Amazon disputes claims that Echo Show’s Drop-In feature is a security risk

Drop-In is a strange and mostly ill-advised feature. It’s a way of offering instant communication between Echo devices — essentially a phone call that doesn’t require the receiver to pick up in order to initiate. Hence, “dropping in.”

Amazon introduced it with the new Show and is rolling it out to older Echo devices as a way of facilitating the new intercom feature it introduced this week. We raised a few questions when the feature was first announced alongside free Echo calling back in May, but with the Show arriving this week, the some privacy and security concerns are being raised anew.

The feature is a bit of an odd choice from Amazon, given all of the questions that have been raised around the Echo line’s always-on microphones — though the company did get out in front of things this time around by spelling out the fact that Drop-In is an opt-in feature. Both parties involved have to enable Drop-In in the device’s settings in order to work.

Amazon reiterated that point in a statement provided to TechCrunch, adding, “Customers will know when they are engaged in a Drop-In call as they will first hear a ‘chime,’ and the green light ring on their Echo device will rotate throughout the call. On Echo Show devices, the caller will experience a 10-second ‘frosted glass’ screen when dropping in on an approved contact or room, so the call recipient can decline the Drop In in that timeframe before they are shown on the screen.”

Beyond intercom functionality, the feature is primarily targeted at users looking to check-in on older relatives or who’d like the system double as a baby monitor. The inclusion of visual and audio clues are certainly helpful — so users can’t be entirely stealth. But even with the “frosted glass” that partially obscures the screen for the first 10 seconds, it’s easy to imagine a scenario where the user on the other end is out of the room when a Drop-In is initiated or otherwise doesn’t notice that first chime.

In-home intercom functionality is a useful and much-requested feature for the Echo, but introducing an Echo with a built-in camera was inevitably only going to raise privacy and security concerns around the device. So the optics around launching this feature at the same time were bound to be less than ideal.

https://techcrunch.com/wp-content/uploads/2017/06/dsc00742.jpg?w=1024&h=576

There’s also the issue of potential malicious access by hackers. Like most big companies, Amazon isn’t eager to share information around how something like Drop-In works on the server side. Companies will often keep some mystery around that secret sauce, for fear of revealing too much to wannabe hackers — which may go a ways toward explaining why it took so long for the company to issue an official response to earlier questions about what the Echo records and uploads to its servers.

It’s a balancing act. Staying silent on specific security concerns doesn’t look great from the outside. Depending on how the feature is implemented on the backend, it could potentially open the product to additional vulnerabilities, though the company reassures me that Drop-In operates like regular calling from a security standpoint. 

“We take security very seriously at Amazon, and Alexa calling and messaging is no different,” the company tells TechCrunch. “The new Drop-In feature leverages the same security measures used in other Alexa features available on Echo devices. We limit the information we disclose about specific security measures we take, but I can tell you that — just like other calling and messaging services- –Alexa calling and messaging is encrypted in transit to protect our customers. Further, we have full teams dedicated to ensuring the safety and security of our Alexa customers who regularly conduct security reviews of our products and features.”

The company is also quick to point to the Mute button on the devices. In the case of the Show, it’s one of three large buttons on the top of the unit. Hitting it will both deactivate the microphone and camera, while turning the status bar red. While testing the feature over the past week, I had to train myself to hit the button every time I got dressed or did anything else I’d rather not have floating around on Amazon’s servers.

I’d suggest using the mute button liberally. In fact, I found myself unplugging the Show from time to time — which admittedly is counterproductive to the idea of a hands-off assistant. And in most cases, I’d recommend against using the Drop-In feature altogether. Every time you introduce another new technology into your home, it’s important to weigh the cost/benefit ratio. In my own life, I can’t think a single instance in which I wouldn’t at least want the option of not picking up a call.