, AKG and Shure have several options much cheaper than these Bose or Sony headsets which still give you at least 10x the audio-performance.

For headsets, if you care about usability, portability, longevity and performance, wired is still the no-brainer choice.

squarefoot• 6 years ago

"I'm thinking / hoping it's sufficient to simply avoid headphones that require an app."

Every effing time they convince users to install an app they magically have a tool to steal peoples personal data.

Not just headphones: the kids toy drone can be controlled using an app from the cellphone? The security camera just purchased doesn't use standard protocols over a web browser but needs its own app? The IoT system doesn't use standard protocols as well but forces the use of their app? Bad, bad and bad! And so on for every piece of hardware that needs a proprietary app that -betting all my horses on that- will ask for full permissions to access everything.

In this context, headphones are among the easily replaceable accessories with secure and better sounding ones. Just get wired ones and avoid architectures that force the use of wireless phones just to make a bigger business out of a misfeature.

Polylactic_acid3• 6 years ago

You have to do prior research. Bose don't tell you on the box that the headphones are bricked until you connect it to the app to do an update before it will allow you to connect it as a normal bluetooth device.

taneq4• 6 years ago

I'm thinking / hoping it's sufficient to simply avoid headphones that require an app.

I'd hope so - as far as I know there's no way for a Bluetooth headset device to get internet access via the thing it's paired with. It's getting harder and harder to be confident about this kind of thing, though.

niklasd• 6 years ago

I recently tried out wireless noise-cancelling headphones from both Bose and Sony, and (the important privacy issues aside) the user experience with these apps is just horrible.

You unpack your Bose headphone, eager to use them. But before that, you have to download an app on the iPhone, then download a software update program on your laptop, which in turn opens a program in the browser that downloads an update, then you connect the headphones with a wire to the laptop that the update gets installed, and THEN you can start using them.

I send both back and now I'm a happy AirPod user.

riquito• 6 years ago

I don't know about Bose, but you can connect the Sony headphones with the normal bluetooth pairing, there's no app required

hinkley• 6 years ago

So far Shure hasn’t done anything that dumb, but you have (or rather, had. They seem to have to be coming out with over the ear model) to be ok with tethered headphones.

I kind of like the tether. Harder to lose them under a bookcase. And less of a problem if they plop out during exercise.

NoPicklez3• 6 years ago

I own the Bose QC 35's and I never had to use an app at all until I decided to update them to the latest software

fomine32• 6 years ago

AirPods also requires to use app for many features but the app is integrated to iOS. IMO It's worse than dedicated app.

flyingpenguin3• 6 years ago

But holy crap, the process for updating AirPods without an iPhone is a real hassle.

Took my bank account months to download my an iPhone to update with.

cactus20933• 6 years ago

I didn’t find that an issue at all, and not sure what you mean about the laptop part I only use the mobile app to upgrade my qc 35s.

I do find the Bose UX to be horrible though for another reason, which is the incredibly stupid “feature” that the headphones can be connected to multiple devices at once. Since I use it both with my phone and laptop and they’re often in range of each other, sometimes the audio control will just switch back to the other device than the one I’m trying to use, I assume because of some background process that’s still open, and I lose my sound. If one device is on the edge of connectivity range, it’ll beep every couple of minutes as it connects and disconnects even though I’m not even using it. Then if I ever want to connect a third device like a tablet, it’s made to switch back and forth between exactly 2 devices not 3 so things get even more messed up.

It’s quite annoying, and I feel like I’m the only one bothered by these issues because I don’t see a lot of other people complaining. But I’ll definitely be switching to a different brand away from Bose when these headphones wear out. Probably the upcoming over ear Apple headphones, since I find airpods to not have any of these issues and generally work great at switching between two devices without being stolen back by the previous device.

charwalker2• 6 years ago

The Jabra 85h is great in this regard. Totally fine without the app, the app itself has a ton of features and useful items including changes to side tone and auto noise cancellation. The app pulled in a firmware update when I first connected and ran that in a few minutes without me touching anything. I would like to compare my set to the top Bose and Sony sets but at almost double the price of the 85h, I can't bring myself to spend the money.

drcongo• 6 years ago

I have the Sony WH-1000XM3 noise cancelling headphones, didn't have to install an app at all and the noise cancelation on them is absolutely incredible. Along with the amazing sound quality, they're the best headphones I've ever owned.

flyinghamster• 6 years ago

I am fervently glad that I'm happy with my WH-1000XM3 in its stock configuration. I took one look at what the permissions they wanted for the app, and said "No effing way."

I shouldn't have been too surprised, though, given that it was Sony that brought us rootkits on music CDs.

Teledhil• 6 years ago

I have the WH-1000XM2 and the location permission is optional if you want the app to change noise cancelling profiles according to what you are doing (walking, running, on the bus). The ear scanner is another optional thing you can do to improve the 360 audio which only works on a few apps.

MaxBarraclough• 6 years ago

Interesting, didn't know they used photos of the user's ears.

There has been research done on identifying people by their ears. [0]

You can't use it because it requires the internet to get the latest _required tos_ to use your headphones.

Can't you just uninstall the app entirely? They're standard Bluetooth headphones, right?

[0] https://www.southampton.ac.uk/news/2010/10/new-method-to-ide...

notatoad• 6 years ago

as far as i can tell, the only thing the app does is dynamically change the noise cancellation level based on your location and accelerometer, so if it doesn't have location permission it's kind of pointless to use the app.

the headphones still work fine without the app, they're just bluetooth headphones that the OS can interface with directly if you don't want the location-based profiles.

dragonsngoblins4• 6 years ago

I've been using my Sony W-1000XM3s with my Android phone for months and I haven't had to install an app. The only thing the app would get me is a bunch of equalizer shit (which my music player could do and I never use anyway), dynamic noise cancelling of some form (which I'm not sure why I'd ever use, just an on/off toggle is good enough for me).

As shitty as the app collecting data is it isn't as if the app is required for me to have had an excellent experience with these headphones so I'm not really all that bothered that the app is invasive.

If any real functionality was locked behind it I'd be annoyed, but honestly the app seems like an afterthought with no real purpose other than "EVERYTHING NEEDS AN APP" type thinking.

patcon3• 6 years ago

First off, I say the following as kindly-spoken words :)

I'm grateful that you and I both know to be critically-minded, and we understand the difference between essential features and data-grabs, but honestly... my Dad needed me standing over the sketchy wifi thermostat (that required an app and Facebook login), loudly complaining about how invasive it was, to even understand that this was not OK and worth returning the product. And he's spent years osmosing conversations with his tech-savvy, upper-middle class son. Further, many people take for granted that they can trust a brand like Sony, so they're not in critical-thinking mode about this stuff -- it's quite confusing to know what is reasonable when you're just trying to get the thing done that was literally just a male-female plug before.

I do believe you're a caring person (most ppl are), but the practical effect of your position would lead someone to judge that you don't actually care about the data of the vast majority of normal people across many demographics. I kinda suspect that isn't true, so I'm wondering if maybe you'd find some dissonance in your own views on closer inspection <3

rorykoehler3• 6 years ago

How did you tune the headphones eq without to app?

driverdan• 6 years ago

Are you using Wavelet to tune them? Stock they sound pretty bad, far too bass heavy.

waheoo2• 6 years ago

This exact thing has happened to me. Blew my fucking mind.

But I'm also a long time suck fony guy so, I basically accepted it as karma for buying this witch doctor voodoo noise cancelling anyway.

trissylegs• 6 years ago

This was raised when Australia rolled out its' Contract tracing app. On Android if you need bluetooth access you have to ask for locat ion access, because it's possible to derive location from bluetooth data. (Like wifi data).

andrewmackrodt2• 6 years ago

I've owned the Sony WH-1000XM2 for several years and while the Android app location collection is unnecessary, ear data is entirely optional.

You have a valid point that the app can misbehave regarding updates and lack of internet connection. I personally find myself never using the app, it only really provides 3 somewhat useful features; equalisation (which forces the audio codec to SBC which is inferior to LDAC so I've never used it); automatic profile switching, e.g. ambient sound if detecting you are walking and finally, the level of noise cancellation to apply.

This model has a dedicated switch on the headphones to change the profile where a long press even "calibrates" the sound based on atmospheric pressure, not sure I buy into that gimmick, but they're perfectly useable without the app. I have them paired with Android, Windows, macOS and Linux and all work perfectly (with the minor exception being Linux does not support Bluetooth absolute volume). The headphones also support volume control from the unit for devices which have an older Bluetooth stack which does not support absolute volume.

Overall, I agree the app needs improvement but I'm not sure there's anything that warrants burying the company of these decisions. I suspect for many users, the app is entirely useless and not worth installing.

strogonoff• 6 years ago

I immediately deleted Sony’s app after disabling EQ and probably some other gimmicks on my XM3s—has worked alright with Apple devices.

(Well, as ‘alright’ as could be expected. Switching between devices requires slow re-pairing through long power button press, but I don’t think Sony’s app would’ve resolved that.)

panpanna• 6 years ago

Clicking "don't accept" pushes you back to the tos screen.

This is a textbook example of a GDPR violation. In fact, it is a clear violation of the first of the five requirements for consent.

See recital 43:

"... Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance."

neiman3• 6 years ago

If I had the resources, I would establish an organization for privacy badges for products. From "absolutely anonymous", through "necessary violations of privacy for function" till "unnecessary harvesting of data".

Till such an organization for handing out badges will exist, it will be a hard task to buy any hardware and being able to trust its privacy.

jakub_g• 6 years ago

~ https://tosdr.org/

neiman3• 6 years ago

Thanks, looks great.

teddyh2• 6 years ago

Respects Your Freedom Certification:

https://ryf.fsf.org/

tgsovlerkhgsel2• 6 years ago

With GDPR in place, "unnecessary harvesting of data" should in theory be a thing in the past (unless the user explicitly makes a voluntary choice to opt-in after being informed of the options).

Reality is different, but NGOs can in theory sue to make reality align better with the intent of GDPR. NOYB (https://noyb.eu) is supposed to be such an NGO, and they seem to be doing a decent job so far, although they're limited in what they can do with their resources, facing a never-ending wall of vendors that blatantly violate GDPR.

neiman3• 6 years ago

Afaik GDPR allows harvesting of data as long as I agree to that in the user agreement. The problem is of course that more than once I found out the user agreements after purchasing the product, when it was too late.

(I live in the EU, so GDPR is relevant to me)

fffernan• 6 years ago

I'm wondering if someone could file HIPAA complaint at them and get these things classified as Medical Devices and shut this sharing of bio data down. A simple opt-out doesn't fly with HIPAA. It requires a signature that you will allow another person to access your medical records.

coronadisaster2• 6 years ago

This reminds me that I still need to root my phone so that I can remove Google's crapware...

RealStickman_4• 6 years ago

It'd probably be easier to just go and flash lineageos and microG (if you need that) than trying to remove google stuff.

coronadisaster2• 6 years ago

That's probably what i should do... Hopefully my phone is fully supported.

maps72• 6 years ago

As someone with both Bose QC IIs and the Sony WH-1000MX, this is annoying but not much I can do about it - they're expensive and I doubt I could resell them for as much (would reselling even be ethical now?). I also really like noise cancelling, especially now I am working from home.

jakereps• 6 years ago

I mean you can just not use the apps, can’t you? The headphones don’t magically ship data home through the device. The app is what you agree to their privacy policy through and is what reads all the metadata through usage and then sends it home. I deleted all of my headphone apps the first time I saw the note about sending all audio titles to Bose in the privacy policies.

maps72• 6 years ago

Oh that's fine then. I don't use the apps at all - I think they were required on set up though.

duxup2• 6 years ago

TIL, Headphones have apps.

Apps are quickly becoming this weird add on that I really don't want.

luckycharms810• 6 years ago

Apps are the new drivers.

duxup2• 6 years ago

Man I vaguely recall when you could use an .ini file as a driver in windows back in the day...

maest• 6 years ago

The move to no-jack phones really only exacerbates this problem.

It's difficult for manufacturers to justify an app for wired headphones, but, now that bluetooth is becoming the new norm, there's suddenly a justification for instrusive, data-collecting apps.

This whole story is a really good reason for keeping headphone jacks on phones.

dkersten5• 6 years ago

I would rather give up on a smartphone than give up on my wireless headphones. Hell, I was without a phone for a few months a couple of years back and it felt liberating. It’ll be my excuse to be a permanent smartphone luddite.

flukus2• 6 years ago

I did the same, went without a phone for a few weeks (getting repaired/replaced) and it taught me a lot about how much I was overusing it. The most important change was turning off nearly all notifications (interruptions), but I've slid back into other bad habits like mobile reddit/HN since.

I've toyed with the idea of going back to a dedicated MP3 player for music and audio books, they should be cheaper and smaller than the last time I had one and with actual buttons they have a superior user interface (phones are versatile but a bit shit at everything). After that I could probably ditch a smart phone entirely.

_fat_santa• 6 years ago

Technology moves on. The same shift also happened with cars. I remember when there was pushback (ok at least hearing about the pushback) when cars started to use computers. Why does it have to so complicated? Why does everything need a computer?

You know to a certain extent those folks were right. But you look at cars today and I couldn't imagine my car not having a computer. Adaptive cruise control, lane keep assist, apple carplay, I could go on.

The problem I see now is that privacy is still a pretty novel concept among the regular user so companies in the mean time can get away with overbearing data collection. My prediction is in the next 3-5 years, users will start to get savvier, and overbearing data collection will become a taboo and no company will do it because users will revolt.

deeblering4• 6 years ago

Not mine! They are wired, and will always be.

colecut• 6 years ago

I have both Beats Wireless noise cancelling headphones (provided by work) and Bose wireless noise cancelling..

I have never even thought about downloading the apps for either of them. I never even thought to consider if they have apps. I just bluetooth to my phone and listen to music.

Am I really missing out?

qwerty456127• 6 years ago

We just should to stop tolerating conventional things using Internet connection. There is no way headphones really need an Internet-connected app to work and even to let you use advanced functions (i.e. all the configuration can be implemented in a purely offline app). And if they don't need they should not even nudge, let alone require, you to install such. Most of the people just don't give a uck, somebody competent on the state level should give it.

IgniteTheSun• 6 years ago

"We just should to stop tolerating conventional things using Internet connection."

Given IoT and 5G how can you stop this?

titzer• 6 years ago

In Soviet Russia, headphones listen to you!

dilandau• 6 years ago

Yeah, because some asshole business team decided that why should anyone sell a decent product anymore, when you can squeeze your customers for their personal information, and have a recurring/ongoing revenue stream?

It's like these shit-tier blogs and webdevs, who are tracking every single thing you do on their sites. Are they just incapable of creating? all this tracking...it's anti-creative in the extreme. Mechanical, soulless, lowest common denominator. It's medium.com and web 3.0. Where's the exit bros?

vladTheInhaler• 6 years ago

I see a lot of people talking about Bose and Sony and their awful apps, but there are alternatives! I have been using my Sennheiser PXC 550's for almost a year now with no software updates or other nonsense. If it has an app, I certainly don't know about it. About the only complaint I have is how easy it is to accidentally hang up on someone with the touch controls on the ear. Normally I support more organized solutions, but this seems like a clear case of voting with your wallet.

kkapelon3• 6 years ago

It has an app.

And unfortunately the app is the only way to set noise reduction to any level other than 0%, 50%, 100% (that is available with the hardware button).

If for example you want noise reduction to 75% you need to use the app.

Same for changing the sound profiles from the defaults.

shadowprofile772• 6 years ago

Truly, is it possible for tech companies today to release even one fucking product, even something so simple as headphones, without piling on all the desperate, grubby, scummy tracking bloat and related shit possible in an effort to turn you into a product EVEN when you're paying for their creations. It's revolting and sincerely deserves to be harshly punished by the market (if enough consumers could be bothered to give enough of a shit about something so "irrelevant" as their basic privacy).

briandear• 6 years ago

You mean like Beats or Apple AirPods? They don’t collect user data at all.

shadowprofile772• 6 years ago

My exasperated comment isn't meant to deny that products like these don't exist, it's more of a recrimination of those companies (and they are far too many, with it becoming steadily more habitual among them all the time) which simply can't keep themselves from squeezing and grubbing and pawing at our personal information for the sake of every last drop of monetization taken to disgusting levels of disrespect even for paying customers. All of it justified by cliche boilerplate nonsense about "caring for your' privacy" while they cram as much of the opposite down your throat as possible.

I don't care that maybe, just maybe, company X doesn't sell my personal information as a user of theirs to third parties (though I steadily doubt more and more about the claims of any company promising that it doesn't, and then there are also unintentional data leaks of things they supposedly don't keep stored) I also want goddam company X itself to not pry into my life so much just because I use a fucking pair of headphones or a blender, or a refrigerator or any number of other products that are being designed more often by the day to track everything you do with them and feed it all back to their creators. The sheer arrogance of the whole trend deserves much more criticism than it gets.

zeveb• 6 years ago

You mean like Beats or Apple AirPods? They don’t collect user data at all.

They may not, but Beats and Apple — the former is a subsidiary of the latter — lock one into a proprietary ecosystem in which your data is not your data (just try sharing iCloud photos with Android users), you have no right to run, view, modify or share the software you depend on, your message security rests 100% on the corporate goodwill of Apple and any government which can force Apple to do its will (your iMessages are end-to-end encrypted … to whatever keys Apple says belong to your correspondents; Apple can add new keys at will). And of course Apple are also doing their best to replace the standard headphone jack with crufty, battery-draining, CPU-requiring Bluetooth.

Headphones capable of running Bluetooth are headphones capable of collecting data about you, because they need some sort of processor to speak the Bluetooth protocol. Headphones which are composed of wire and drivers aren't capable of anything other than playing or receiving audio.

mindfulhack2• 6 years ago

You're not even as high-status as 'product' (let alone 'customer') - you're the 'fuel' - for an ad product, bought by ad customers. You're the coal being burned - all for profit and power.

Yes, my analogy doesn't go too far. We're sentient coal, being fed bread and circuses as the trade-off for being burned away. We still have some choice, power, and control.

j88439h84• 6 years ago

Nice analogy

chooseaname3• 6 years ago

Nope. They have to generate recurrent income in some form or another, otherwise they won't get the green light.

loktarogar• 6 years ago

I just went on 2 12+ hour flights and every few minutes my phone had a "These aren't your airpods" or similar message. I had no airpods, they were someone elses on the flights, but they still interacted with my phone often.

rkagerer• 6 years ago

When you buy food there's a label on the package that tells you what's in it.

When you buy cigarettes there's a big warning label about the risk to your health.

I think consumer devices need something like that. Imagine browsing an aisle and seeing a label on the package like "WARNING: These earbuds phone home with the track names you play, your GPS location and menstruation cycle history." How many people do you think will buy that box vs. the cheap $20 pair with the analog plug?

trickstra• 6 years ago

But... they do. When you install the app, people routinely agree with "This app wants access to your contact list, storage, internet, and to run at startup". But I get your point, it should be on the box, before you buy the hardware. Currently they can easily argue that you can install the software from appstore, check the required permissions, before even buying the hardware. But that's not enough.

lm28469• 6 years ago

"This app wants access to your contact list, storage, internet, and to run at startup"

If you don't agree most of the time the app quits and you can't use the product you bought.

Can_Not• 6 years ago

The vast majority of bluetooth headphones don't even mention their Bluetooth version!

datashaman• 6 years ago

It would be neat if we could sandbox specific mobile apps.

c3534l• 6 years ago

Can we all just take a step back and appreciate what a techno-dystopia we're living in that this is now a headline no one bats an eye about?

mindfulhack2• 6 years ago

I first really appreciated your thought - indeed, the fact that "Headphones are collecting personal data" alone feels like something unacceptable and shocking compared to just 10 years ago.

But then I had a counter thought: You know how in the early 20th century people said the dawn of recorded music would make 'music dead'? And many other examples of new tech being hailed as dystopian / would cause the end of the world? Sometimes the fear response to newness and unfamiliarity can be a little unhelpful. I think it's our lizard brains responding there.

So I guess what I'm saying is: The fact that a new situation is so different to an old one you were used to, isn't a cogent argument against the new situation.

Some new tech is genuinely awesome, and old things are genuinely terrible, e.g. old forms of industrialisation were terribly pollutive compared to forms used today.

I'm a person who greatly values my privacy, and doesn't follow the crowd - but perhaps one needs to compare on merits alone, not on the fact that things have changed.

rchaud• 6 years ago

I certainly batted an eye. I bought my first pair of bluetooth headphones in 2012 and I am only now finding out that some require you to install an app to use. Absurd.

square_usual2• 6 years ago

OT, but that is the worst dickbar I've ever seen.

kerneltime• 6 years ago

My LG washer dryer app needs to know my location... why? They won’t let me add it without giving app location access.. so does the YI camera now.. this is getting a bit out of hand.

DanielleMolloy• 6 years ago

To those only looking for the noise cancelling component of modern headphones: I was only interested in this as I already have a good pair of (wired, offline) hi-fi headphones, and given some HN comments on this I decided for Peltor x5a passive noise cancelling earmuffs. No batteries to charge and become disfunctional with time, no spy-apps, no potential hearing damage from ANC (not sure what the status is here), no cables, no bluetooth issues; and you get Peltors for 15-30$ so no problem if they break because you stored them in the bottom of a bag. My growing collection of low tech might look a bit dorky but I love it.

everdrive• 6 years ago

When I was younger, I was wondering what it would feel like to to feel 'left behind' by technology. I remember helping so many adults to navigate a world they didn't understand. They'd ask "left click or right click?" every time I asked them to use their mouse. They just couldn't grasp some of the context.

This is not quite the same thing, but I'm starting to feel that perhaps I am starting to witness that same disconnect. Having read the title alone, I wondered "how are the headphones collecting data?" Oh, there's an app. Why would you need an app for headphones? It simply never occurred to me.

darthrupert• 6 years ago

Yeah, I'm getting more and more convinced about my purchase strategy for electronics:

1. Get as simple and durable as possible

2. If it has to be complex, get something made by Apple

3. There's no rule three

sukilot• 6 years ago

It's hard to muster up the energy to worry about the privacy policies of luxury toys for rich people.

AlexandrB• 6 years ago

As with other instances of privacy overreach, this will trickle down to cheaper tech products in an even more invasive way - e.g. cheap "smart" TVs that collect everything they can.

If even the rich people can't "muster up the energy" to defend themselves from data collection, I think we're all well and truly fucked.

chooseaname3• 6 years ago

Give me a dumb pair of headphones with a 3.5mm jack and I'm happy.

Edit: Thinking about this article more, it really goes back to hardware not getting funding unless there's a model for recurrent income. It's going to get a LOT worse before we either wise up or give up.

Headphones are collecting too much personal data (2019)

Related Stories