7 ms·
Google admits changing phone settings remotely
- TwoNineA 8y agoWhat's next? Change location settings remotely so that they can siphon more data? Who the hell at Google tought that playing with phone settings remotely was a good idea?
- aneutron 8y agoIt can have legitimate use cases, for example administrating a large fleet of Android phones in a corporation. But I have to agree that mobilizing such machinery against typical non-enterprise users is stupid. In some countries that could make them vulnerable to huge lawsuits
- deleted 8y ago[deleted]
- reaperducer 8y agoIn some countries that could make them vulnerable to huge lawsuits In some countries it could be leveraged to put government-sponsored spyware on everyone's phones. And by "some" I mean "all."
- jjoonathan 8y agoThe same people who thought it was a good idea to give control of the lockscreen to third parties who are notorious for attention-seeking and brinksmanship (album art) -- and then to remove the setting to control it. (Album art is communicated through notifications so you can still revoke access on a per-app basis, but the new setting is not explicit, not global, coarse, and overrode my preferences during an "upgrade". Ugh.)
- shittyadmin 8y agoWell, at least in modern Android it's not as bad as it used to be - it used to take up the entire background of the lockscreen. I used to need an Xposed module just to fix that.
- SketchySeaBeast 8y agoMy gym phone still has android 5 on it - nothing like having everyone see you're pumping yourself up for your big lift with Frozen. "LET IT GOOOOOOO!!!!"
- curiousgal 8y ago> Change location settings remotely You don't have to change a setting if it never works. points at temple https://bgr.com/2018/08/20/lawsuit-google-violates-privacy-tracking-locations/ https://bgr.com/2018/08/20/lawsuit-google-violates-privacy-t...
- romed 8y agoI guess it's pretty obvious that the company who regularly pushes new software to your phone can also change the interpretation of settings and preferences as they like, or remove the preferences and settings altogether, or replace your wallpaper with cat photos. How has this gone uncontemplated by the HN commentariat?
- solarkraft 8y agoLMAO. They already track people who disabled tracking without telling them about it. If you request they delete your data they probably won't, either. Tech companies (especially Google) are giant black boxes with vast control over our lives. "The Circle" wasn't a good movie in my eyes, but it might give people a feeling of what such a company is capable of.
- el_duderino 8y agoPrevious discussion from a few days ago: https://news.ycombinator.com/item?id=17984576 https://news.ycombinator.com/item?id=17984576
- test0014232874 8y agoWTF GOOGLE YOU SHOULD NOT BE ABLE TO DO THAT
- onepremise 8y agoRemote wipe your phone if it gets stolen?
- yjftsjthsd-h 8y agoUser-initiated. Totally different.
- Alterlife 8y agoThe fact that this is even possible on a private device should be shocking, yet I don't even feel surprise.
- Someone1234 8y agoAny piece of software that receives updates can have its settings changed. Automatic updates worsen that. Almost all major companies have done so in the past, some of it justified, some less so.
- toast0 8y agoThat this only happened on the newest operating system is going to negatively influence acceptance of upgrades, for the slim number of users who actually have a choice. I didn't upgrade so I could have my messages delayed, thanks.
- deleted 8y ago[deleted]
- mauliknshah 8y agoHas anyone found the app permissions being reset for many apps abruptly? I just faced it!
- sorenjan 8y agoIt feels arrogant by Google to take the liberty to even add the possibility to changes customer's settings remotely without them having a say in it. It's like the forgot who's phones they are. My guess is that they're so used to A/B testing on their web sites that they think the same is OK on peoples personal devices just because Google makes the software that runs on them too.
- shittyadmin 8y agoYeah, how was this rolled out? I assume a play services update? I mean - I expected it to be possible just because they're the ones who signed both play services and the settings apps - but for them to actually use that capability seems completely insane. I'm almost wondering if we could do some sort of crowd auditing of play services changes, automatically grab changes pushed via play store, pass through appropriate decompilers and disassemblers and highlight modified sections, similar to what tools like bindiff do... I know, I know, install MicroG/switch to an iPhone/burn your phone with fire, but many people run these devices and would be interested in any impacts like this being had on user security and privacy I'm sure.
- solarkraft 8y agoThis is something the world does need. What data does my phone automatically send, what commands does it listen to from the outside?! I have no idea. Google is fucking creepy and it probably shouldn't be legal for them to bully me into using Play Services.
- clubm8 8y ago>It feels arrogant by Google to take the liberty to even add the possibility to changes customer's settings remotely without them having a say in it. I think the issue is a lack of informed consent. Some of the commenters seem to think this isn't a "big deal", since the changes were relatively minor and made to benefit the user. Let's draw from the real world: even if you have zero STDs, and use a condom, it is a serious crime to have sex with someone while they're asleep - because they couldn't give consent. It deeply troubles me that I keep seeing this mentality that there must be "harm" for something like this to be a problem. I saw similar logic used in the article on Google using "anonymized" credit card data - that people's feelings about the matter are invalid, since there's no harm if the data is anonymized. Frankly, the word that comes to mind when I read these articles is not arrogance - it's entitlement. Google feels entitled to do as it pleases, because it feeds it knows better than you.
- throw2016 8y agoFearmongering and FUD on security by short sighted and self serving technical folks on forums like this has got us to the point where backdoors and remote execution by 'trusted parties' are the norm while users root access to their own device is demonized as a security hole. These are folks who are constantly 'empowering' themselves at the cost of others so getting root on your own phone is now thought of some sort of great security hole and some apps will detect it and refuse to work. This is the future of software freedom courtesy ex freedom and liberty poseurs and now greedy out of control tinpots.
- lima 8y agoAll of Google's own devices have an unlockable bootloader and you're free to install your own operating system (both on smartphones and chromebooks). That being said, rooting is a security hole - the PIN lock on most rooted phones can be trivially bypassed, and an application running as root can persistently and invisibly compromise the system (and bypass safeguards on things like Android Pay). The only non-Google Android fork which does not trivially compromise device security was Copperhead OS (now defunct) - they would ship devices with a locked bootloader and sign their updates, achieving a similar level of security (assuming a secure build system).
- jrockway 8y agoI don't really see the problem here. You tweak settings and collect data so you can pick better defaults in the future. Why wouldn't you do this? I worry that users imagine software to be static, complete, and never in need of change... and the world just doesn't work that way. Software is in a constant state of "works just well enough to maybe deploy". Experimentation and refinement are always necessary. I don't see outrage when Microsoft updates Windows and it starts deleting malware from your system. What's the difference?
- shittyadmin 8y ago> I worry that users imagine software to be static, complete, and never in need of change... and the world just doesn't work that way. For users who have stable, working software, it should. If I voluntarily update my device that's a different scenario. Quietly pushing changes like this that impact user settings, not so much. > I don't see outrage when Microsoft updates Windows and it starts deleting malware from your system. Googling "Disable malicious software removal tool" certainly reveals otherwise.
- ardy42 8y ago> I don't really see the problem here. You tweak settings and collect data so you can pick better defaults in the future. Why wouldn't you do this? The problem, is that they didn't seem to ask for consent or have been upfront that they had implemented this kind of remote control capability. The user's phone is the user's phone, not Google's; so the user needs to have ultimate control (and Google needs to respect that).
- jrockway 8y agoBut I mean, they write the software on it. Something is going to change every release. People seem mad that it was a configuration change and not a change in the image that is installed on the device, but I don't see the difference.
- 394549 8y ago> People seem mad that it was a configuration change and not a change in the image that is installed on the device, but I don't see the difference. Think of it this way: you need a backdoor to push remote config changes the way Google did. Sure, Apple, Google, Microsoft, etc. have the ability to run arbitrary code on your machine through updates, but they'd be abusing the trust placed in them to even install a backdoor, let alone use it.
- romed 8y agoEvery time Ubuntu updates some package (that I haven't figured out) it blows away my CPU governor settings. But I guess there won't be a lot of press articles about this.
- butz 8y agoMaybe you are changing wrong config file? Most software has a default config that is overwritten with updates, but allows you to add custom config in separate files.
- dredmorbius 8y agoWhich means: 1. Google have this capability. 2. They have exercised it. 3. Whatever internal controls exist to check this don't exist, failed, or explicitly permitted this action. None of the three options, for a single locus of control to something on the order of 3-4 billion user devices or accounts (net of Android + Gmail accounts) is particularly heartening. 4. The primary channel of communication is ... a Reddit account? Someone is terrifyingly asleep at the wheel. Competency? Trust? Goodwill? This is how you lose it. This is how organisational decline starts. It tends to proceed slowly, at first, then all at once. Shades of Hemmingway.
- rauhl 8y agoThe key insight here is that this should not even be possible. Yes, corporate-owned phones need to be administered remotely. Yes, Google needs to be able to perform internal testing (this is in fact just an example of corporate ownership). Sure, maybe some individuals want to opt in to something like this. But the key is that this should be opt-in. It should simply be impossible for Google to do anything pernicious to a newly-purchased Android phone: it should not be able to write settings, nor should it be able to read any data.
- jlg23 8y agoPushing configurations to devices has been around for at least 2 decades. Everybody does it and unless we are bashing big companies, we usually agree on "automatic software updates are a good thing(tm)". I don't see any difference between software or configuration updates, after all you can do the latter through the former anyways.
- dx87 8y agoI don't think people are upset that Google could change settings or software, they're upset at the lack of technical controls that allowed Google to accidentally push out settings changes to user's devices, and the lack of security measures in the OS that allows that accidental settings change to be done without any sort of notification to the user. It'd be like your bank accidentally moving your money to another account; you know that they need the ability to transfer funds as part of their job, but they should have better internal processes that prevents them from accidentally doing it.
- daveFNbuck 8y agoThey're able to push a new OS. How can they do that without being able to change your settings?
- rauhl 8y agoThey shouldn’t be able to push a new operating system onto my phone. They can let me know that a new version is avilable for me to download, when I see fit. It’s my phone, after all!
- LinuxBender 8y agoThis has been possible since at least the mid 90's. We used to update the firmware over the air. We could change any settings on the phone, but would only do so when required to keep the phone operational. Anything beyond that risked customer support calls and bricked phones. And yes, we sometimes bricked phones. We even had the ability to brick phones intentionally, if stolen, but that feature was never used by customer support for fear of bricking the wrong phones. Some years later I was at a company that could rewrite any part of your phones OS over the air. They did some fairly clever things that were barely documented by the vendors. I can only imagine what is possible today.
- lern_too_spel 8y agoIt looks like they meant to change a default setting, which users expect, but instead overrode settings, which should only be used to fix bugs.
- gwbas1c 8y agoHonestly, when I saw that battery saver was on, I thought I turned it on by accident. A lot of the responses here are overreactions. This appears to be a defect, not something nefarious. Part of software development is altering default settings. Another part of software development is periodic updates. Mistakes like this will happen. Get over it.