Hello Barbie

~ the eulogy ~

I was thirty one years old and five years out of university when Hello Barbie shipped, in a country where she was never a retail product. She reached me only as an argument. The dispute around her travelled everywhere and the product itself stayed in American toy aisles, which is a common enough shape for a toy and a strange one for a piece of voice infrastructure.

The mechanism was simple enough to explain to the child using it. Barbie had a microphone behind her necklace and a WiFi radio in her back. You held down the belt buckle, spoke, and the audio went to servers run by ToyTalk, a San Francisco company founded by former Pixar people. Speech recognition up there picked out what you had said, then a scripted engine chose a reply from thousands of pre-recorded lines for the doll to play back. She remembered things between sessions, which was the selling point. She knew your sister's name because you had told her.

She arrived in late November 2015 at $74.99, into the worst possible season for the idea. The Campaign for a Commercial-Free Childhood had been running against her since the spring under the hashtag #HellNoBarbie, and the objection was not really technical. It was that Mattel had put a recording device shaped like a friend into a child's bedroom and arranged for the recordings to leave the house.

~ the dossier ~

~ the week the researchers arrived ~

In November 2015 Bluebox Labs went through the doll and its app and published what they found. ToyTalk's servers accepted a known broken encryption fallback, the POODLE attack, which meant the channel between doll and server could be stripped. The companion app reused an authentication credential in a way an attacker could take advantage of. Somerset Recon published a separate analysis shortly after. The press coverage was what you would expect, and Fortune put her in a piece about the worst toy year.

What usually goes unmentioned is how ToyTalk handled it. Bluebox disclosed in the middle of the month and the company answered within hours, patching the same day. It had a bug bounty running before any of this started. Judged as a security operation it was better than most of the connected-toy industry managed in that era. It made no difference at all to the outcome, because the thing people objected to was the feature working as designed, and no patch addresses that.

~ the body without the voice ~

Mattel stopped producing her in 2017. ToyTalk had by then renamed itself PullString, kept building voice tools for Alexa and Google Assistant, and in February 2019 was bought by Apple in a deal reported at around thirty million dollars, with earn-outs on top. The conversation service for the doll was switched off in July 2019.

So the dolls in cupboards across America still have the microphone behind the necklace and the belt buckle that used to start a conversation. Press the buckle now and nothing happens, because the part of Hello Barbie that was Hello Barbie never lived in the doll at all. Mattel's support page for her is still up, and all it says is that the service will no longer be working.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »