Conncting a TV to the Internet?

[Nick]

Personally I only use a smart TV for Netflix, YouTube etc not for browsing the web, banking apps etc. I'd also not buy a set with a microphone and if it was inevitable I'd disconnect it.
A TV is for watching Corrie, news etc, if you want to go online use a laptop etc, just my opinion.

Indeed, I wouldn't recommend doing anything critical via a smart TV or set top box - use a fully secured browser and environment for that. One of the main reasons is that embedded browsers generally are not updated very often, so security fixes can take a long time to appear (if they do at all) and you really don't know what's going on in the box. Set top box/smart TV manufacturers are pretty bad at maintaining security upgrades to their devices as they have long since moved onto new devices, new sales, new income and supporting & maintaining old kit is very low on the list of priorities...

One other thing I've done is to have a separate VLAN for stuff that just needs to go to the net and has no need for local access, e.g. the TV box - you can then just bridge the needed protocols (if any) as needed to the main house LAN (VLAN0). Not always possible in a domestic setup, but if you have an environment that can support that, then do it.

BTW, I would never have an Amazon Echo or Google Home etc. in the house.

You might want to read How to turn off smart TV snooping features

[Murphyv310]

Totally agree Nick
I've a Roku box in the living room and a cheap Cello Android TV upstairs, it's not a good set to be fair and hardly used. In fact the Pi4B is far superior for streaming than the Cello. The Roku box though is well loaded with many channels etc and runs fine from my Samsung's USB power source.

[Mike Watterson]

Not sure what Google had to do with this unless you're using a Chromecast or Google home etc.

Most smart TVs (ie TVs with apps and networking) use Android TV. The info is all collected by up to 3 organisations:
Google
Set maker (or badge sticker)
Samba (unrelated to the Linux clone of Windows Filesharing).
Many TVs not using Android TV do it anyway as the badge sticker is paid.

It's not about banking, or Web. It's wholesale collection of all your usage of the set, including titles of discs played if the player is connected via HDMI!

Also opt outs can be ignored. Google caught doing it.

Under GDPR it should always be OPT IN and never prechecked.

Unless you are expert with firewalls and routers you don't know what any gadget is doing. Windows, Mac, Linux laptops and iOS are better defined. Mileage varies on Android phones. All actual Google products are spyware be default with varying ability to block. Chromecast, Chrome OS and Chrome Browser are bad. There has been scrutiny of Android, but using the supplied browser, Google's keyboard with voice search and many applications are bad.

[Murphyv310]

So we dump modern tech then?
We could of course revert to cheque books, do no online banking and shopping and shop in Woolworths, BHS, etc.......... Oh I forgot they went bust didn't they.
It has to be a case of being sensible, not stuck on a PC or phone all day and using alternatives to gadgets, support local shops more often. Avoid Chinese outlets that sell fake products. Go on ask me about the Huawei Mate 30 PRO I bought. Answers only by PM though.

[Radio Fixer]

Yes! it difficult. You could say if you have nothing to hide then what' the worry? The data might be being used just for improving the viewing experience, like what series are popular and which aren't.

Does the data collection only occur if you are internet connected? Or can it happen if you use cable modems; from Virgin in my case?

thanks Gary

[Murphyv310]

Data is shared no matter what platform you use.
A friend of mine who is very senior in programming has told me nothing is 100% secure no matter what you do or what people and companies tell you. Just look at the things that have been breached over the last few years then realise you will never have the security that NASA has or the Pentagon.

[ppppenguin]

The Pentagon is leaky. Look at Edward Snowden. Even airgapped systems can be breached by a man with a memory stick. Remember Stuxnet?

If your device is connected to anythng outside your home then you can assume it leaks. Nick has the experience and knowledge to monitor his outgoing traffic carefully and isolate parts of his network that have to be exposed. That's rather beyond mst of us. Mike Watterson is also on the cautious side of things.

On the whole we strike a bargain with the devil. We get free services online, they get information about us. I reduce this by using Firefox with Adblock+ and Ghostery but that's hardly watertight.

At least in the UK we don't have the really heavy handed surveillance they do in China, Russia etc. But give the security services a chance and they'll listen. It's no coinicdence that they have an outpost near Bude, Cornwall, where many of our undersea cables come ashore.

[Nick]

A fair chunk of my career, which is still ongoing, is in CTO roles in the finance industry where security is a key concern.

This includes PII (personally identifiable information), which is leaked everywhere and all the time and was one of the key drivers behind the GDPR regulations. Just having a mobile phone leaks all sorts of metadata.

e.g. WhatsApp may be encrypted end to end (and it is, unlike zoom who made that claim but were not) but the app leaks metadata like crazy to Facebook, who own them: number contacted, friends, message size, attachment types, location, phone type and os version, signal quality, numbers contacted (and by association, the numbers of your called or calling partner), the groups you are in etc etc.
Which is why, of course, many use Signal for anything sensitive.

Most of the social media and many other apps are just as bad. Websites are often not great either...

There is a tonne of stuff that is of little or no interest to the public at large, but it's a fascinating and complex field. Network security is a miniscule part - security has to be looked at holistically. The biggest risks are the humans involved in any system - they are relatively easy to compromise.

One of the issues is that folk agree to the privacy policies of the app providers without reading them - WhatsApp do say what they collect, but only a tiny fraction of folk read that before agreeing or declining.

There's risk everywhere - as with everyday life, what you need to do is:

1. Identify the risks
   
2. Mitigate all that you reasonably can
   
3. Accept or reject what's left
   

If you can't accept the remaining risk (and there will always be SOME risk), don't use the service and just move on...

Edit: note that whilst you can do a lot to protect yourself, you cannot defend against a state-sponsored actor, e.g. GCHQ, NSA, Unit 8200, or indeed any of the APT groups.
If they want your data, they'll get it.

[Mike Watterson]

Does the data collection only occur if you are internet connected?  Or can it happen if you use cable modems; from Virgin in my case?

Cable supplies actual TV. A Cable setbox used for actual TV doesn't connect to the Internet. Some TVs can tune unencrypted cable and in some countries the Cable TV viewing card will work in a CAM in the TV CAM slot (very like the old laptop PCMCIA slots).
A Cable modem connects ethernet and if it has a router built in, also WiFi to the internet. It uses the same cable but different channels. A Smart TV will only share to the Internet via cable provider IF it using the ethernet cable or WiFi set up to your Broadband via your cable modem.
There are cable boxes that combine a Cable TV setbox and a cable Modem. They don't share what the TV is doing unless the TV's ethernet or WiFi is connected. The cable TV digital set boxes may incorporate streaming services via the cable broadband as well as conventional channels. Unlike a Satellite box with no Internet connection (sadly Sky box do now), the Digital Cable TV set box does report to the cable company what is selected on the cable box. US cable companies sell it.

Five Eyes surveillance is now helped by Palantir and tech companies. It's much more invasive than at the start of Echelon.
There was nothing remarkable about Snowden's revelations other than detail. It's been known for decades.
https://en.wikipedia.org/wiki/ECHELON

We don't have to give up technology, but IoT, smart Homes, Smart TV are an extra unnecessary invasion. A TV fed by HDMI by a laptop is actually "better" than the "native" and more invasive apps. Also some don't get updated. YouTube doesn't work now on lots of earlier so called Smart TVs.

[Murphyv310]

Ah well I think I'll listen to a couple of 78's then watch the test card and music later ........ Bliss