9 ms·
Lenovo: Companies working in China may have to install local backdoors
- greymeister 8y agoI'm sure they have plenty of examples to go by, all they need to do is consult Yahoo, Google or any of the telecoms for good strategies. I guess on the plus side at least we know now that it is happening despite the lies the Federal government told us. I worry that as bad as it is for whistle blowers in the US what chance does China have?
- claydavisss 8y agoExactly. HN is great at armchair-quarterbacking the PRC but is too busy fawning over US tech corps to see the parallels.
- ComputerGuru 8y agoAnd apparently also confirmed that they’ve done it for other countries too, without providing any names.
- paulsutter 8y agoEasier to make a list of countries that don’t want backdoors. It’s for the children you know, to stop those pesky evildoers.
- deleted 8y ago[deleted]
- sctb 8y agoWe've reverted it from “Lenovo CTO confirms local backdoors in products”.
- woliveirajr 8y ago> "Likewise, if there are countries that want to have access, and there are more countries than just China, you provide what they're asking." Seems that it's kind of obvious and infuriating at the same time: companies that sell physical goods don't have much choice, they must meet country regulations for each country they want to sell.
- snaky 8y agoCompanies that don't sell physical goods don't have much choice too. > A prototype search engine that Google is designing to meet the scrutiny of Chinese officials links users’ phone numbers to the searches they perform > This report adds to earlier news, also broken by The Intercept about the search engine, codenamed “Dragonfly,” which eliminates from results a number of terms and topics, like freedom and democracy. http://fortune.com/2018/09/14/google-china-search-engine-links-phone-numbers/ http://fortune.com/2018/09/14/google-china-search-engine-lin...
- jackhack 8y agoI think they have plenty of choice. They can say "no", tell these regressive regimes to go to hell, and simply not manufacture/sell their product there, where-ever "there" may be.
- responseguy 8y agoThe shareholders do not agree that that is an option.
- comboy 8y agoDo note, that based on those quotes it is not clear that backdoors requested by the US gov are not installed in the US. He just said they don't install any of them globally.
- close04 8y agoYou're going to be spied on one way or another. I guess it's a matter of picking the side you want to make life easier for. The one you trust more with your data :).
- claydavisss 8y agoMeanwhile in the US we also have a long history of monitoring internet traffic, installing backdoors and allowing private third-parties to filter what we see online. Where do we get off critiquing the PRC? We should clean our own house first.
- HenryBemis 8y agoLast I checked, in the EU or the USA you don't disappear in the middle of the night never to be seen again because you are: -follower of different religion -saying the word "democracy" -critisizing a politician/the government so yes, first things first.
- claydavisss 8y agoYou're moving the goalposts with a strawman. We are no better than anyone else when it comes to information privacy, which is the thrust of this article.
- soperj 8y agoWas McCarthyism really that long ago?
- iforgotpassword 8y agoReally, does HN deserve that kind of idiotic post? You can walk around China an say "democracy" all day. You think they don't report on eg elections in the US on TV there? People in China complain about the government and laws all day. There is a lot wrong with China that they deserve to be called out for, but what's your goal with a post like that? Show the world that you don't have a clue about anything besides tech? It boggles my mind how many people happily buy any FUD that helps them painting a simple black and white image of the world just so they can feel good about their own country.
- 07d046 8y agoTrue. It would be a more accurate post if it listed "having a watch set to the wrong time zone" instead (mentioned in the HRW report). It is unfortunate that there is a lot of misinformation about China out there. Winnie the Pooh isn't banned. The social credit system apparently isn't like how it's commonly reported in the West. But I also chafe at the suggestion that China is little worse than the US on these points. There are few countries on earth that have more control over their population and shape the way they think than China. https://www.hrw.org/report/2018/09/09/eradicating-ideological-viruses/chinas-campaign-repression-against-xinjiangs https://www.hrw.org/report/2018/09/09/eradicating-ideologica...
- chooseaname 8y agoEventually you just won't be able to buy a trustworthy computer.
- snaky 8y agoEventually?
- craftyguy 8y agoMy hope is that eventually we would be able to buy a trustworthy computer.
- snaky 8y agoTo print all the chips on your own mini-fab - maybe. Eventually.
- RcouF1uZ4gsC 8y agoBut your mini-fab might be backdoored and create chips with backdoors.
- responseguy 8y agoMore likely that the schematics will contain backdoors, that aren't easily understood to be backdoors. EDIT: have - contains
- 0xcde4c3db 8y agoIt could conceivably be done even below the schematic level, though I'm not sure how much room modern processes have for this sort of thing now that we're talking about how many atoms wide a transistor is. I've been told that there was a period of a few years in which a kind of "copy protection" proliferated in IC layouts. The layouts would be tweaked to exploit quirks of the originating company's fabrication process (e.g. a pattern might look like a diode but actually function as a resistor when fabricated), and this would sabotage attempts by other companies to clone the chip (at the time, Japanese and Soviet clones were major concerns).
- netwanderer2 8y agoAre they telling me other companies in the West are not doing this and only Lenovo in China does it? I would find that hard to believe. You see, the reality is once your opponent has made the move first in an attempt to gain a competitive advantage, no matter how unethical that move is, you are forced to do the same or even more. If not you'll be quickly left so far behind and won't ever have the chance to come back in the race. Despite whatever anyone has told you, that's how the real world works. Our companies may not readily admit what they're doing but in reality they have little choices. It's similar to countries that don't possess nuclear weapons are always second class in the world's power order. The time limit to join first class was gone a long time ago and it will never come back.
- walterbell 8y agoPurism is working with coreboot to provide laptops where you can verify the integrity of firmware on your device, within the limits of Intel CPUs. https://www.tomshardware.com/news/purism-heads-rootkit-tampering-protection,34128.html https://www.tomshardware.com/news/purism-heads-rootkit-tampe... "Purism announced that, after almost a year of testing, it was able to successfully integrate the Heads firmware into its TPM-enabled and Coreboot-running Librem laptops. The open source firmware, which checks if someone has tampered with the laptops, allows users to freely inspect and customize the code. Purism also recently announced that all of its new Librem 13 and 15 laptops now include a TPM by default, so they all come with the Heads firmware by default, too." Previously: Google on "Replacing exploit-ridden firmware with a Linux kernel", https://news.ycombinator.com/item?id=15579592 https://news.ycombinator.com/item?id=15579592
- snaky 8y agoIntel microcode updates are encrypted and signed.
- walterbell 8y agoYes, this is about open-source firmware vs OEM (e.g. Lenovo) closed-source firmware.
- lowry 8y agoWAT?
- walterbell 8y agoOpen-source firmware: https://coreboot.org https://coreboot.org Purism/coreboot: https://puri.sm/posts/category/firmware/ https://puri.sm/posts/category/firmware/
- mothsonasloth 8y agoI miss the early 90s and 2000s when governments were still struggling to understand what the internet was, rather than trying to control it.
- danieldk 8y agoDid that time ever really exist? https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Export_of_cryptography_from_th... I also remember writing some (naive) crypto tools as a kid and I had to report it to permit re-export from the US. Also, the DMCA is from the nineties: https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_Act https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_A...
- mothsonasloth 8y agoWow those are interesting. I'll need to do some digging on the UK government, to see what they were up to back then.
- spectre256 8y agoI concur that it's unlikely that time ever really existed, at least in the US. After all, the internet came directly from the Department of Defense funded ARPANET. Before that, computers were so expensive and large that realistically only governments or large companies could fund even routine work with them. I suppose all that's changed is now the average human is on the internet. I mean that literally, since it seems that we are about to cross the threshold of 50% of humanity using the internet (https://en.wikipedia.org/wiki/Global_Internet_usage https://en.wikipedia.org/wiki/Global_Internet_usage). So the things governments wish to do on the internet are more and in line with things that involve the population at large. For better or worse (mostly the latter, IMO) that involves lots of intelligence gathering, copyright enforcement, and national security work.
- captain_perl 8y agoI remember the US federal govt. hired around 20 Unix sysadmins around 1984-1985 to monitor/archive IRC and newsfeeds (pre-WWW.)
- mtgx 8y agoMay? It's just now getting official.
- reaperducer 8y agoMaybe this will finally make Apple rethink its manufacturing. It can either be the bastion of freedom in consumer electronics, as it likes to brag, or not. Time to decide.
- mc32 8y agoIt doesn’t seem this would mske a diff: exports outside of China would not be affected (indifferent) imports into China would still require this regardless of mfg origin. Their only option is to not sell in that market —which seems highly unlikely.
- kodablah 8y ago> Does Lenovo put backdoors in if the Chinese government asks? > "If they want backdoors globally? We don't provide them. If they want a backdoor in China, let's just say that every multinational in China does the same thing. Even though not a direct answer, close enough. One could only hope to get a similar statement from Apple wrt iCloud so we aren't left with assumptions about lack of privacy.
- Laforet 8y agoiCloud in China has been hosted by a local licencee for a while. People who care about privacy are at least aware that the backend is no longer secure. While we are on the topic, Windows 10 binary for Chinese government contracts are compiled by a third party company based in China so certain features could be added/removed at code level without directly giving away the source code. It may only be a matter of time before this practice permeates into retail and OEM markets.
- _red 8y agoHow do I, as a US citizen, know that Apple isn't replicating my data to this Chinese datacenter? I know you will say "you have to trust them", but therein lies the problem. There is no way for consumers to verify anything about their data.
- justtopost 8y agoExactly why I simply cannot trust their supposed 'commitment to privacy'. How could you take it seriously when they are willing to play ball with this clear human rights issue? It's madness.
- throwa9192018 8y agoOn another note, if I get my data on the Chinese datacenter, does this mean my country's government is unable to extract this information from Apple? If they send a notice to Apple for my data, will Apple refer them to China instead?
- 8y ago
- 08-15 8y agoInteresting choice of language there: "we don't put in backdoors [...] we follow the ethics" but then "if there are countries that want to have access [...] you provide what they're asking" No, Mr. YY, it's you who's providing what "they" are asking, and that makes you evil, not me. ("Them" too, naturally.)
- rodgerd 8y agoThis is not unique to China. New Zealand has the TICSA requirement that network operators must provide intercept capabilities to security agencies, and all network operator designs must be approved by security agencies before deployment. I would imagine other five eyes countries have or soon will have similar requirements.
- krylon 8y agoWasn't there this announcement recently that the Five Eyes was "asking" vendors to provide backdoors voluntarily, or else? And all the governments engaging in this kind of behavior are at the same time giving each other excuses, "because every one else is doing it, too". So if China does this, you can be sure other countries will point to China's example and require their own backdoors. Let's just hope all those backdoors are mutually incompatible.
- AnthonyWnC 8y agoThey are just stealing the concept from US (lawful intercept/CALEA)..
- mindfulhack 8y agoThis is gravely concerning to me. Privacy is a fundamental human right, and it's needed to fight unjust laws and practice civil disobedience in a safe and comfortable way. If we had today's surveillance capabilities in the 70's, it would have been impossible for the LGBTQ community to achieve the societal acceptance they now have! We need a fully open-source hardware ecosystem (with downloadable component blueprints, 3D-printing machines and local co-ops or gumtree-like marketplaces for obtaining free hardware), to bring much-needed democratisation to our society like the Internet did at the software / information access level. We need a Linux of hardware.
- krupan 8y agoPlease support librecores. It's a small start. I think one thing we are missing is a Stallman of hardware. Some who is loud, willing to take a stand, and who has enough technical chops to back it all up.
- foxrob92 8y ago> "Likewise, if there are countries that want to have access, and there are more countries than just China, you provide what they're asking." So..the US as well? The UK? I wonder who else is "asking".