When It's Not Worth the Paper It's Written On: A Provocation on the Certification of Skills in the Alexa and Google Assistant Ecosystems

TL;DR

This paper critically examines the shortcomings of current skill certification processes in voice assistant ecosystems like Alexa and Google Assistant, highlighting security issues and proposing a roadmap for improvement.

Contribution

It identifies fundamental flaws in existing certification methods and offers a comprehensive roadmap with research directions to enhance platform security and quality assurance.

Findings

Current certification methods are ineffective at preventing malicious skills.

Documented security and privacy issues persist despite certification.

A proposed roadmap aims to improve certification and platform safety.

Abstract

The increasing reach and functionality of voice assistants has allowed them to become a general-purpose platform for tasks like playing music, accessing information, and controlling smart home devices. In order to maintain the quality of third-party skills and to protect children and other members of the public from inappropriate or malicious skills, platform providers have developed content policies and certification procedures that skills must undergo prior to public release. Unfortunately, research suggests that these measures have been ineffective at curating voice assistant platforms, with documented instances of skills with significant security and privacy problems. This provocation paper outlines how the underlying architectures of these platforms had turned skill certification into a seemingly intractable problem, as well as how current certification methods fall short of their full potential. We present a roadmap for improving the state of skill certification on contemporary voice assistant platforms, including research directions and actions that need to be taken by platform vendors. Promoting this change in domestic voice assistants is especially important, as developers of commercial and industrial assistants or other similar contexts increasingly look to these devices for norms and conventions.