10 ms·

OnePlus Is Again Sending User Data to a Chinese Company Without User Consent

185 points by pritambarhate 9y ago

PacketPaul 9y ago
And what penalty will the company suffer? Virtually none.
- pat2man 9y ago
  Wirecutter removed them as a recommendation. Others will probably as well. This should affect sales somewhat and since smart phone margins are so slim it could have a drastic affect.
- Spivak 9y ago
  This is one of the cases where they will probably suffer if any of this turns out to be true. OnePlus is a small manufacturer with a following of enthusiasts. They aren't large or popular enough to PR their way out of this.
  - enitihas 9y ago
    OnePlus is owned by the same company that owns Oppo and Vivo, so they aren't really a small manufacturer.
deagle50 9y ago
Shocker! Nobody should be surprised by this.
RubenSandwich 9y ago
Here is an article about their previous data collection: https://www.chrisdcmoore.co.uk/post/oneplus-analytics/ https://www.chrisdcmoore.co.uk/post/oneplus-analytics/.
AlexandrB 9y ago
Any fight for privacy in the modern technology environment is such an extreme case of power asymmetry that I'm starting to think it's hopeless. On the one side you have individuals that don't want their private information to be revealed without their consent. On the other are device manufacturers, advertisers, startups, and giants like Google and Facebook. Often, maintaining privacy while viewing a single website requires either trusting or subverting the intentions of multiple such organizations. It's like going to war with the British Royal Navy at the height of its power in a dinghy. So far it's been possible because the navy has made a promise that they'll "play fair". But that can change on a whim and there's ultimately very little you can do if that happens.
- kuschku 9y ago
  Don't worry, the GDPR is coming. Now you're going to war with the Royal Navy in a nuclear armed ruber dinghy 4% revenue per timeframe in which privacy rights were violated, or 20 million. EUR, whichever is larger, is absolutely nothing to ignore anymore.
  - imglorp 9y ago
    That sounds nice in theory, but in a global setting, how will it really work? Per GP comment, there is a whole tech stack of N providers, each piece made or running in a different country, pushing data to servers in another country, which data is bought by interests in a third country, for M destinations. Then you get the providers who intentionally don't store data in GDPR countries specifically so they can avoid these rules. Look at what Uber already does to skirt the authorities. So you have at least MxN countries possibly involved or whatever. If your data is released, it'll rattle around in a pachinko machine of jurisdiction debate for years against well funded, malicious corporations. It doesn't seem like any rule is enforceable in practice.
    - kuschku 9y ago
      The GDPR applies extraterritorially. If a company even stores a record of a single EU citizen, the GDPR applies to it, and the EU has the right to seize the assets of the company for the purpose of enforcing it.
xkcd-sucks 9y ago
On one hand, if you live in the USA maybe it's better that a Chinese company spies on you, because they're far away and the government/other gangsters are less likely to care about you than about local people involved in local politics etc. On the other hand, there's no guarantee your data isn't also made available to domestic parties, either as it's intercepted in transit or explicitly shared in bulk in exchange for e.g. concessions on a trade treaty
- reaperducer 9y ago
  > On one hand, if you live in the USA maybe it's better that a Chinese company spies on you It depends on who the "you" is. If it's a couple of internet nobodies like you and me that China is spying on, then it's no big whoop. But if the "you" in question is someone who works at the Pentagon, or at a defense contractor, or a diplomat, or government official, then there's a problem.
  - LukaAl 9y ago
    Even if you are a nobody, are you sure? Maybe you know someone that is not a nobody (works at the Pentagon, or at a defense contractor, or a diplomat, or government official ...). Or you know someone that has access to a non-nobody. And even that. Probably having access to an allegedly nobody with no connection could be interesting. Which access level has, I don't know, the DevOps of Credit Karma? Or a Data Scientist for Acxiom, or... They are totally mister nobody, but they have access, directly or indirectly to important peoples. So, the risk is actually higher than expected...
ryandrake 9y ago
Why does it matter whether the company is Chinese or not? Isn't it bad enough that there's a background process running, unbeknownst to the user, and presumably uncontrollable by the user, that monitors the device's clipboard and has methods like containsBankAccount(String)?
- jackhack 9y ago
  One reason is court jurisdiction. A domestic company is subject to, and therefore vulnerable to, court action/rulings/judgements. Suing a foreign company (especially one in China) is hopeless.
  - jayess 9y ago
    https://abovethelaw.com/2016/03/suing-chinese-companies-in-u-s-courts/ https://abovethelaw.com/2016/03/suing-chinese-companies-in-u...
- mrj 9y ago
  Because China's government has been known to lean on manufacturers in the past to include malware and backdoors.
  - forgotmysn 9y ago
    to be fair though, the NSA has been known to inject malware into american products without even telling the manufacturers
- cletus 9y ago
  Sure it's bad but there are a couple of reasons why it matters that it's a Chinese company. 1. It feeds into the suspicion many have that many (most? all?) large Chinese companies are effectively controlled by the Chinese government. This could go as far as having backdoors in, say, Huawei routing equipment. 2. Effectively disclosing a user's personal information to the Chinese government could, in some cases, imperil their liberty, even their life. I'm talking about people the Chinese governments views as "dissidents". The same would be true if it were a Russian, North Korean, Iranian, Syrian or Sudanese company.
anonu 9y ago
How do we remove this? I'm getting quite tired of one plus. This is the third strike against them in at least the last 6 months. Anyone has good experience with a custom rom on a one plus 5?
- casuallancelot 9y ago
  I'm having good luck with the most recent Dirty Unicorns RC. https://plus.google.com/+JoshChasky/posts/4B9q3PqgrVx https://plus.google.com/+JoshChasky/posts/4B9q3PqgrVx
- agentx3r 9y ago
  I've been using Lineage on my oneplus 3 for some time, and it's very stable. https://wiki.lineageos.org/devices/cheeseburger https://wiki.lineageos.org/devices/cheeseburger
veeti 9y ago
Notice how there is actually no proof at all in these tweets. The author admits that they could not observe any network requests being made: > I didn't manage to trigger the network communications to the teddymobile servers but I will continue later. It looks to me like this person is cherrypicking random SDK methods that may seem suspicious out of context and making very wild assumptions of their purposes. For example, they show a function that checks if a string contains a bank account number (https://twitter.com/fs0c131y/status/956649951056064513 https://twitter.com/fs0c131y/status/956649951056064513). Somehow they then jump to the conclusion that copied text is run through this function and uploaded to some server! But where is the proof? They could check where this method is used and show this supposed data upload happening. In fact, since these methods are coming from some third party SDK and not the app itself, they could be completely unused.
- franciscop 9y ago
  Playing devil's advocate here, we don't know the conditions of usage. It could be just inactive, or become active after X date or whatever other condition they wish. Speculating on use/non-use is a bit pointless until someone analyzes these in-depth. What we do know is the intent of those functions, and it paints a quite horrible image.
EamonnMR 9y ago
Can anyone recommend a similar company that isn't violating privacy?
- Spivak 9y ago
  OnePlus isn't all that special in the hardware category. Buy any device supported by Lineage OS and go nuts. If you want the whole package from a single company keep your eye on the Librem 5 https://puri.sm/shop/librem-5/ https://puri.sm/shop/librem-5/
  - zeveb 9y ago
    > OnePlus isn't all that special in the hardware category. I don't know about that. I've found their hardware to offer surprisingly good value for money, and they offer close-to-stock Android for much less than Google now do. Their privacy failures are deeply unfortunate; I'd have remained a happy customer for the next several years were it not for these issues.
getcrunk 9y ago
This is a smear campaign. It seems like first this only affects Chinese users and second it does not send emails or numerics (tries to protect privacy)
yingbo 9y ago
Funny. If you visit a Canada website, it will "Save User Data to a Canadian Company Without User Consent" for sure.
krisives 9y ago
I thought this was going to be something interesting like them encoding your private data into the dictionary set to obfuscate the communication. Apparently it's nothing at all. Also worth noting iPhone sends a lot of information in the HTTP headers about your phone - like model number. Android does the same thing. Also simply plugging your phone in to USB (not accepting any on-screen dialogs) will save the IEMI and other device IDs into your system log. If you ever have a device stolen I suggest you run $(zgrep -i iphone /var/log/*.gz)
ksec 9y ago
When will the lesson be learned! You cannot reason with China when your head is in its mouth!
jaxondu 9y ago
OnePlus statement that it is a false claim: https://www.reddit.com/r/Android/comments/7t6joy/statement_from_oneplus_on_the_latest_clipboard/ https://www.reddit.com/r/Android/comments/7t6joy/statement_f... The recent few "data collection" alarms appears to be smear campaign.
consciouskernel 9y ago
The tweets are blatantly inaccurate. There's an r/android discussion on this currently, where the consensus is that the twitter poster is a serial clickbaiter. https://www.reddit.com/r/Android/comments/7t6joy/statement_from_oneplus_on_the_latest_clipboard/ https://www.reddit.com/r/Android/comments/7t6joy/statement_f...
quantumfoam 9y ago
Seems to me like this might be a requirement for Asian markets or for selling phones in those regions. Author has tweeted that it's specific to Chinese regional locale/headset. Can't it be chalked up to the costs of doing business if sales plummet? OP5s owner here.

185 points by pritambarhate 9y ago

PacketPaul 9y ago

And what penalty will the company suffer? Virtually none.

pat2man 9y ago
Wirecutter removed them as a recommendation. Others will probably as well. This should affect sales somewhat and since smart phone margins are so slim it could have a drastic affect.
Spivak 9y ago
This is one of the cases where they will probably suffer if any of this turns out to be true. OnePlus is a small manufacturer with a following of enthusiasts. They aren't large or popular enough to PR their way out of this.
- enitihas 9y ago
  OnePlus is owned by the same company that owns Oppo and Vivo, so they aren't really a small manufacturer.

deagle50 9y ago

Shocker! Nobody should be surprised by this.

RubenSandwich 9y ago

Here is an article about their previous data collection: https://www.chrisdcmoore.co.uk/post/oneplus-analytics/ https://www.chrisdcmoore.co.uk/post/oneplus-analytics/.

AlexandrB 9y ago

Any fight for privacy in the modern technology environment is such an extreme case of power asymmetry that I'm starting to think it's hopeless. On the one side you have individuals that don't want their private information to be revealed without their consent. On the other are device manufacturers, advertisers, startups, and giants like Google and Facebook. Often, maintaining privacy while viewing a single website requires either trusting or subverting the intentions of multiple such organizations. It's like going to war with the British Royal Navy at the height of its power in a dinghy. So far it's been possible because the navy has made a promise that they'll "play fair". But that can change on a whim and there's ultimately very little you can do if that happens.

kuschku 9y ago
Don't worry, the GDPR is coming. Now you're going to war with the Royal Navy in a nuclear armed ruber dinghy 4% revenue per timeframe in which privacy rights were violated, or 20 million. EUR, whichever is larger, is absolutely nothing to ignore anymore.
- imglorp 9y ago
  That sounds nice in theory, but in a global setting, how will it really work? Per GP comment, there is a whole tech stack of N providers, each piece made or running in a different country, pushing data to servers in another country, which data is bought by interests in a third country, for M destinations. Then you get the providers who intentionally don't store data in GDPR countries specifically so they can avoid these rules. Look at what Uber already does to skirt the authorities. So you have at least MxN countries possibly involved or whatever. If your data is released, it'll rattle around in a pachinko machine of jurisdiction debate for years against well funded, malicious corporations. It doesn't seem like any rule is enforceable in practice.
  - kuschku 9y ago
    The GDPR applies extraterritorially. If a company even stores a record of a single EU citizen, the GDPR applies to it, and the EU has the right to seize the assets of the company for the purpose of enforcing it.

xkcd-sucks 9y ago

On one hand, if you live in the USA maybe it's better that a Chinese company spies on you, because they're far away and the government/other gangsters are less likely to care about you than about local people involved in local politics etc. On the other hand, there's no guarantee your data isn't also made available to domestic parties, either as it's intercepted in transit or explicitly shared in bulk in exchange for e.g. concessions on a trade treaty

reaperducer 9y ago
> On one hand, if you live in the USA maybe it's better that a Chinese company spies on you It depends on who the "you" is. If it's a couple of internet nobodies like you and me that China is spying on, then it's no big whoop. But if the "you" in question is someone who works at the Pentagon, or at a defense contractor, or a diplomat, or government official, then there's a problem.
- LukaAl 9y ago
  Even if you are a nobody, are you sure? Maybe you know someone that is not a nobody (works at the Pentagon, or at a defense contractor, or a diplomat, or government official ...). Or you know someone that has access to a non-nobody. And even that. Probably having access to an allegedly nobody with no connection could be interesting. Which access level has, I don't know, the DevOps of Credit Karma? Or a Data Scientist for Acxiom, or... They are totally mister nobody, but they have access, directly or indirectly to important peoples. So, the risk is actually higher than expected...

ryandrake 9y ago

Why does it matter whether the company is Chinese or not? Isn't it bad enough that there's a background process running, unbeknownst to the user, and presumably uncontrollable by the user, that monitors the device's clipboard and has methods like containsBankAccount(String)?

jackhack 9y ago
One reason is court jurisdiction. A domestic company is subject to, and therefore vulnerable to, court action/rulings/judgements. Suing a foreign company (especially one in China) is hopeless.
- jayess 9y ago
  https://abovethelaw.com/2016/03/suing-chinese-companies-in-u-s-courts/ https://abovethelaw.com/2016/03/suing-chinese-companies-in-u...
mrj 9y ago
Because China's government has been known to lean on manufacturers in the past to include malware and backdoors.
- forgotmysn 9y ago
  to be fair though, the NSA has been known to inject malware into american products without even telling the manufacturers
cletus 9y ago
Sure it's bad but there are a couple of reasons why it matters that it's a Chinese company. 1. It feeds into the suspicion many have that many (most? all?) large Chinese companies are effectively controlled by the Chinese government. This could go as far as having backdoors in, say, Huawei routing equipment. 2. Effectively disclosing a user's personal information to the Chinese government could, in some cases, imperil their liberty, even their life. I'm talking about people the Chinese governments views as "dissidents". The same would be true if it were a Russian, North Korean, Iranian, Syrian or Sudanese company.

anonu 9y ago

How do we remove this? I'm getting quite tired of one plus. This is the third strike against them in at least the last 6 months. Anyone has good experience with a custom rom on a one plus 5?

casuallancelot 9y ago
I'm having good luck with the most recent Dirty Unicorns RC. https://plus.google.com/+JoshChasky/posts/4B9q3PqgrVx https://plus.google.com/+JoshChasky/posts/4B9q3PqgrVx
agentx3r 9y ago
I've been using Lineage on my oneplus 3 for some time, and it's very stable. https://wiki.lineageos.org/devices/cheeseburger https://wiki.lineageos.org/devices/cheeseburger

veeti 9y ago

Notice how there is actually no proof at all in these tweets. The author admits that they could not observe any network requests being made: > I didn't manage to trigger the network communications to the teddymobile servers but I will continue later. It looks to me like this person is cherrypicking random SDK methods that may seem suspicious out of context and making very wild assumptions of their purposes. For example, they show a function that checks if a string contains a bank account number (https://twitter.com/fs0c131y/status/956649951056064513 https://twitter.com/fs0c131y/status/956649951056064513). Somehow they then jump to the conclusion that copied text is run through this function and uploaded to some server! But where is the proof? They could check where this method is used and show this supposed data upload happening. In fact, since these methods are coming from some third party SDK and not the app itself, they could be completely unused.

franciscop 9y ago
Playing devil's advocate here, we don't know the conditions of usage. It could be just inactive, or become active after X date or whatever other condition they wish. Speculating on use/non-use is a bit pointless until someone analyzes these in-depth. What we do know is the intent of those functions, and it paints a quite horrible image.

EamonnMR 9y ago

Can anyone recommend a similar company that isn't violating privacy?

Spivak 9y ago
OnePlus isn't all that special in the hardware category. Buy any device supported by Lineage OS and go nuts. If you want the whole package from a single company keep your eye on the Librem 5 https://puri.sm/shop/librem-5/ https://puri.sm/shop/librem-5/
- zeveb 9y ago
  > OnePlus isn't all that special in the hardware category. I don't know about that. I've found their hardware to offer surprisingly good value for money, and they offer close-to-stock Android for much less than Google now do. Their privacy failures are deeply unfortunate; I'd have remained a happy customer for the next several years were it not for these issues.

getcrunk 9y ago

This is a smear campaign. It seems like first this only affects Chinese users and second it does not send emails or numerics (tries to protect privacy)

yingbo 9y ago

Funny. If you visit a Canada website, it will "Save User Data to a Canadian Company Without User Consent" for sure.

krisives 9y ago

I thought this was going to be something interesting like them encoding your private data into the dictionary set to obfuscate the communication. Apparently it's nothing at all. Also worth noting iPhone sends a lot of information in the HTTP headers about your phone - like model number. Android does the same thing. Also simply plugging your phone in to USB (not accepting any on-screen dialogs) will save the IEMI and other device IDs into your system log. If you ever have a device stolen I suggest you run $(zgrep -i iphone /var/log/*.gz)

ksec 9y ago

When will the lesson be learned! You cannot reason with China when your head is in its mouth!

jaxondu 9y ago

OnePlus statement that it is a false claim: https://www.reddit.com/r/Android/comments/7t6joy/statement_from_oneplus_on_the_latest_clipboard/ https://www.reddit.com/r/Android/comments/7t6joy/statement_f... The recent few "data collection" alarms appears to be smear campaign.

consciouskernel 9y ago

The tweets are blatantly inaccurate. There's an r/android discussion on this currently, where the consensus is that the twitter poster is a serial clickbaiter. https://www.reddit.com/r/Android/comments/7t6joy/statement_from_oneplus_on_the_latest_clipboard/ https://www.reddit.com/r/Android/comments/7t6joy/statement_f...

quantumfoam 9y ago

Seems to me like this might be a requirement for Asian markets or for selling phones in those regions. Author has tweeted that it's specific to Chinese regional locale/headset. Can't it be chalked up to the costs of doing business if sales plummet? OP5s owner here.