Amazon Sidewalk starts sharing your WiFi tomorrow, thanks

Amazon smart device owners only have until June 8 to opt out of a new program that will group their Echo speakers and Ring doorbells into a shared wireless network with their neighbors, a new feature that the shopping giant claims will provide better stability for smart devices during initial setup and through possible Internet connectivity problems.

The program is the latest example of yet another multibillion-dollar company rolling out significant changes without meaningfully notifying users beforehand, making it increasingly difficult for users to choose how their data is used, or how their products function. In March, Google changed how Google Chrome users would be tracked across the web, and in May, WhatsApp threatened to remove basic messaging functions from the apps of users who refused to share some of their data with parent company, Facebook.

With all these company decisions, user choice has diminished.

This week, Amazon announced that many of its smart devices would be incorporated into what it is calling “Amazon Sidewalk,” a shared network of devices within neighborhoods that will, according to the company, “help simplify new device setup, extend the low-bandwidth working range of devices to help find pets or valuables with Tile trackers, and help devices stay online even if they are outside the range of their home WiFi.”

Amazon Sidewalk will create a mesh network between smart devices that are located near one another in a neighborhood. Through the network, if, for instance, a home WiFi network shuts down, the Amazon smart devices connected to that home network will still be able to function, as they will be borrowing internet connectivity from neighboring products. Data transfer between homes will be capped, and the data communicated through Amazon Sidewalk will be encrypted.

Amazon smart device owners will automatically be enrolled into Amazon Sidewalk, but they can opt out before a June 8 deadline. That deadline has irked many cybersecurity and digital rights experts, as Amazon Sidewalk itself was not unveiled until June 1—just one week before a mass rollout.

Jon Callas, director of technology projects at Electronic Frontier Foundation, told the news outlet ThreatPost that he did not even know about Amazon’s white paper on the privacy and security protocols of Sidewalk until a reporter emailed him about it.

“They dropped this on us,” Callas said in speaking to ThreatPost. “They gave us seven days to opt out.”

Other experts have warned about the security and privacy implications of Amazon’s project, as Sidewalk will rely on an untested WiFi protocol to link together selected devices. Whitney Merrill, a privacy and information security attorney with Asana, said on Twitter: “Hello privacy nightmare.” 

Further, as reported by Ars Technica, the history of wireless connection technologies is littered with vulnerabilities. Researchers found flaws in the late-90s security algorithm Wired Equivalent Privacy (WEP)—after it had been widely used for years—and the technology that replaced it—WPA—is not without problems.

To its credit, Amazon’s white paper addresses how it plans to keep customers’ data secure and private when it travels through Sidewalk. According to that white paper, Amazon will limit the type and amount of metadata it receives, it will encrypt the contents of delivered packets so that the company cannot see what is inside, and customers themselves will also be prevented from seeing the content of packets sent to and from endpoints that they do not own.

Security and privacy aside, one issue still remains—weakened user choice.

The implementation of Amazon Sidewalk mirrors the more careless behavior showcased by Google earlier this year, when it decided to include millions of Google Chrome users in an experiment into how their web browsing behavior was tracked online. Google, like Amazon, did not individually notify users about the new program—called FLoC—and Google, like Amazon, automatically enrolled users into the program, forcing them to manually opt out.

Amazon’s approach to opt-out is clearer than Google’s, though. The company has developed a specific menu item in its Alexa and Ring apps that clearly denotes a new setting to enable or disable Sidewalk. Google, on the other hand, did not have a specific toggle to disable FLoC, and users were instead forced to turn off all third-party cookies if they wanted to opt out.

Certain aspects of Amazon’s rollout of Sidewalk also resemble decisions made this year by WhatsApp, the end-to-end encrypted messaging app owned by Facebook. Last month, the messaging app told users that if they did not agree to sharing some of their data with Facebook, they would see their apps become useless, unable to receive calls or messages. WhatsApp walked back this decision in late May.

Here, Amazon is implementing no such consequences for opting out—which is good—but it is still making a sweeping decision about how customers’ own products should function. And the company isn’t just changing the way already-purchased Amazon devices work, it’s also reaching beyond those devices to affect relationships that have nothing to do with Amazon, such as who gets to use your internet connection, how much of it they can use, and what you might be charged for that.

Amazon Sidewalk will work with the following devices in the US, according to Amazon: Ring Floodlight Cam (2019), Ring Spotlight Cam Wired (2019), Ring Spotlight Cam Mount (2019), Echo (3rd gen and newer), Echo Dot (3rd gen and newer), Echo Dot for Kids (3rd gen and newer), Echo Dot with Clock (3rd gen and newer), Echo Plus (all generations), Echo Show (2nd gen), Echo Show 5, 8, 10 (all generations), Echo Spot, Echo Studio, Echo Input, Echo Flex.

For users who want to opt out, they can find the solution in their Alexa and Ring apps. In the Alexa app, users can go to “Settings,” and then navigate to “Account Settings,” where they can find “Amazon Sidewalk.” Users can also disable Sidewalk in the “Control Center” of the Ring app or Ring website.

The post Amazon Sidewalk starts sharing your WiFi tomorrow, thanks appeared first on Malwarebytes Labs.