How Much Dirty Laundry Are Your Smart Home Devices Airing About You

The talk asks how much personal data connected devices send back to their manufacturers. The speaker, a security consultant with a privacy interest, first planned to study a smart washing machine and a robot vacuum, but after the vacuum failed he switched to two smartwatches: a Samsung Galaxy Watch 4 and a Garmin Forerunner 245. He opened with context on how sensitive wearable health data is and past cases where location data from fitness devices exposed people.

The method moved from simple checks to deeper ones. He read the privacy policies, compared the permissions each Android app requested, and looked up third-party trackers with an online database. He then decompiled the app packages and searched them for partner and third-party references. Finally, he routed app traffic through a web proxy on a rooted phone with a trusted certificate, and logged DNS lookups through a filtering service. Garmin traffic was largely readable and mapped to upload, weight and gear services. Samsung traffic was mostly encrypted, and his decryption attempts did not succeed. He also noted that a Samsung voice assistant consent could extend to other devices on the account.

The takeaways were practical. Blocking third-party domains through DNS can reduce tracking, but blocking vendor domains leaves the watch close to useless. Garmin devices can work without the companion app, while the Samsung model needed its phone app. Some devices can be moved to an open-source replacement backend. His advice was to weigh features against data collection, turn off tracking that is not needed, and read privacy policies closely.