The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy

213 points · 97 comments on HN · read original →

Points and comments are a snapshot, not live.

Bright Data's SDK turns consumer devices into residential proxy nodes for AI training data scraping, bypassing anti-bot detection.

Bright Data operates the world's largest residential proxy network with 400+ million home IP addresses sourced via SDKs embedded in consumer apps including smart TVs, phones, and gaming platforms. The SDK establishes a persistent WebSocket tunnel to relay web-scraping traffic through users' home internet connections, even when users configure VPNs. The research reverse-engineered the iOS framework and captured 30 days of traffic, finding that the SDK uses two inspection-bypass techniques: the control plane bypasses URLSession hooks via CFNetwork primitives, while the data plane uses Apple's NWConnection API to route around VPNs entirely. The config ships idle-detection rules that permit relaying even while users view the screen or take calls, with default monthly bandwidth caps of 500 MB per device. Partner apps identified include PlayWorks (400+ CTV titles across major ISPs and TV brands), CloudTV (125+ TV brands), Viber (250M-820M users), and others. The consent dialog text is often vague, disclosing only that "occasionally" your IP and bandwidth may be used, while the config permits 200 GB monthly use on smart TVs.

What commenters are saying

Commenters expressed practical resignation and technical workarounds rather than outrage. The dominant stance: avoid smart TVs entirely by never connecting them to WiFi and using them as passive HDMI displays only. Specific technical solutions mentioned include blocking the TV's MAC address on the router, creating temporary guest WiFi networks for one-time setup, and network segmentation with firewall rules to monitor and restrict device communications. One commenter noted that even disconnected TVs perform automatic content recognition (ACR) on HDMI feeds and phone home when reconnected. A broader concern emerged that as datacenter IPs become blocked, residential IPs (now compromised by proxy services) will also become suspect, forcing ISPs toward client verification and further internet lock-down. No commenters defended Bright Data; sentiment focused on individual device isolation as the only practical defense.