Your Xfinity Wi-Fi can see you now

Comcast wants to be your free security company. But not just any—a high tech one that detects motion through the disruption of radio waves.

Called “Wi-Fi Motion,” this feature is part of the corporation’s Xfinity Wi-Fi Shield service, which combines tools for combating cybersecurity and residential threats with parental controls. Wi-Fi Motion specifically monitors Wi-Fi interference to determine the presence and movement of people in a home. Comcast specifically tracks how the signal gets redirected, blocked, or absorbed through its Xfinity devices, including gateways and Wi-Fi extenders.

In abstract, the concept is sci-fi come to life. In reality, I don’t like the privacy implications—and you shouldn’t either.

Whether video or invisible radio signals, such surveillance can expose your personal life to others, often unwittingly. Recall the Ring camera debacle, where employees and contractors alike first had unrestricted access to customer footage, then still kept spying on others. Ring also failed to provide adequate security for the cameras, allowing hackers to harass women and children through them.

Comcast says in a support page that it “does not monitor the motion and/or notifications generated” by Wi-Fi Motion. It also says that this feature is opt-in. So what’s the harm? The problem is if you use the feature, you won’t know who can see your information—or which hands that data will pass through.

First are the partners that Comcast works with. If any of them ever fall victim to a hack, the intimate details of your habits and living situation could spill into the open. Next is the level of trustworthiness of those partners, and who might be tempted to spy on customers.

Comcast

And possibly most importantly, Comcast doesn’t promise complete privacy. When obligated by law, it will share the data. In an era of identifying people through novel methods (e.g., adding tech like SignalTrace that adds phone tracking to license plate cameras like Flock), it’s not a stretch to imagine that a feature like Wi-Fi Motion could get eventually used as Wi-Fi body tracking.

In the right hands, monitoring would alert people to actual problems, and nothing more. I definitely like imagining a world where Wi-Fi Motion tips me off to a potential intruder, or even warn of a loved one’s bad fall.

But in this chaotic era, privacy is actually a valuable commodity. AI can mine for patterns—exploitable patterns—and the more information you lose or give away about yourself, the easier it is to fall for scams. (They’re becoming harder and harder to detect, as all the loose data on the dark web helps with increasingly better targeting and wording.) Or even become victim to blackmail, if you have hobbies or activities you don’t want others to know. (Even if that’s as benign as taking a slightly long lunch—with a strict enough boss, it’s an issue.)

Plus, Comcast doesn’t have a spotless record for clear, defensible advertising—much less impenetrable cybersecurity practices. Even when marketing Wi-Fi Motion, the Wi-Fi Shield is touted as “home protection” in the announcement…but in its support page, Comcast clarifies that “WiFi Motion is not a home security service and is not professionally monitored.” Accurate? Yes. But will most people interpret the marketing that way? Probably not.

In the news

Improvements to Windows 11 are always welcome—and Microsoft is planning to add more to tighten up its operating system. (Even if the change feels overdue.) On the flip side though, the AI side of things is still as a chaotic as ever, with chatbots easy to trick. (Humans too, actually.)

Microsoft

The good:

• Microsoft is reportedly planning better controls for webcam and mic permissions in Windows 11—the ability to grant access per app. It’s a long overdue change, given that mobile operating systems have used this approach for years.

• More Windows 10 users should see updated Secure Boot certificates as part of a recent security patch. Make sure you have automatic Windows updates turned on.

The interesting:

• A well-known hacker discovered a way to gain full hardware control over older AMD CPUs—with just a single instruction. This clever trick requires access to the PC and 15h or 16h family processors (think 2011-2015ish era). It’s a great reminder that once hardware or software leaves active support, they fall much easier to attack.

The surprising:

• My colleague Ben Patterson had a shock when a ChatGPT plug-in for Apple Messages showed it had more access than expected. What happened? Ben forgot he’d granted broader permissions during earlier testing. Never forget that in this AI era, agents can take extreme measures by accident, especially if your settings are misconfigured.

The bad:

• Microsoft Copilot is the latest AI chatbot to be manipulated into giving up important secrets. Researchers discovered that simply asking questions could get Copilot for Enterprise to reveal a workaround to the guardrails protecting user data. AI isn’t human, but the vibe here is reminiscent of what happens after telling young kids a secret.

• Hackers haven’t given up on good old-fashioned sexploitation, according to the FBI. They’re sneaking into email and social media accounts, then blackmailing the owners. Be careful about what links you click in messages, and don’t share one-time passcodes with anyone.

Tip of the week

Experian

Identity theft is still an issue, even with all the noise about ransomware, scams, and other cybersecurity problems dominating the news. If you live in the US, you can take back some control by freezing your credit and banking reports. (It’s free!) When frozen, no fraudulent accounts can be opened in your name.

To place a freeze, you must put in a request with each of the major credit bureaus, as well as the primary verifier for banks. (Our guide explains how.) Once you’ve placed a freeze, you can temporarily lift it any time you need to apply for credit or a new bank account.