Smart Speakers Always Listen: Privacy Controls for Yandex Alice, Marusya, Salyut, Siri and Google Assistant
Smart speakers and phones keep their microphones powered even when no one is speaking to them. The only purpose of this constant listening is to catch a short wake phrase such as Yandex Alice, Marusya, Salyut, Hey Siri or OK Google. Until that phrase is detected, audio normally stays on the device and is not transmitted to the cloud.
Yandex states that Alice processes sound locally for the activation phrase only. After the wake word is heard, the request is sent to Yandex servers. The same local-detection model is used by VK Marusya and Sber Salyut. Apple applies an on-device detector for “Hey Siri,” while Google Assistant and Gemini rely on account settings and device microphone permissions.
Hardware mute options
Most dedicated speakers provide a physical button that disables microphones at the hardware level. On Yandex Station models the crossed-microphone button turns the LEDs red. VK Capsule and VK Capsule Mini show a red ring when muted. SberBoom Mini requires a two-second press of the AI-assistant button to achieve the same red state. Phones lack an equivalent global hardware switch, so users must rely on software toggles.
Recommended privacy settings
- Disable “Listen for Hey Siri” and “Allow Siri When Locked” in iOS Settings.
- Turn off “Web & App Activity” and “Gemini Apps Activity” at myactivity.google.com.
- Revoke microphone access for unused apps in Android and iOS permission menus.
- Switch off the “Help Alice improve” toggle inside Yandex ID.
- Delete stored voice histories through each provider’s data-management portal.
Even with these steps, the microphone itself remains the only reliable way to guarantee silence. Security-conscious users are advised to mute devices during meetings, medical calls or any discussion involving financial or personal data.
Related articles
Engineer Details Six Weeks Spent Training and Testing Signature Redaction Models for Closed-Loop Document Anonymization
A detailed case study describes attempts to automatically redact handwritten signatures from scanned and text-based PDFs containing personal data such as names, phones, addresses and signatures. The work was performed inside an air-gapped environment on a single GPU machine with no internet access. Multiple approaches including color-based ink gates, pre-trained YOLO detectors, custom-trained YOLO11s models, Tesseract OCR heuristics and various vision-language OCR engines were evaluated on 492 real pages plus synthetic augmentations. Key findings include rotation handling bugs, line-assembly failures in Tesseract, the necessity of using apply_redactions instead of draw_rect for true removal, and the limited value of vision models once rule-based pipelines are mature. The final pipeline reduced expensive vision-model calls from 50 pages to 18 pages while achieving zero leaks across thousands of redactions. The author also measured twelve OCR engines and demonstrated that combining PaddleOCR detection with Tesseract recognition yields the best accuracy-to-speed trade-off.
pg_anon Open-Source Tool Receives Major Updates for PostgreSQL Data Masking and Partial Database Operations
Tantor Labs has released version 1.11.0 of pg_anon, an open-source utility designed to mask personal data in PostgreSQL databases while preserving structure and relationships. The update introduces packaging as a standard Python package, support for partial dumps and restores using whitelist and blacklist dictionaries, and improved handling of complex schema elements such as partitioned tables, generated columns, and custom types. Performance improvements include switching the dump engine to asyncio, single-query metadata collection, and on-the-fly gzip compression to reduce memory usage on large databases. New CLI options allow clean or drop operations on target databases, privilege ignoring, and passthrough of pg_dump and pg_restore flags. A REST API was added to enable integration into CI/CD pipelines and automated self-service systems for nightly masked database refreshes. The tool helps organizations comply with data protection requirements by creating pseudonymized copies suitable for development, testing, and contractor environments.
Pegasus Spyware Returns in Serbian Surveillance Campaign via Zero-Click iMessage Exploit
A Serbian student activist's iPhone was infected with the Pegasus spyware through a zero-click exploit in iMessage, allowing silent installation without any user interaction. The infection, confirmed by Citizen Lab in collaboration with the SHARE Foundation, showed indicators of compromise between December 2025 and January 2026. Apple later sent the target a notification warning of a mercenary spyware attack attempt. The exploit granted full access to photos, messages, files, and enabled covert microphone and camera activation. The vulnerability was addressed in the iOS 18.4.1 update released on April 16, 2025. The incident forms part of a wider surveillance wave in Serbia, with at least 14 individuals including students, activists, a parliament member, and a local political representative receiving similar Apple alerts. Additional targets were hit with Android spyware variants linked to NoviSpy.
Mozilla Adds Built-in Ad Blocker to Firefox for iOS Devices
Mozilla has integrated a native ad-blocking feature directly into its Firefox browser for iOS. The update allows iPhone and iPad users to block third-party advertisements and associated trackers before web pages load, eliminating the need for separate extensions. Apple’s App Store policies have long restricted the use of third-party content blockers on iOS compared to desktop and Android platforms. The new functionality targets intrusive elements such as pop-up windows, content-overlapping banners, and other advertising formats. By handling blocking at the browser level, Firefox for iOS improves user privacy and reduces exposure to tracking mechanisms without requiring additional software installation.