Skip to main content

Amazon Sidewalk is revolutionary, but its scope worries privacy experts

While Amazon has approached Sidewalk, an endeavor in connecting smart devices to a neighborhood mesh Wi-Fi, in a "sophisticated way" with privacy in mind, experts are still wary of how effective this project will be from a security standpoint.

Amazon announced last week that customers have until June 8 to opt-out of its latest project to keep smart devices connected at all times by using a mesh Wi-Fi system. If you don't want to participate here's how to opt-out on Echo devices and Ring devices.

The program, which was initially announced in September 2019, uses a low-bandwidth shared network that will use part of your home Wi-Fi to connect to Amazon Echo devices, Ring security camera and lights, and Tile Bluetooth trackers. The mesh Wi-Fi is helpful when your device loses connection, at which point it will automatically connect to the neighborhood Wi-Fi over the 900Mhz channel.

According to the company's privacy and security whitepaper, the project was "carefully designed" with privacy protections in mind, specifically on how it collects, stores, and uses metadata.

For example, each user device at registration to the program will have a "unique session key" with the Sidewalk Network Server (SNS) and Application server. Once the device has been identified and is part of the system, the SNS won't be able to identify a user, and makes it "difficult for anyone, including Amazon, to piece together activity history over time."

Information is wrapped in layers of protection, but nothing is 'zero-risk'

Amazon also notes that information for devices to work on the network will travel in, what it calls, a "packet" that will have three layers of encryption protection. The encryption is done to "ensure data is visible only to the intended party."

"This approach to encryption means that Amazon will not be able to interpret the content of commands or messages sent through Sidewalk by third party services or endpoints (applications," Amazon writes.

John Verdi, vice-president of the Future of Privacy Forum, an industry-backed nonprofit based in Washington, D.C., said in an interview what makes this program strong from a privacy front is that only Amazon devices can participate as well as trusted partners. He added that users can't just add a trusted device to the program like an iPhone or a user's personal laptop.

"What that means is that Amazon can limit the physical hardware devices that connect to Amazon manufacturer devices and trusted partners. Not just any device can connect. There's the validation of the device itself," he said.

Verdi also added that the program wouldn't use a lot of data that is typically used for streaming video. Sidewalk would only use up to 500MB of bandwidth a month, a relatively small amount — though not insignificant for people on a fixed-bandwidth connection.

"The Sidewalk mesh network [likely] doesn't use bandwidth that will materially impact the owner's online experience," he said.

Verdi added that there is no "obvious or straightforward way" in which a third party could manipulate the system.

"Now, nothing is zero-risk. There's always a chance that a novel exploit or a novel method performed by a malicious actor could come to light. We don't know. But when you look at the safeguards that are in place, they are serious technical safeguards. They are not trivial," he said.

"There's a risk with any product, but having said that, does the risk look well mitigated? Yes."

Whitepaper is full of complicated jargon

Sumit Bhatia, director of communications and knowledge mobilization with the Cybersecure Catalyst at Toronto's Ryerson University, said in an interview that Amazon's whitepaper details security and privacy in a detailed manner, but uses sophisticated language that makes it difficult for a regular person to understand how the system works.

Bhatia said that while this is a step towards building a smart neighborhood or city, there needs to be a proper framework with systems that have been tested before implementing a large-scale project like Amazon is trying to do.

"The fact that they (Amazon) are not launching this in a closed group but launching it in an entire country of people, speaks to the approach that they want to take," he said. "They are using this mass approach across the U.S. as, in my opinion, an opportunity to gather data, and a lot of people who are (part of the opt-in) are guinea pigs for that data, but at the cost of there being potential threats and ramifications that we don't know."

And while Amazon has laid out clear privacy guidelines, Bhatia suggests that this is another way for Amazon to create a user profile this time by creating a connected-service program.

"Amazon is being very strategic about how they're doing this because they're doing this without being somewhat of an internet service provider, but still being able to claim ownership of a network where they can aggregate data of a larger pool of people," he said. "That to me is problematic."

Without beta testing the program, how does Amazon know it's effective?

Rebecca Herold, CEO of the Privacy Professor Consultancy and a privacy expert, agreed with Bhatia in an interview, adding that the white paper includes "copious amounts of text and jargon."

She notes that despite Amazon explicitly detailing its encryption method, which is "very protective," there are still issues.

"We've already seen how you can actually use the mesh network to basically decrypt rather easily using simple tools like configuring IP tables that will tell devices to forward traffic from all Echo devices or all other types of IoT devices to a certain proxy. And by sending it to a certain proxy it can replace the Amazon Server Certificates.

"The way it works is basically those IoT devices are going to accept the certificate of whoever answers them first. I just want to sit around in my network in my neighborhood here and figure out a way to incorporate my devices into the network and I could probably fool a lot of those devices into trusting me," she said.

Herold applauded that Amazon is also trying to help you find your pet, lost keys, or in some cases patients suffering from dementia or Alzheimer's in a more efficient way. But it also concerning if you have a stalker, she said.

Like Bhatia, Herold said she was worried there wasn't a proven beta for the program.

"How did they beta test this thing? How did they even make sure that the testing was thorough and that it'll work? When you're dealing with new Wi-Fi protocols, which basically they created, you need to test them very thoroughly. It does not seem so, especially in some of the online groups that I've been tracking where people have opted out," she said.

The program is a win for consumers: Higginbotham

Despite, Bhatia's and Herold's reservations, Stacey Higginbotham, a technology journalist who focuses on IoT devices, explains in her latest newsletter that overall Amazon's program is a win for consumers.

"I firmly believe that this network will be an overall benefit for consumers and developers, who can add new features or build new, cheaper devices that take advantage of it," she wrote. "The privacy and security features are legit. Again: Amazon doesn't see your data and it doesn't see the developers' data. Neither does anyone else. In other words, I think you should opt-in."

She does add that if you're a "control freak," or someone who is well-versed in the security protocols but is still wary, they might opt out.

"Most came to the conclusion that they simply don't want their home network to be used as a bridge for unknown packets. What if those packets were illegal? What if the ISP didn't permit that type of use? I can't argue with control freaks, but I can point out that Apple's AirTag and FindMy network run on a similar principle of using your home or cellular data to share Bluetooth location data across an ad-hoc mesh network," she wrote.


Source: androidcentral

Popular posts from this blog

The hidden cost of food delivery

Noah Lichtenstein Contributor Share on Twitter Noah Lichtenstein is the founder and managing partner of Crossover , a diversified private technology fund backed by institutional investors, technology execs and professional athletes and entertainers. More posts by this contributor What Studying Students Teaches Us About Great Apps I’ll admit it: When it comes to food, I’m lazy. There are dozens of great dining options within a few blocks of my home, yet I still end up ordering food through delivery apps four or five times per week. With the growing coronavirus pandemic closing restaurants and consumers self-isolating, it is likely we will see a spike in food delivery much like the 20% jump China reported during the peak of its crisis. With the food delivery sector rocketing toward a projected $365 billion by the end of the decade, I’m clearly not the only one turning to delivery apps even before the pandemic hit. Thanks to technology (and VC funding) we can get a ri

Cyber Monday Canada: Last-minute deals for everyone on your list

Best Cyber Monday Canada deals: Smart Home Audio Phones, Tablets & Accessories Wearables Laptops & PC Components Amazon products Gaming Televisions Cameras Lifestyle & Kitchen Toys & Kids Cyber Monday Canada is here, and retailers are rolling out the red carpet for customers who want to shop for everything from tech to kitchenware to games and everything in between. Unlike years past, Cyber Monday Canada deals look a bit different than normal. Instead of retailers trying to pack their stores with as many shoppers as possible, we're seeing tons of online deals that you can take advantage of from the comfort of your home. We've rounded up our favorites below, so feel free to browse through the best of what Canada Cyber Monday has to offer! This list is being updated with new Cyber Monday deals all the time, so check back often. Spotlight deals It's a Switch Nintendo Switch Fortnite Edition bundle $399.95 at Amazon It's a Switch.

Slack’s new integration deal with AWS could also be about tweaking Microsoft

Slack and Amazon announced a big integration late yesterday afternoon. As part of the deal, Slack will use Amazon Chime for its call feature, while reiterating its commitment to use AWS as its preferred cloud provider to run its infrastructure. At the same time, AWS has agreed to use Slack for internal communications. Make no mistake, this is a big deal as the SaaS communications tool increases its ties with AWS, but this agreement could also be about slighting Microsoft and its rival Teams product by making a deal with a cloud rival. In the past Slack CEO Stewart Butterfield has had choice words for Microsoft saying the Redmond technology giant sees his company as an “existential threat.” Whether that’s true or not — Teams is but one piece of a huge technology company — it’s impossible not to look at the deal in this context. Aligning more deeply with AWS sends a message to Microsoft, whose Azure infrastructure services compete with AWS. Butterfield didn’t say that of course

iPhone 13 Pro vs. iPhone 15 Pro Buyer's Guide: 50+ Differences Compared

The iPhone 15 Pro brings over 50 new features and improvements to Apple's high-end smartphones compared to the iPhone 13 Pro, which was released two years prior. This buyer's guide breaks down every major difference you should be aware of between the two generations and helps you to decide whether it's worth upgrading. The ‌iPhone 13‌ Pro debuted in 2021, introducing a brighter display with ProMotion technology for refresh rates up to 120Hz, the A15 Bionic chip, a telephoto camera with 3x optical zoom, Macro photography and photographic styles, Cinematic mode for recording videos with shallow depth of field, ProRes video recording, a 1TB storage option, and five hours of additional battery life. The ‌iPhone 13‌ Pro was discontinued upon the announcement of the iPhone 14 Pro in 2022, but it is still possible to get hold of it second-hand. Our guide helps to answer the question of how to decide which of these two iPhone models is best for you and serves as a way to c