3 ms·

This has to be fixed by HMD and I hope for an official investigation as most other manufacturers are probably doing the same. In the meantime, I recommend the

This has to be fixed by HMD and I hope for an official investigation as most other manufacturers are probably doing the same. In the meantime, I recommend the following: 1. Remove any unnecessary packages through ADB (https://www.xda-developers.com/uninstall-carrier-oem-bloatware-without-root-access/ https://www.xda-developers.com/uninstall-carrier-oem-bloatwa...) 2. Use Shelter (https://f-droid.org/en/packages/net.typeblog.shelter/ https://f-droid.org/en/packages/net.typeblog.shelter/) 3. Use a VPN-Firewall such as NetGuard (https://f-droid.org/en/packages/eu.faircode.netguard/ https://f-droid.org/en/packages/eu.faircode.netguard/) or NoRoot Firewall (https://play.google.com/store/apps/details?id=app.greyshirts.firewall https://play.google.com/store/apps/details?id=app.greyshirts...).

vesinisa 8y ago
According to the statement HMD Global gave to NRK, they have already rolled out a software update to fix this issue. Of course there is almost guaranteed to be other spyware on the phone serving the curiosity of the same and different masters, like Google.
anc84 8y ago
Thank you for linking Shelter, I had no idea that was possible and that easy software for it existed!
m-p-3 8y ago
This should be fixed at an even higher level, and have Google force manufacturers to not add or alter the base OS for any data-gathering reasons in Android One and deny them from using the Android One brand if they do, or people will lose faith about the Android One program.
- UncleEntity 8y ago
  That, my friend, would be abusing their monopoly position. Google hoovers up all the data and tells their partners they can't do this too? The antitrust regulators would have a field day.
codedokode 8y ago
You suggest installing userspace apps to control system software that might run in a privileged context. NoRoot Firewall, for example, doesn't control iptables, it just pretends to be a VPN server and privileged software, I assume, can bypass it.
- v4n4d1s 8y ago
  Yes, I'm fully aware of this. There's also the problem of having a closed source baseband processor in pretty much every device. But bypassing these mechanisms is a decision they had to make. If they're just lazy or incompetent, these userspace apps should be sufficient as a mitigation. Check this out for a more sophisticated way: https://privacyinternational.org/node/2732 https://privacyinternational.org/node/2732
- kingosticks 8y ago
  According to the explanation about permissions within NoRoot Firewall itself, any app with the 'Internet' permission can create connections to bypass the VPN. This is how NoRoot Firewall itself works (else the filtered traffic would never escape the app/vpn).
kevin_thibedeau 8y ago
Google should revoke their use of the AndroidOne trademark over these shenanigans.

vesinisa 8y ago

According to the statement HMD Global gave to NRK, they have already rolled out a software update to fix this issue. Of course there is almost guaranteed to be other spyware on the phone serving the curiosity of the same and different masters, like Google.

anc84 8y ago

Thank you for linking Shelter, I had no idea that was possible and that easy software for it existed!

m-p-3 8y ago

This should be fixed at an even higher level, and have Google force manufacturers to not add or alter the base OS for any data-gathering reasons in Android One and deny them from using the Android One brand if they do, or people will lose faith about the Android One program.

UncleEntity 8y ago
That, my friend, would be abusing their monopoly position. Google hoovers up all the data and tells their partners they can't do this too? The antitrust regulators would have a field day.

codedokode 8y ago

You suggest installing userspace apps to control system software that might run in a privileged context. NoRoot Firewall, for example, doesn't control iptables, it just pretends to be a VPN server and privileged software, I assume, can bypass it.

v4n4d1s 8y ago
Yes, I'm fully aware of this. There's also the problem of having a closed source baseband processor in pretty much every device. But bypassing these mechanisms is a decision they had to make. If they're just lazy or incompetent, these userspace apps should be sufficient as a mitigation. Check this out for a more sophisticated way: https://privacyinternational.org/node/2732 https://privacyinternational.org/node/2732
kingosticks 8y ago
According to the explanation about permissions within NoRoot Firewall itself, any app with the 'Internet' permission can create connections to bypass the VPN. This is how NoRoot Firewall itself works (else the filtered traffic would never escape the app/vpn).

kevin_thibedeau 8y ago

Google should revoke their use of the AndroidOne trademark over these shenanigans.