Who's listening? Growing privacy concerns around transcription services (2020)

80 43 5 years ago

fwn• 5 years ago

The main message here seems pretty straightforward and is only lightly related to transcription:

If you gather confidential information do not hand them over to some third party for transcription, storage, sync, cloud office solutions, etc.

I feel that this is quite a basic truth and packaging it in such a long essay makes me think that most people on HN might not be the articles target group.

It was still fun to read though.

ganafagol• 5 years ago

Combine this with the article about brain-to-machine connections earlier today and you are deep in a privacy-nightmare dystopia.

jabo2• 5 years ago

Privacy concern is the main reason we still have a local-only mode in our transcription app [1]. It’s a web-app, but we play the audio/video file directly from the user’s computer, and we use local storage to store typed text in users’ browsers. This way no transcription data leaves users’ computers. We also use service workers to allow this mode to work offline, for good measure.

We’ve been working on it for over a decade and we did add machine transcription recently, but I still find a surprising number of users use and ask about the local-only “Self Transcription” mode.

One interesting side-effect of a local-only mode is that we can’t sync transcript data between computers. And this sometimes surprises people. Once we explain that this is actually a feature not a bug, since we don’t store the data on our servers to be able to do the sync, it actually seems to reassure people even more.

[1] https://transcribe.wreally.com

lupire3• 5 years ago

A post on HN yesterday said Local Storage is not secure from XSS attacks.

jabo2• 5 years ago

Thanks for sharing. Just read through it and like one of the comments mentioned, if malicious JS is able to run on any site, that’s a larger issue and would affect not just local storage right?

gruez• 5 years ago

And that's fine right? If it was a desktop app instead, you could say that it's not secure against sandbox escapes and stack smashing attacks. It's still a step-up in security compared to cloud transcription services, and for most use cases perfectly adequate.

Jon_Lowtek4• 5 years ago

This "privacy concerned" app has a myriad of analytics and tracking scripts which can read the transcript in local storage or log key presses (but are hopefully not be configured that way). Typical privacy friendly defaults like google analytics anonymize_ip are not set. There are no checks for the integrity of these third party scripts (a hack against them can lead to a breach of the app) and it does not ask for consent before connecting the user to these third party servers. There is also an error logging service (datadog) and i have seen other apps push all state info, including local storage and auth tokens, when any error happens. The promise of the recording and transcript not leaving the users computer in local-only mode may be true, if its implemented correctly.

The privacy policy looks halfway decent, a bit chaotic with no ToC and free-floating "legal basis" & "retention policy" that are independent from the concrete processing tasks, leaving them as abstract "we know the law" blocks of little value. The policy is very dominated by all the user behavior tracking and ad-tech integrations, while the processing of recordings/transcriptions is rather short. In a way that is good, but it is almost too short, given that it is the primary function: "transcripts" and "recordings" are not even a category of data in their policy, and they are not mentioned with any sub-processor, not even by the ones running the servers (a rather curious formal error, as one would assume a focus on their core business). There is a complete lack of "we keep small samples to improve the ML/AI" which i find inteersting, but which might be true.

There is a small note in the legal texts that the user must have the consent of the recorded people before uploading recordings to the server for automatic transcriptions, but there does not seem to be one in proximity to the upload function. (or at least they are missing from the screenshots in the guides, i did not register for a trial)

dsnr2• 5 years ago

Pro tip: Jump to paragraph 11 to skip the life story of the random person and get to the point.

StavrosK3• 5 years ago

What's with the fad where articles start by describing how a random person overpacked? It's such a cliche by now, yet I see it everywhere.

loceng3• 5 years ago

We're story tellers with lives, perhaps it allows a person to feel like they're more than a cog in a wheel existing just to please some impatient internet stranger?

lupire3• 5 years ago

Can a cliche be a fad?

merpnderp• 5 years ago

Have to pad those word counts when you're paid for length. If you don't have eyeballs on your website for X amount of time per visit, how are advertisers to know they got their money's worth?

jasode• 5 years ago

What's with the fad where articles start by describing how a random person overpacked?

Fyi, it's not a fad. It's what's called a "human interest" angle and some publications (like this rrj.ca website of this thread) have that editorial allowance for personal storytelling. (I made a previous comment about this: https://news.ycombinator.com/item?id=24270673)

More examples of that include "The New Yorker", "Harper's" and other literary style magazines.

The opposite examples of "just the facts" type of publishers would be "lwn.net" for Linux tech articles or The Economist magazine for business stories. You won't find articles beginning with personal things like, "When I was a little boy, my father took me to discover ice...blah blah blah...."

The problem is that HN is an aggregation site that gets the [human interest] articles when some readers don't want it and we have no convention for tagging them to avoid annoying that subset of the audience.

Jon_Lowtek4• 5 years ago

how a random person overpacked

This particular investigative journalist is over-preparing for interacting with sources. That is a literary device to color his avoidance of the services named in the headline.

zoomablemind• 5 years ago

Why going that deep, if one can just 'get to the point' from the title alone?

I would not comment, if it were somewhat disrespectful to the source and context of the article. It's a journalism oriented blog, and in this case, its target audience is practicing or student journalists. So the story is painted to relate to that audience's concerns.

Also giving such a 'Pro tip' is equal to teaching HN readers how to use scrolling...

Jon_Lowtek4• 5 years ago

Starting with paragraphs of side-story primed my bullshit detector as well and it kept flagging this article: not only is there too much text that has little to do with the headline, the paragraphs that focus on the subject hide wild claims behind citations. "U.S. officials were reported to have said" is an honest attribution, but not a quality source. However, the author has to deal with the problem that rumors are all we have. There are no new facts in this article, it's a write up of what is known, garnished with tales of journalists at work, intended for those who are new to the topic. (Edit: skipping the first ten looses the explanation of "air-gapped device" and what "transcription" even is.)

The relevant key elements for the topic are all there: undisclosed third parties, outsourcing to cheap labor, spy agency backdoors, governments wanting blanked access, subpoenas against sources and journalists, bad tech, bad laws, data breaches, hacks and overly broad clauses in the service contracts. But it is too shallow, not intended for those who already knew that and hoped for details and depth.

For a moment the article even hit my advertisement detection due to the way the "list of transcription services" at the end is formatted, how brand names are sprinkled in, how the author tries to avoid making it too one sided (which is a good thing!) and how the investigative journalists approach is related to overpacking and old fashioned motels. I suspected a bait and switch: bait with a cautionary tale, switch into a sales pitch. But the author says he does not endorse any of the named services and the short reviews focus on problems with their policies.

Overall i find it ok, even if it is a bit too heavy on the narrative of this journalist protects his sources, be like him for my taste.

EDIT: i ran the literal quotes through google and i think these are interviews backing the article as primary sources. This is no bullshit, it's good and honest work.

MaxikCZ• 5 years ago

When the article starts like this one...: > When Michael Lista went to stay 10 days at a lonely, one-storey motel in Emerson, Manitoba

...I immidiatelly close the site and make a mental note of the "dont open links from this site again".

Sometimes I wonder if I am the only one. I came to read info, not authors attempt at a short novel.

cproctor• 5 years ago

Can anyone provide an update on the state of open-source transcription packages, with language models? I'd love to have the equivalent of spaCy, gensim, Stanford NLP, or NLTK, but for transcription. That is, packages that will just work at quality comparable to cloud transcription APIs if you generally know what you're doing but maybe don't keep up with the latest literature.

electriccello• 5 years ago

Vosk does a solid job, and there are a couple other alternatives. Trouble is, the bottleneck for quality here is dataset size/quality/availability, so closed-source models with private data have the leg up.

jfd98njkdgnh• 5 years ago

And in some places, those are hard to avoid. My school in previous semester had a class that required online meetings that were recorded and transcriped with no way to opt out without affecting your grade. And explaining my beefs to professors is getting harder and harder ( ie. for an outside viewer it looks like I am not being reasonable ).

ghaff2• 5 years ago

For air-gapped recordings the technique that one person mentions (locally record and make brief notes/timing of important parts of the conversation--there are devices that will do this semi-automatically) is probably the best approach.

I'd also note that ML transcriptions are useful in the context of this article, i.e. to get rough cheap transcripts. But, if you value your time above minimum wage, human transcription is a lot better if you actually want to publish a transcript of an interview.

julianna01k• 5 years ago

At https://audext.com/ your privacy and security are very important to us. All uploaded files are stored securely, are used exclusively for transcription and can be deleted manually or after a time limit.

Who's listening? Growing privacy concerns around transcription services (2020)

Related Stories