Last week, Amazon opened its Sidewalk protocol<\/a> to third-party developers. Sidewalk is a large mesh network that draws on people\u2019s home internet connections across the US. It\u2019s a service that requires a lot of trust, and so far, most of the devices on it happen to be Amazon\u2019s own products. But that\u2019s about to change \u2014 and as a result, Sidewalk\u2019s privacy safeguards are about to be tested at a much larger scale.<\/p>\n<\/div>\n No connected device is ever truly 100 percent private or secure. But so far, despite some initial concerns, Sidewalk has avoided any major privacy disasters. Here\u2019s a rundown of how Sidewalk works, the risks it might pose to you as a user, and what we know about Amazon\u2019s plans to defuse them.<\/p>\n<\/div>\n Sidewalk feels like it should<\/em> be a privacy nightmare. It uses your Amazon Echo or Ring camera as a bridge to siphon a small portion of your internet bandwidth, which is then pooled together to create a mesh network. The more Sidewalk bridges in your neighborhood, the better it works. <\/p>\n<\/div>\n Why would you want this? It\u2019s a way to ensure your smart devices work even if there\u2019s no stable Wi-Fi connection. Say you stick a Ring floodlight on your garage door, way out of your router\u2019s range. That device could instead tap into Sidewalk to stay connected. Sidewalk is also similar to Apple\u2019s Find My network when it comes to Bluetooth item or location trackers. Before adding Sidewalk compatibility, Tile trackers were mostly limited to your phone\u2019s Bluetooth range. That\u2019s fine if you lose your keys at home but isn\u2019t quite as helpful if you lose them on the street. Now, certain Tile trackers can tap into the Sidewalk network to notify owners of their last known location \u2014 even if you\u2019re miles away.<\/p>\n<\/div>\n Your devices connecting to and sending data across a network made from bandwidth borrowed from strangers? Sounds fishy. However, experts say they aren\u2019t too worried about Amazon\u2019s Sidewalk privacy and security protocols, which include three layers of encryption to secure data. (You can read more about them in this white paper<\/a>.)<\/p>\n<\/div>\n \u201cEverybody who\u2019s looked at the [Sidewalk privacy] protocol has said it\u2019s a good<\/a> protocol<\/a>,\u201d says Jon Callas, director of public interest technology at the Electronic Frontier Foundation. \u201cThere are no major flaws.\u201d<\/p>\n<\/div>\n Amazon Sidewalk was quietly announced<\/a> in 2019, but a privacy brouhaha began in earnest before it launched in June 2021. It centered around the fact that Sidewalk was an opt-out service. If you had an Echo or Ring that could act as a bridge when Sidewalk launched, it was enabled by default via an over-the-air update. Amazon said it sent users an email detailing how to opt out, but who among us has read every e-commerce email in their inbox? It didn\u2019t help that the setting was \u2014 and still is \u2014 hard to find in the Alexa app. The better option for privacy and security would have been to make the service opt in. Instead, the backlash was fierce, and Sidewalk made a less than stellar first impression. <\/p>\n<\/div>\n Since then, Amazon has stated that you\u2019ll be asked if you want to enable Sidewalk the first time you set up a compatible device. It still isn\u2019t completely opt in, however. In its white paper<\/a>, Amazon also says that if you don\u2019t complete setup, Sidewalk will be enabled by default unless you\u2019ve previously opted out.<\/p>\n<\/div>\n There were also concerns that Sidewalk was effectively stealing internet bandwidth. The fear was that users would end up with higher than expected internet bills and slower speeds, potentially without having given consent. While Sidewalk does \u201cborrow\u201d bandwidth, it caps usage to 500MB per month<\/a>. That shouldn\u2019t be an issue if you have wired broadband and, at that amount, is unlikely to slow down your service.<\/p>\n<\/div>\n Until now, the majority of Sidewalk-enabled devices have been Amazon Echo and Ring products, with a handful of other partners<\/a> like Tile. Adding third parties will increase the number of Sidewalk-compatible products and hubs, but it inevitably means uncovering bugs and other vulnerabilities that Amazon and experts haven\u2019t thought of. Sidewalk\u2019s privacy and security protocols look good on paper, but they haven\u2019t been tested under these conditions.<\/p>\n<\/div>\n \u201cIt has not met with reality yet. When all of these things meet with reality, there are problems that surface,\u201d says Callas, referring to Sidewalk. \u201cI am sure that there is going to be at least one embarrassing bug in the system because everybody has at least one embarrassing bug.\u201d<\/p>\n<\/div>\n We\u2019re still waiting on key information about Sidewalk, too. Apple, Google, and other tech giants all make developers meet certain criteria to use their APIs, and there aren\u2019t many details about Sidewalk\u2019s certification process or how it plans to ensure developers comply with Sidewalk\u2019s privacy policies. Likewise, Amazon hasn\u2019t detailed its plans to handle bad actors. We don\u2019t know yet how quickly Amazon will respond to reported threats or how quickly it will patch bugs and vulnerabilities. And the fact is, we won\u2019t know until it happens. <\/p>\n<\/div>\n \u201cI am sure that there is going to be at least one embarrassing bug in the system because everybody has at least one embarrassing bug.\u201d<\/p>\n<\/div>\n<\/div>\n \u201cDevelopers who want to participate in Amazon Sidewalk will go through the Works with Amazon Sidewalk qualification program (WWAS),\u201d Amazon spokesperson Jill Tornifoglio tells The Verge.<\/em> The WWAS<\/a> program, which is currently live, will purportedly test third-party designs for compliance with Sidewalk protocol requirements such as timing, packet structure, and size requirements. \u201cWe also verify that devices connect with the Sidewalk network following the registration process,\u201d Tornifoglio says.<\/p>\n<\/div>\n Tornifoglio also clarified that Sidewalk has multiple layers of encryption, and those standards will also apply to third-party applications. Third parties will also be able to issue unique identities to link devices to their apps to prevent unauthorized access. <\/p>\n<\/div>\n \u201cWe believe technology can and should be used for good, but recognize bad actors can misuse many different kinds of technology. Abuse of any kind is unacceptable and subject to termination under our terms of service,\u201d Tornifoglio says, adding that Amazon has the capability to remove bad actors and malicious devices from the network.<\/p>\n<\/div>\n At this point, it boils down to how comfortable you are with uncertainty. So far, there are no major reasons to be wary \u2014 aside from your personal feelings about Amazon\u2019s trustworthiness. That\u2019s fair since Amazon botched how it handled<\/a> Alexa voice recordings<\/a>. The company also doesn\u2019t have the best record with regard to Ring cameras and surveillance<\/a>. However, it should also be noted that Amazon\u2019s AWS cloud services are considered<\/a> to have<\/a> excellent security measures<\/a>.<\/p>\n<\/div>\n If you\u2019re concerned about Sidewalk, opting out is the only way to ensure it won\u2019t impact your privacy whatsoever. (Here\u2019s how.<\/a>) But if you\u2019re already an avid Amazon Echo or Ring user and you like the idea of Sidewalk as a whole, you should feel free to participate until you\u2019re given a reason not to.<\/p>\n<\/div>\n \u201cI wouldn\u2019t sweat the details,\u201d says Callas. \u201cAll of these voice things like Echo, I don\u2019t use them, but I don\u2019t feel like people who do are somehow endangering themselves.\u201d<\/p>\n<\/div>\n<\/div>\nAre Amazon Sidewalk\u2019s privacy protocols any good?<\/h3>\n<\/p>\n
So why the concern? <\/h3>\n<\/p>\n
What do third-party developers have to do with anything?<\/h3>\n<\/p>\n
So, should I be worried?<\/h3>\n<\/p>\n