On: Wiretapping Google smart speakers

[sneak]

Note also that if the devices are deauthed from their wi-fi and cannot reassociate, they will turn into APs themselves with the name "<device name>.m" without a password.

I reported this to Google and they said it's not a bug but is working as intended. I asked them "What if the device name is 'Project Dragonfly v2 Conference Room'?" They said it's still not a bug.

This of course leaks the device name to the public (via wi-fi beacon packets) along with allowing anyone in range to access the APIs on the device.

[thaumasiotes → sneak]

> I asked them "What if the device name is 'Project Dragonfly v2 Conference Room'?"

> This of course leaks the device name to the public

Leaking the sound from that room is potentially serious, but I thought the whole point of project codenames was that it's fine when the codename inevitably leaks to the public.

[sneak → thaumasiotes]

Project Dragonfly was claimed, by Google, to be cancelled. If there exists a "Project Dragonfly v2", with a conference room, that's headline news.

[jacquesm → thaumasiotes]

In some cases even the codewords themselves are classified.

[thaumasiotes → jacquesm]

Easy solution: use a non-sensitive codename to refer to the classified codename. :D

[jacquesm → thaumasiotes]

Hehe. Codenames all the way down :)