17 ms·

HP printers try to send data back to HP about your devices and what you print

497 points by darekkay 7y ago

stallmanite 7y ago
Good to know that the world and Hewlett Packard are just as disgusting as I assume they are. I get called cynical but it’s reality.
raincom 7y ago
That's good for espionage and other activities. Even photo copies leave meta data somewhere; that's how one serial killer got caught, iirc.
- __m 7y ago
  No it’s fine, HP isn’t a company from Gina, nothing to see here
- reaperducer 7y ago
  Some printers/photocopiers can be configured to erase their data. For HIPAA reasons we have a Kyocera at work that does this. After each job the display shows "Erasing hard disk data" or something like that as it scrubs the buffer.
  - tinus_hn 7y ago
    But how about a printer that just doesn’t have a hard disk? What is it used for anyway?
hyperman1 7y ago
I wonder if, at this point, it isnt easier to write a service that floods all these companies with random made up telemetry. MS/HP/FAANG wants data? Lets bury them in it. We train some AI so it isn't obviously wrong. We start anti tracking lists like the spam blacklists. We se d GDPR requests to find out what sticks. With some luck, their firewalls block us and we're finally getting privacy.
- userbinator 7y ago
  That's been done already with ads: https://adnauseam.io/ https://adnauseam.io/ I've heard that in practice it does get you on a blacklist and they'll start ignoring what you send, so perhaps it does have some effect.
  - yjftsjthsd-h 7y ago
    That's still a win, I suppose.
  - drewmol 7y ago
    Point of caution before using adnauseam: I installed and used it on 3 devices for about 6 months a few years ago. I have seen an increase of about 50 fold in the amount of targeted spam phone calls and physical mailers I receive since that time and they've only started to subside in the last year. I can't prove but highly suspect it's a result of my name getting added to a lot of lead DBs as an interested potential customer due to adnauseum ad clicks.
    - rightbyte 7y ago
      You took shots for the team. Keep up the good work! Reading about the tool makes me kinda wanna install it ... that should mess up the targeting profile quite a bit for my ip.
userbinator 7y ago
The bloat in HP printer drivers has been well known for a long time, and I'm not surprised "telemetry" is now part of that. I stopped "upgrading" printers when they still used parallel ports and standard drivers the OS already had (no need to even touch the installation CD), so I don't know if the newer ones can also be used without installing the extra crap. I imagine that a user’s data is exfiltrated back to HP by the printer itself, rather than any client-side software. To me, that's a good reason (among others) to use a print server and plug the printer into it instead of a printer with its own networking; or if you must, keep it behind a firewall with no access to the Internet. Although I have no interest in owning one, I'd be curious to packet-sniff one of these.
- reaperducer 7y ago
  To me, that's a good reason (among others) to use a print server and plug the printer into it instead of a printer with its own networking That's an excellent idea. I wish I'd thought of it. I have a couple of old Airport Expresses lying around with USB ports on them. I wonder if one of them could be pressed into service in this manner.
  - NegativeLatency 7y ago
    I did this, just needed to torrent and install an old version of 10.6 on a VM so I could configure the airport. Raspberry pis also make decent print servers
- javajosh 7y ago
  Another option is to a) give your printer a static IP (or setup DHCP to assign it's MAC a consistent IP) and b) add a routing rule to not forward packets from that IP. (However, a print server is strictly better if only because you just can't know what such a printer is going to do on your network!)
jeroenhd 7y ago
There was a time that I trusted HP and their products and would recommend their business line to friends and family. This has changed over the years. Crummy software updates (had to install an old version of some Intel tool to get my laptop to sleep in Windows 10) and the crapware they still bundle with Windows has made me take a step back from that position. With this move I'm done with HP. I would have accepted a simple and clear explanation and toggle to send the same information, but this is just too shitty. If anyone from HP is reading this, tell your supervisor that you've just lost another guy-that-everyone-goes-to-for-pc-advice. I hope you're happy.
- chiph 7y ago
  I gave up on them when the inkjet I had bought produced a small mountain of dried ink inside it with it's constant cleaning cycles. There was more money in that dried ink than I had paid for the printer. This was very a different experience from the monochrome DeskJet 500 that was such a workhorse. And the 7470A plotter that dad used for over a decade.
  - imglorp 7y ago
    If you don't need color, try a laser printer. Toner doesn't dry out; you only pay for what you actually print.
    - ars 7y ago
      Get a laser printer EVEN if you need color. Color laser printers are slow, but not expensive.
    - chiph 7y ago
      That's what I did. Got a Brother HL-5370DW and it's been excellent.
      - zrobotics 7y ago
        Second this- the really great thing about the brother lasers is awesome Linux driver support. The install process was simpler on Debian than even the windows setup, which is certainly not the case for HP gear (hplip, the less I think about it the happier I am).
tempguy9999 7y ago
My epson printer specifically says this when you install the driver. At least they're being upfront. I don't like it but I don't know how to disable it and don't have the time to look into it. Arguably much worse than all this is the yellow dots tracking on some colour printers https://www.eff.org/deeplinks/2008/10/effs-yellow-dots-mystery-instructables https://www.eff.org/deeplinks/2008/10/effs-yellow-dots-myste...
- OrgNet 7y ago
  > I don't like it but I don't know how to disable it and don't have the time to look into it. They know that almost nobody does, so they bank on it... it needs to be regulated.
vbezhenar 7y ago
It's good that I never trust printers to print my master passwords and just write them by hand. At least my pencil does not send anything yet...
- wolco 7y ago
  HP pencils record arm movement and the eraser has a wireless transmittor.
rgrieselhuber 7y ago
Sounds like we need the Raspberry Pi of printers.
- imglorp 7y ago
  I was just thinking more like using a raspberry pi for a home print server. 1. Load up the Pi with Cups, which has a web interface, and all the optional drivers and fonts it needs. 2. make sure ip_forward is off 3. set all your printers to use your Pi as their default network gateway 4. profit?
  - edoceo 7y ago
    I do this but, I've missed step 4. There is a little more to the cups config but it "just works" (if you know cups well)
snthd 7y ago
Are HP doing this in GDPR-covered territory? Possibly the requirement to download stuff is so they can geo-target?
neilv 7y ago
When I got a modern LaserJet at home (my LJ5 lasted forever), I intentionally got one with Ethernet, and without WiFi. But all the cloud-y firmware features of the new LaserJet looked so sketchy, I decided not to connect the printer's Ethernet to my LAN. Instead, I set up a separate little print server, which connects to the printer's USB. Of course there are still vulnerabilities, but at least now it's not as overtly sketchy.
- mirimir 7y ago
  Couldn't you just drop Internet-bound packets in your router? But yeah, USB is good enough for printers.
  - neilv 7y ago
    Yes, and I could additionally filter the permitted traffic to/from the expected TCP port(s) and directions for each. But my current home routers are OpenWrt, tend to get reflashed, occasionally lose their configs various ways, and aren't documented as well as one would like, so I try not to add much complexity there. A little print server either works, or it fails conspicuously (unlike rules on my plastic router, which are most likely to fail silently). If I ever get time to build a bit different router (e.g., pfSense or atop a normal Linux distro), I'll revisit that.
    - mirimir 7y ago
      I found pfSense far easier to setup than OpenWrt. I've been running it on an Atom desktop for about seven years. I've updated more or less annually, and have only needed to tweak the configuration when I've moved.
      - neilv 7y ago
        Good to hear that's worked well. Looks like there's now some Atoms with AES-NI, for future pfSense support.
        7y ago
drewg123 7y ago
What is a good low-end laser printer or multi-function device to recommend to non-technical friends that "just works" ? I don't like HP for the reasons mentioned in the article and other reasons (blaring WIFI-DIRECT interference from their printers in houses all around me) We bought a Brother a few years ago, because it supported Google Cloud Print. The idea was that my son, who used a Chromebook, would be able to easily print. The problem came when the GCP worked only for a limited time, and then stopped working a few weeks after we got the printer. I was able to set it up to work via a Linux machine and the "cloudprint" daemon, but this was supposed to be _EASY_ and it wasn't. Assuming this was just a problem with GCP, I recommended a Brother to an Apple-using friend who was trying to decide between an HP and a Brother. She uses airprint (I'm not a Mac/iPhone person, so I never tried it). And she has the same problems with the printer just not being found as an airprint device.
- M4v3R 7y ago
  I personally use Canon Pixma series printers. They work really well with AirPrint and are not super expensive.
- m463 7y ago
  I've used brother laser printers, which seem to work without downloading an app or something. We used the current model with USB, but it has ethernet and wifi and I have not analyzed what it tries to do with an active network connection. If I hook that up, I would give it an internal ip with no outside connectivity and see what happens.
  - tomatocracy 7y ago
    I’ve also used a Brother laser for several years now and am happy with it. It doesn’t appear to try to phone home, but it’s on a VLAN with no internet access and limited connectivity to anything local. Even if devices like this are not phoning home, it’s still sensible to put them on their own isolated network (or network segment if you have an L3 capable switch) because the chances are their firmware doesn’t get frequent security patches so they could make a nice ‘beachhead’ within your network.
- 7y ago
sitkack 7y ago
Wouldn’t wire tapping laws apply?
- reaperducer 7y ago
  Maybe not once you "accept" the EULA that you never saw or read.
floki999 7y ago
Are there any open-source telemetry detection tools out there to easily identify this sort of thing?
- mirimir 7y ago
  You can probably log traffic in your router.
arthurcolle 7y ago
What is the best "serious" office printer that doesn't have this kind of malware installed? Ideally that has a bay for multi-page document scanning and can print 100 double sided pages without skipping a beat? Bonus points for reasonably priced ink!
jawns 7y ago
We've been using HP's Instant Ink subscription service for about two years now. Basically, you pay $3 a month and can print up to 50 pages. HP remotely monitors your ink levels and sends you replacement cartridges automatically when the cartridges need to be replaced. We tend to print close to 50 pages a month but have never gone over, so it's not a terrible deal. Obviously, I would prefer to go with lower-cost third-party ink cartridges. But the printer companies tend to be doing more and more to make that a pain. With my last printer, you could use a third-party cartridge, but only after you dissected the original, peeled off its chip, and glued the chip to the new cartridge. And even then, you'd deal with the perpetual warnings about low ink even though you know the new cartridge has plenty of ink. So Instant Ink is something we've done begrudgingly, sort of like buying overpriced movie popcorn. And in order to work correctly, it needs to be able to track how many pages you've printed, and we get occasional alerts when it gets knocked off wifi and can't communicate with home base.
- anewguy9000 7y ago
  i can't tell if this is real
  - dgdas9 7y ago
    https://instantink.hpconnected.com/us/en/l/ https://instantink.hpconnected.com/us/en/l/
- kgwxd 7y ago
  Please stop supporting that. That business model really needs to die.
  - dngray 7y ago
    > Basically, you pay $3 a month and can print up to 50 pages. HP remotely monitors your ink levels and sends you replacement cartridges automatically when the cartridges need to be replaced. Ugh dollar shave club for printers or something? I refuse to engage in thing-as-a-service. The only reason companies do this is because they know if they bleed a little bit out of you each month you're more likely to say "it's only a couple of dollars". It all adds up costing huge amounts in your monthly expenses. They then also know there's a huge portion of customers paying for this who aren't using their '50 sheets', so wow, they've just built a model where customers pay for a thing they don't use and they don't have to provision for. > Please stop supporting that. That business model really needs to die. I would up vote you more than once if I could.
chiefalchemist 7y ago
I don't print much. I bought an HP printer with Instant Ink strictly for the free tier (10 free pages p/m). This privacy issues concern me. That aside, I've been thinking about what is the minimum amount data needed to identify what's being printed. For example, if you knew tbe lenght of the first X words, how many words would be necessary to identify a source? If you added the awareness of periods, how many words? Long to short, it seems to me, simple and basic meta data used wisely could be used as a fingerprint (or sorts) to identify what's being printed without actually needing to capture the actual content.
anotherevan 7y ago
As an aside, I found the opening paragraph amusing and painful in equal measure, given how I've often been treated by relatives because I, "work with computers."
jdkee 7y ago
Give me an old HP 32S calculator or LaserJet III. Not this post Fiorina crap.
WalterBright 7y ago
Guess I might as well keep running my old HP printer which uses a parallel interface.
mehrdadn 7y ago
For anyone else looking to quickly block internet access from their printers (note this is IPv4 only): iptables -t filter -I FORWARD -m mac --mac-source "${macaddr}" \! -d "192.168.0.0/16" -j REJECT Replace 192.168.0.0/16 with your subnet. You may also want to manipulate chains besides FORWARD as necessary.
agumonkey 7y ago
neighbor bought a wifi hp aio printer; 30eur, ink included. They must make money somewhere.. of course.
caf 7y ago
This: I don’t think that “is it OK if we have your printer collect metadata about your devices and what you print, and then use it online advertising?” is a question that HP should even be asking. They already know the answer, and all they’re really doing is giving people who have already paid them several hundred dollars for a cheap but functional printer the opportunity to make a mistake. ...is so true, and HP are far from the only culprits here.
zaroth 7y ago
It needs to be a lot easier to detect this is happening and stop it from happening, in the router. I almost never visit my router's web interface, and when I do it's either to reboot it because it's acting funky, or check if it needs a firmware update. There's just nothing useful there. It's absolutely packed full of totally useless information. And yet such a golden opportunity to provide actually helpful management functionality of all the devices on the network. I'm not saying there aren't good products out there that do this, just sort of lamenting that routers differentiate on the colorful plastic molding instead of actually helping to manage, monitor, speed up, secure, and protect my devices, and when needed, protect me from my devices.
- peteri 7y ago
  Last small office system I ended up using Draytek Vigor ADSL as it had a sensible max device limit, the ISP one would crap out at around 30 MAC addresses. The device management was pretty good and I wish I had the same kit at home (currently using an ISP provider router). https://www.draytek.co.uk/products/business/vigor-2862#screenshots https://www.draytek.co.uk/products/business/vigor-2862#scree...
brokenmachine 7y ago
It's so sad that every company seems to be willing to do shady stuff like this just to grab a couple of extra cents from selling their users out. Technology companies should be leading the way for privacy. You'd think it'd be very bad for business for a company like HP to demonstrate that they don't care about their user's privacy. But they all seem to do dodgy stuff like this, selling people's privacy for cents.
inamberclad 7y ago
The only HP device I own is an oscilloscope from 1994, thankfully.
leonroy 7y ago
This is foolish on HP’s part, not just because of the reputation fall out, but the low value of this data coupled with the massive risk it poses to governmental departments or journalists. We don’t know how the data is being sent or stored nor whether it’s being anonymised sufficiently - if at all. I would say this kind of data snooping is software malfeasance and could really pose a serious risk to individuals and organisations printing sensitive documents on HP printers.
boring_twenties 7y ago
Hmm, the same printer manufacturers that have, despite no laws requiring them to do so, entered into agreements with governments to embed secret identifying information into all produced documents, for decades, are also exfiltrating user data for profit? Truly shocking, I cannot believe they have done this.
- Erlich_Bachman 7y ago
  Don't all printer manufacturers do this?
crb002 7y ago
HP and HPE split. Looks like HP is going to shit.
- jabl 7y ago
  Well, the oldtimers are all saying that HP went to shit when they spun off Agilent (in 1999, per Wikipedia). And the last remnants of ye olde HP engineering culture was trashed when the Compaq vacuum cleaner salespeople took over after the 2002 HP-Compaq merger.
NetOpWibby 7y ago
Nice, more fodder for my “fuck HP” list. I’m just forever bummed about Palm, I adored my Pre.
maz1b 7y ago
What are some good alternatives then? Laser, black and white and one that respects privacy ideally?
Animats 7y ago
What do enterprise firewall operators think of this? They must notice.
fencepost 7y ago
HP lost my respect and recommendations for anything consumer level or that could be consumer level years ago, but I did like their largish printers (M600 series). Maybe not up to the standards of the older business LaserJet printers but still pretty good. The thing that made me decide against HP products was the change on server firmware updates (bios, management controllers, etc) that basically requires an active warranty or service contract for updates. I'm just waiting to see a wormable iLO exploit that's easy to patch... As long as you're a paying HP customer.
- killjoywashere 7y ago
  As a diver, my personal favorite HP-related disaster is documented in Last Breath (1), where a saturation diver was almost killed when they support ship's dynamic positioning system failed. Ultimately, the solution was to reboot all the control computers. You have to pay attention, but they clearly show (I don't think it's an accident or a prop) that they're rebooting HP machines. That had to make somebody in Palo Alto flinch. (1)https://en.wikipedia.org/wiki/Last_Breath_(2019_film) https://en.wikipedia.org/wiki/Last_Breath_(2019_film)
- jabl 7y ago
  > The thing that made me decide against HP products was the change on server firmware updates (bios, management controllers, etc) that basically requires an active warranty or service contract for updates. I'm just waiting to see a wormable iLO exploit that's easy to patch... As long as you're a paying HP customer. LVFS is seeing some success in consumer stuff. I hope it starts to catch on for server gear as well. Then we can start requiring firmware update via LVFS [1] as a hard requirement in RFP's and wave goodbye to these kinds of shenanigans. [1] https://fwupd.org/ https://fwupd.org/ . This uses UEFI Capsule support to distribute and install the updates, similar to what apparently Windows is also doing these days.
b0blee 7y ago
We are doomed.
specialist 7y ago
Would it be feasible to create DIY printer? As in buy or salvage the imaging and paper handling hardware, add your own CPU and software. Or maybe root and reprogram an existing printer, like an OpenWRT for printers.
PeterStuer 7y ago
We have come to the point where 'Informed consent' has become so perverted that it should no longer hold up. Mostof the trickery companies seem to find acceptable obtaining it would be outright frauduleus and clearly a scam in other contexts.
dvfjsdhgfv 7y ago
> But even if you would be perfectly happy to publish all your printing and device data to the entire internet, I’d still argue that it’s a grim world in which HP feels entitled to take it from you. But it's Microsoft who started all this. I remember a few years ago the would politely ask if I want to "send a report" home about a some crash etc. Now they don't bother. You need to bend over backwards to change obscure settings and still can't be sure they don't phone home. Moreover, updates introduce new privacy violations, and people only find it after installing them, so privacy-conscious people have a tough choice. No wonder other companies stopped caring about these things if MS can easily get away with it.
perfunctory 7y ago
Soon, toilet paper will send your stool test back to its manufacturer without you knowing about it.
- tonyedgecombe 7y ago
  https://twitter.com/internetofshit https://twitter.com/internetofshit
sammorrowdrums 7y ago
I elected for HP to gather data in exchange for free ink and up to 15 pages of printing a month for free. They mail me ink. I know I'm selling my data for that ink but TBH I rarely print and it makes it free for me. Instant Ink has really been a positive for me so far, and while at first I was a bit uneasy about data gathering it seems similar (and probably less invasive for my use cases) to using a Google product for example.
jokoon 7y ago
I have this conspiracy theory that the NSA is using US monopolies to spy on the entire world. I mean if you're holding the majority of the computer-related industry when it comes to making the software, it would be a pity to not benefit from it.
teddyh 7y ago
> Tech Enthusiasts: Everything in my house is wired to the Internet of Things! I control it all from my smartphone! My smart-house is bluetooth enabled and I can give it voice commands via alexa! I love the future! > Programmers / Engineers: The most recent piece of technology I own is a printer from 2004 and I keep a loaded gun ready to shoot it if it ever makes an unexpected noise. — https://imgur.com/6wbgy2L https://imgur.com/6wbgy2L
- odiroot 7y ago
  I still have my trusty Brother HL-2270DW, most of its lifetime connected by Ethernet cable. I recently got around to configuring the WiFi and it works. So call me a risk-taker!
  - Uberphallus 7y ago
    Brother printers are amazing. I have a 20 year old laser from them, they stopped selling toner cartridges, at least around here, but toner refills seem to be working fine.
  - JBlue42 7y ago
    lol Same. I think going on a decade now. Have had the wifi working for a while now though.
  - jboles 7y ago
    Agreed, I have an at least 10 year old Brother laser printer and while it doesn’t support any new standard like AirPrint, their iOS app can still print to it across the network, direct from an iPhone/iPad, despite it being made likely before iPhones/iPads could even print.
  - Splognosticus 7y ago
    Another endorsement for Brother printers here. I actually just kind of default to their stuff at this point, because they invariably just do their job with no drama.
- nojvek 7y ago
mr__y 7y ago
I've never expected that airgapping printers will become a real thing
jart 7y ago
HP appears to only want to collect analytics metadata for product decisions, asks permission beforehand, grants the option to turn off telemetry, and are super transparent about exactly what's collected. That sounds reasonable to me. What does this Stripe employee have to gain from scaremongering people about HP? If corporations face unfair backlash for being open about their data policies, they'll just do it in secret.
- unionpivo 7y ago
  My definition of super transparent and yours seem to be different. > If corporations face unfair backlash for being open about their data policies, they'll just do it in secret. Not in EU. (citation not needed, use google) (edit: i do not agree its unfair) They obscured as much as possible while still complying wit the law. Turning it off is also not easy or straightforward as the article explained. HP became one of the biggest in the printer market without their printers collecting so much metadata. I agree with author, this reality where everything snoops on you pisses me off.
- im3w1l 7y ago
  They are legally required to be open about their data policies. The intention of course is to enable discussion like this. If they start collecting data in secret they will be punished for it.
- tomjen3 7y ago
  Collecting data on hardware devices, or anything else people pay money for should never be considered reasonable under any circumstances.
- JohnFen 7y ago
  > If corporations face unfair backlash for being open about their data policies, they'll just do it in secret. That sounds suspiciously close to extortion. "If we tell customers what we're doing and they hate it, let's stop telling them" vs "if we tell customers what we're doing and they hate it, let's stop doing that stuff".
greggman2 7y ago
Gonna rant but other than using 100% open source software what can we do? I think I kind of wish it was illegal to collect data without very explicit opt in and no loss in functionality. (Note: HP apparently asked for permission AFAIK Facebook spies on all Oculus usage. Every app you run on it, how often, even apps not from their store. Even not VR apps. There is a law that a video rental store can not share your rental history. Facebook is going beyond that. Sure they know what apps I bought from their app store but they also know every non Oculus app as well. They aren't sharing it, or maybe they are to "trusted 3rd parties", but to me that's like the video rental store somehow tracking all videos I watch even ones not rented from them. Note that I don't know that Steam and Valve are any better but I absolutely hate the idea that everything I do on my PC (or phone) is tracked. I have no idea if Apple or Microsoft knows I watch ?? hours of video a week or what the names of the files are. Even my TV I have no idea if it reports every network connection back to Sony or that my Apple TV doesn't report similar things to Apple. I feel like I want that kind of collection made illegal as an invasion of privacy with very large fines for non-compliance and I don't feel like my only option should be run nothing but open source software and by open source hardware. ...sigh...
- jstanley 7y ago
  > other than using 100% open source software what can we do? Why is that option not on the table? That is the thing to do.
  - greggman2 7y ago
    Because none of the software I want to run nor hardware I want to run is open source and there are no useful open source alternatives. AFAIK you can't use a Vive or an Oculus without proprietary drivers that spy on you. On top of which all the interesting content is also not open source. I don't actually mind paying for propretary software, especially entertainment software. I just care that now that all computers are networked nearly all software spies on you. Even an honest company is probably using 10, 20, 30 3rd party libraries which might also be spying on you.
aj7 7y ago
Ha ha coincidence. I live in a high rise, so you can pick up about 10 wifi signals. My Brother all-in-one scanned three times last night on its own. I’m turning it off and on manually now.
tr33house 7y ago
HP really lost their way. Now it's all about selling ink and perhaps user data. As a side note, I'm always surprised by how bad printer software still is(even on device). I'd be more than happy to support a startup in this space. HP, Canon etc frustrate customers by their aggressive actions to sell ink eg software updates that made it almost impossible to refill ink
ga-vu 7y ago
No offense, but this guy is overhyping this more than I can stomach. HP is collecting basic telemetry, analytics, and metadata, similar to... let me check... EVERYONE. If you've ever worked in a large company, you'll know that you need that telemetry for debugging, first and foremost. It's almost useless for analytic purposes. Let's be honest here. What advertiser cares about the number of pages you printed on Tuesday. Give me a break.
- ajb 7y ago
  "If you've ever worked in a large company, you'll know that you need that telemetry for debugging, first and foremost." If you worked in a large company before telemetry was available, you know it's actually possible to make a product that works out of the box, rather ship something barely working and use users as unpaid QA testers.
alimbada 7y ago
They're staunch supporters of apartheid in Palestine so this is not surprising. https://www.foa.org.uk/campaign/rebootyourethics/ https://www.foa.org.uk/campaign/rebootyourethics/
rasz 7y ago
go to https://binisoft.org/ https://binisoft.org/ install Windows Firewall Control, set up your whitelist policy, no more spying. This can even stop W10 telemetry.

497 points by darekkay 7y ago

Good to know that the world and Hewlett Packard are just as disgusting as I assume they are. I get called cynical but it’s reality.

raincom 7y ago

That's good for espionage and other activities. Even photo copies leave meta data somewhere; that's how one serial killer got caught, iirc.

__m 7y ago
No it’s fine, HP isn’t a company from Gina, nothing to see here
reaperducer 7y ago
Some printers/photocopiers can be configured to erase their data. For HIPAA reasons we have a Kyocera at work that does this. After each job the display shows "Erasing hard disk data" or something like that as it scrubs the buffer.
- tinus_hn 7y ago
  But how about a printer that just doesn’t have a hard disk? What is it used for anyway?

hyperman1 7y ago

I wonder if, at this point, it isnt easier to write a service that floods all these companies with random made up telemetry. MS/HP/FAANG wants data? Lets bury them in it. We train some AI so it isn't obviously wrong. We start anti tracking lists like the spam blacklists. We se d GDPR requests to find out what sticks. With some luck, their firewalls block us and we're finally getting privacy.

userbinator 7y ago
That's been done already with ads: https://adnauseam.io/ https://adnauseam.io/ I've heard that in practice it does get you on a blacklist and they'll start ignoring what you send, so perhaps it does have some effect.
- yjftsjthsd-h 7y ago
  That's still a win, I suppose.
- drewmol 7y ago
  Point of caution before using adnauseam: I installed and used it on 3 devices for about 6 months a few years ago. I have seen an increase of about 50 fold in the amount of targeted spam phone calls and physical mailers I receive since that time and they've only started to subside in the last year. I can't prove but highly suspect it's a result of my name getting added to a lot of lead DBs as an interested potential customer due to adnauseum ad clicks.
  - rightbyte 7y ago
    You took shots for the team. Keep up the good work! Reading about the tool makes me kinda wanna install it ... that should mess up the targeting profile quite a bit for my ip.

userbinator 7y ago

The bloat in HP printer drivers has been well known for a long time, and I'm not surprised "telemetry" is now part of that. I stopped "upgrading" printers when they still used parallel ports and standard drivers the OS already had (no need to even touch the installation CD), so I don't know if the newer ones can also be used without installing the extra crap. I imagine that a user’s data is exfiltrated back to HP by the printer itself, rather than any client-side software. To me, that's a good reason (among others) to use a print server and plug the printer into it instead of a printer with its own networking; or if you must, keep it behind a firewall with no access to the Internet. Although I have no interest in owning one, I'd be curious to packet-sniff one of these.

reaperducer 7y ago
To me, that's a good reason (among others) to use a print server and plug the printer into it instead of a printer with its own networking That's an excellent idea. I wish I'd thought of it. I have a couple of old Airport Expresses lying around with USB ports on them. I wonder if one of them could be pressed into service in this manner.
- NegativeLatency 7y ago
  I did this, just needed to torrent and install an old version of 10.6 on a VM so I could configure the airport. Raspberry pis also make decent print servers
javajosh 7y ago
Another option is to a) give your printer a static IP (or setup DHCP to assign it's MAC a consistent IP) and b) add a routing rule to not forward packets from that IP. (However, a print server is strictly better if only because you just can't know what such a printer is going to do on your network!)

jeroenhd 7y ago

There was a time that I trusted HP and their products and would recommend their business line to friends and family. This has changed over the years. Crummy software updates (had to install an old version of some Intel tool to get my laptop to sleep in Windows 10) and the crapware they still bundle with Windows has made me take a step back from that position. With this move I'm done with HP. I would have accepted a simple and clear explanation and toggle to send the same information, but this is just too shitty. If anyone from HP is reading this, tell your supervisor that you've just lost another guy-that-everyone-goes-to-for-pc-advice. I hope you're happy.

chiph 7y ago
I gave up on them when the inkjet I had bought produced a small mountain of dried ink inside it with it's constant cleaning cycles. There was more money in that dried ink than I had paid for the printer. This was very a different experience from the monochrome DeskJet 500 that was such a workhorse. And the 7470A plotter that dad used for over a decade.
- imglorp 7y ago
  If you don't need color, try a laser printer. Toner doesn't dry out; you only pay for what you actually print.
  - ars 7y ago
    Get a laser printer EVEN if you need color. Color laser printers are slow, but not expensive.
  - chiph 7y ago
    That's what I did. Got a Brother HL-5370DW and it's been excellent.
    - zrobotics 7y ago
      Second this- the really great thing about the brother lasers is awesome Linux driver support. The install process was simpler on Debian than even the windows setup, which is certainly not the case for HP gear (hplip, the less I think about it the happier I am).

tempguy9999 7y ago

My epson printer specifically says this when you install the driver. At least they're being upfront. I don't like it but I don't know how to disable it and don't have the time to look into it. Arguably much worse than all this is the yellow dots tracking on some colour printers https://www.eff.org/deeplinks/2008/10/effs-yellow-dots-mystery-instructables https://www.eff.org/deeplinks/2008/10/effs-yellow-dots-myste...

OrgNet 7y ago
> I don't like it but I don't know how to disable it and don't have the time to look into it. They know that almost nobody does, so they bank on it... it needs to be regulated.

vbezhenar 7y ago

It's good that I never trust printers to print my master passwords and just write them by hand. At least my pencil does not send anything yet...

wolco 7y ago
HP pencils record arm movement and the eraser has a wireless transmittor.

rgrieselhuber 7y ago

Sounds like we need the Raspberry Pi of printers.

imglorp 7y ago
I was just thinking more like using a raspberry pi for a home print server. 1. Load up the Pi with Cups, which has a web interface, and all the optional drivers and fonts it needs. 2. make sure ip_forward is off 3. set all your printers to use your Pi as their default network gateway 4. profit?
- edoceo 7y ago
  I do this but, I've missed step 4. There is a little more to the cups config but it "just works" (if you know cups well)

snthd 7y ago

Are HP doing this in GDPR-covered territory? Possibly the requirement to download stuff is so they can geo-target?

neilv 7y ago

When I got a modern LaserJet at home (my LJ5 lasted forever), I intentionally got one with Ethernet, and without WiFi. But all the cloud-y firmware features of the new LaserJet looked so sketchy, I decided not to connect the printer's Ethernet to my LAN. Instead, I set up a separate little print server, which connects to the printer's USB. Of course there are still vulnerabilities, but at least now it's not as overtly sketchy.

mirimir 7y ago
Couldn't you just drop Internet-bound packets in your router? But yeah, USB is good enough for printers.
- neilv 7y ago
  Yes, and I could additionally filter the permitted traffic to/from the expected TCP port(s) and directions for each. But my current home routers are OpenWrt, tend to get reflashed, occasionally lose their configs various ways, and aren't documented as well as one would like, so I try not to add much complexity there. A little print server either works, or it fails conspicuously (unlike rules on my plastic router, which are most likely to fail silently). If I ever get time to build a bit different router (e.g., pfSense or atop a normal Linux distro), I'll revisit that.
  - mirimir 7y ago
    I found pfSense far easier to setup than OpenWrt. I've been running it on an Atom desktop for about seven years. I've updated more or less annually, and have only needed to tweak the configuration when I've moved.
    - neilv 7y ago
      Good to hear that's worked well. Looks like there's now some Atoms with AES-NI, for future pfSense support.
      - 7y ago

drewg123 7y ago

What is a good low-end laser printer or multi-function device to recommend to non-technical friends that "just works" ? I don't like HP for the reasons mentioned in the article and other reasons (blaring WIFI-DIRECT interference from their printers in houses all around me) We bought a Brother a few years ago, because it supported Google Cloud Print. The idea was that my son, who used a Chromebook, would be able to easily print. The problem came when the GCP worked only for a limited time, and then stopped working a few weeks after we got the printer. I was able to set it up to work via a Linux machine and the "cloudprint" daemon, but this was supposed to be _EASY_ and it wasn't. Assuming this was just a problem with GCP, I recommended a Brother to an Apple-using friend who was trying to decide between an HP and a Brother. She uses airprint (I'm not a Mac/iPhone person, so I never tried it). And she has the same problems with the printer just not being found as an airprint device.

M4v3R 7y ago
I personally use Canon Pixma series printers. They work really well with AirPrint and are not super expensive.
m463 7y ago
I've used brother laser printers, which seem to work without downloading an app or something. We used the current model with USB, but it has ethernet and wifi and I have not analyzed what it tries to do with an active network connection. If I hook that up, I would give it an internal ip with no outside connectivity and see what happens.
- tomatocracy 7y ago
  I’ve also used a Brother laser for several years now and am happy with it. It doesn’t appear to try to phone home, but it’s on a VLAN with no internet access and limited connectivity to anything local. Even if devices like this are not phoning home, it’s still sensible to put them on their own isolated network (or network segment if you have an L3 capable switch) because the chances are their firmware doesn’t get frequent security patches so they could make a nice ‘beachhead’ within your network.
7y ago

sitkack 7y ago

Wouldn’t wire tapping laws apply?

reaperducer 7y ago
Maybe not once you "accept" the EULA that you never saw or read.

floki999 7y ago

Are there any open-source telemetry detection tools out there to easily identify this sort of thing?

mirimir 7y ago
You can probably log traffic in your router.

arthurcolle 7y ago

What is the best "serious" office printer that doesn't have this kind of malware installed? Ideally that has a bay for multi-page document scanning and can print 100 double sided pages without skipping a beat? Bonus points for reasonably priced ink!

jawns 7y ago

We've been using HP's Instant Ink subscription service for about two years now. Basically, you pay $3 a month and can print up to 50 pages. HP remotely monitors your ink levels and sends you replacement cartridges automatically when the cartridges need to be replaced. We tend to print close to 50 pages a month but have never gone over, so it's not a terrible deal. Obviously, I would prefer to go with lower-cost third-party ink cartridges. But the printer companies tend to be doing more and more to make that a pain. With my last printer, you could use a third-party cartridge, but only after you dissected the original, peeled off its chip, and glued the chip to the new cartridge. And even then, you'd deal with the perpetual warnings about low ink even though you know the new cartridge has plenty of ink. So Instant Ink is something we've done begrudgingly, sort of like buying overpriced movie popcorn. And in order to work correctly, it needs to be able to track how many pages you've printed, and we get occasional alerts when it gets knocked off wifi and can't communicate with home base.

anewguy9000 7y ago
i can't tell if this is real
- dgdas9 7y ago
  https://instantink.hpconnected.com/us/en/l/ https://instantink.hpconnected.com/us/en/l/
kgwxd 7y ago
Please stop supporting that. That business model really needs to die.
- dngray 7y ago
  > Basically, you pay $3 a month and can print up to 50 pages. HP remotely monitors your ink levels and sends you replacement cartridges automatically when the cartridges need to be replaced. Ugh dollar shave club for printers or something? I refuse to engage in thing-as-a-service. The only reason companies do this is because they know if they bleed a little bit out of you each month you're more likely to say "it's only a couple of dollars". It all adds up costing huge amounts in your monthly expenses. They then also know there's a huge portion of customers paying for this who aren't using their '50 sheets', so wow, they've just built a model where customers pay for a thing they don't use and they don't have to provision for. > Please stop supporting that. That business model really needs to die. I would up vote you more than once if I could.

chiefalchemist 7y ago

I don't print much. I bought an HP printer with Instant Ink strictly for the free tier (10 free pages p/m). This privacy issues concern me. That aside, I've been thinking about what is the minimum amount data needed to identify what's being printed. For example, if you knew tbe lenght of the first X words, how many words would be necessary to identify a source? If you added the awareness of periods, how many words? Long to short, it seems to me, simple and basic meta data used wisely could be used as a fingerprint (or sorts) to identify what's being printed without actually needing to capture the actual content.

anotherevan 7y ago

As an aside, I found the opening paragraph amusing and painful in equal measure, given how I've often been treated by relatives because I, "work with computers."

jdkee 7y ago

Give me an old HP 32S calculator or LaserJet III. Not this post Fiorina crap.

WalterBright 7y ago

Guess I might as well keep running my old HP printer which uses a parallel interface.

mehrdadn 7y ago

For anyone else looking to quickly block internet access from their printers (note this is IPv4 only): iptables -t filter -I FORWARD -m mac --mac-source "${macaddr}" \! -d "192.168.0.0/16" -j REJECT Replace 192.168.0.0/16 with your subnet. You may also want to manipulate chains besides FORWARD as necessary.

agumonkey 7y ago

neighbor bought a wifi hp aio printer; 30eur, ink included. They must make money somewhere.. of course.

caf 7y ago

This: I don’t think that “is it OK if we have your printer collect metadata about your devices and what you print, and then use it online advertising?” is a question that HP should even be asking. They already know the answer, and all they’re really doing is giving people who have already paid them several hundred dollars for a cheap but functional printer the opportunity to make a mistake. ...is so true, and HP are far from the only culprits here.

zaroth 7y ago

It needs to be a lot easier to detect this is happening and stop it from happening, in the router. I almost never visit my router's web interface, and when I do it's either to reboot it because it's acting funky, or check if it needs a firmware update. There's just nothing useful there. It's absolutely packed full of totally useless information. And yet such a golden opportunity to provide actually helpful management functionality of all the devices on the network. I'm not saying there aren't good products out there that do this, just sort of lamenting that routers differentiate on the colorful plastic molding instead of actually helping to manage, monitor, speed up, secure, and protect my devices, and when needed, protect me from my devices.

peteri 7y ago
Last small office system I ended up using Draytek Vigor ADSL as it had a sensible max device limit, the ISP one would crap out at around 30 MAC addresses. The device management was pretty good and I wish I had the same kit at home (currently using an ISP provider router). https://www.draytek.co.uk/products/business/vigor-2862#screenshots https://www.draytek.co.uk/products/business/vigor-2862#scree...

brokenmachine 7y ago

It's so sad that every company seems to be willing to do shady stuff like this just to grab a couple of extra cents from selling their users out. Technology companies should be leading the way for privacy. You'd think it'd be very bad for business for a company like HP to demonstrate that they don't care about their user's privacy. But they all seem to do dodgy stuff like this, selling people's privacy for cents.

inamberclad 7y ago

The only HP device I own is an oscilloscope from 1994, thankfully.

leonroy 7y ago

This is foolish on HP’s part, not just because of the reputation fall out, but the low value of this data coupled with the massive risk it poses to governmental departments or journalists. We don’t know how the data is being sent or stored nor whether it’s being anonymised sufficiently - if at all. I would say this kind of data snooping is software malfeasance and could really pose a serious risk to individuals and organisations printing sensitive documents on HP printers.

boring_twenties 7y ago

Hmm, the same printer manufacturers that have, despite no laws requiring them to do so, entered into agreements with governments to embed secret identifying information into all produced documents, for decades, are also exfiltrating user data for profit? Truly shocking, I cannot believe they have done this.

Erlich_Bachman 7y ago
Don't all printer manufacturers do this?

crb002 7y ago

HP and HPE split. Looks like HP is going to shit.

jabl 7y ago
Well, the oldtimers are all saying that HP went to shit when they spun off Agilent (in 1999, per Wikipedia). And the last remnants of ye olde HP engineering culture was trashed when the Compaq vacuum cleaner salespeople took over after the 2002 HP-Compaq merger.

NetOpWibby 7y ago

Nice, more fodder for my “fuck HP” list. I’m just forever bummed about Palm, I adored my Pre.

maz1b 7y ago

What are some good alternatives then? Laser, black and white and one that respects privacy ideally?

Animats 7y ago

What do enterprise firewall operators think of this? They must notice.

fencepost 7y ago

HP lost my respect and recommendations for anything consumer level or that could be consumer level years ago, but I did like their largish printers (M600 series). Maybe not up to the standards of the older business LaserJet printers but still pretty good. The thing that made me decide against HP products was the change on server firmware updates (bios, management controllers, etc) that basically requires an active warranty or service contract for updates. I'm just waiting to see a wormable iLO exploit that's easy to patch... As long as you're a paying HP customer.

killjoywashere 7y ago
As a diver, my personal favorite HP-related disaster is documented in Last Breath (1), where a saturation diver was almost killed when they support ship's dynamic positioning system failed. Ultimately, the solution was to reboot all the control computers. You have to pay attention, but they clearly show (I don't think it's an accident or a prop) that they're rebooting HP machines. That had to make somebody in Palo Alto flinch. (1)https://en.wikipedia.org/wiki/Last_Breath_(2019_film) https://en.wikipedia.org/wiki/Last_Breath_(2019_film)
jabl 7y ago
> The thing that made me decide against HP products was the change on server firmware updates (bios, management controllers, etc) that basically requires an active warranty or service contract for updates. I'm just waiting to see a wormable iLO exploit that's easy to patch... As long as you're a paying HP customer. LVFS is seeing some success in consumer stuff. I hope it starts to catch on for server gear as well. Then we can start requiring firmware update via LVFS [1] as a hard requirement in RFP's and wave goodbye to these kinds of shenanigans. [1] https://fwupd.org/ https://fwupd.org/ . This uses UEFI Capsule support to distribute and install the updates, similar to what apparently Windows is also doing these days.

b0blee 7y ago

We are doomed.

specialist 7y ago

Would it be feasible to create DIY printer? As in buy or salvage the imaging and paper handling hardware, add your own CPU and software. Or maybe root and reprogram an existing printer, like an OpenWRT for printers.

PeterStuer 7y ago

We have come to the point where 'Informed consent' has become so perverted that it should no longer hold up. Mostof the trickery companies seem to find acceptable obtaining it would be outright frauduleus and clearly a scam in other contexts.

dvfjsdhgfv 7y ago

> But even if you would be perfectly happy to publish all your printing and device data to the entire internet, I’d still argue that it’s a grim world in which HP feels entitled to take it from you. But it's Microsoft who started all this. I remember a few years ago the would politely ask if I want to "send a report" home about a some crash etc. Now they don't bother. You need to bend over backwards to change obscure settings and still can't be sure they don't phone home. Moreover, updates introduce new privacy violations, and people only find it after installing them, so privacy-conscious people have a tough choice. No wonder other companies stopped caring about these things if MS can easily get away with it.

perfunctory 7y ago

Soon, toilet paper will send your stool test back to its manufacturer without you knowing about it.

tonyedgecombe 7y ago
https://twitter.com/internetofshit https://twitter.com/internetofshit

sammorrowdrums 7y ago

I elected for HP to gather data in exchange for free ink and up to 15 pages of printing a month for free. They mail me ink. I know I'm selling my data for that ink but TBH I rarely print and it makes it free for me. Instant Ink has really been a positive for me so far, and while at first I was a bit uneasy about data gathering it seems similar (and probably less invasive for my use cases) to using a Google product for example.

jokoon 7y ago

I have this conspiracy theory that the NSA is using US monopolies to spy on the entire world. I mean if you're holding the majority of the computer-related industry when it comes to making the software, it would be a pity to not benefit from it.

teddyh 7y ago

> Tech Enthusiasts: Everything in my house is wired to the Internet of Things! I control it all from my smartphone! My smart-house is bluetooth enabled and I can give it voice commands via alexa! I love the future! > Programmers / Engineers: The most recent piece of technology I own is a printer from 2004 and I keep a loaded gun ready to shoot it if it ever makes an unexpected noise. — https://imgur.com/6wbgy2L https://imgur.com/6wbgy2L

odiroot 7y ago
I still have my trusty Brother HL-2270DW, most of its lifetime connected by Ethernet cable. I recently got around to configuring the WiFi and it works. So call me a risk-taker!
- Uberphallus 7y ago
  Brother printers are amazing. I have a 20 year old laser from them, they stopped selling toner cartridges, at least around here, but toner refills seem to be working fine.
- JBlue42 7y ago
  lol Same. I think going on a decade now. Have had the wifi working for a while now though.
- jboles 7y ago
  Agreed, I have an at least 10 year old Brother laser printer and while it doesn’t support any new standard like AirPrint, their iOS app can still print to it across the network, direct from an iPhone/iPad, despite it being made likely before iPhones/iPads could even print.
- Splognosticus 7y ago
  Another endorsement for Brother printers here. I actually just kind of default to their stuff at this point, because they invariably just do their job with no drama.
nojvek 7y ago

mr__y 7y ago

I've never expected that airgapping printers will become a real thing

jart 7y ago

HP appears to only want to collect analytics metadata for product decisions, asks permission beforehand, grants the option to turn off telemetry, and are super transparent about exactly what's collected. That sounds reasonable to me. What does this Stripe employee have to gain from scaremongering people about HP? If corporations face unfair backlash for being open about their data policies, they'll just do it in secret.

unionpivo 7y ago
My definition of super transparent and yours seem to be different. > If corporations face unfair backlash for being open about their data policies, they'll just do it in secret. Not in EU. (citation not needed, use google) (edit: i do not agree its unfair) They obscured as much as possible while still complying wit the law. Turning it off is also not easy or straightforward as the article explained. HP became one of the biggest in the printer market without their printers collecting so much metadata. I agree with author, this reality where everything snoops on you pisses me off.
im3w1l 7y ago
They are legally required to be open about their data policies. The intention of course is to enable discussion like this. If they start collecting data in secret they will be punished for it.
tomjen3 7y ago
Collecting data on hardware devices, or anything else people pay money for should never be considered reasonable under any circumstances.
JohnFen 7y ago
> If corporations face unfair backlash for being open about their data policies, they'll just do it in secret. That sounds suspiciously close to extortion. "If we tell customers what we're doing and they hate it, let's stop telling them" vs "if we tell customers what we're doing and they hate it, let's stop doing that stuff".

greggman2 7y ago

Gonna rant but other than using 100% open source software what can we do? I think I kind of wish it was illegal to collect data without very explicit opt in and no loss in functionality. (Note: HP apparently asked for permission AFAIK Facebook spies on all Oculus usage. Every app you run on it, how often, even apps not from their store. Even not VR apps. There is a law that a video rental store can not share your rental history. Facebook is going beyond that. Sure they know what apps I bought from their app store but they also know every non Oculus app as well. They aren't sharing it, or maybe they are to "trusted 3rd parties", but to me that's like the video rental store somehow tracking all videos I watch even ones not rented from them. Note that I don't know that Steam and Valve are any better but I absolutely hate the idea that everything I do on my PC (or phone) is tracked. I have no idea if Apple or Microsoft knows I watch ?? hours of video a week or what the names of the files are. Even my TV I have no idea if it reports every network connection back to Sony or that my Apple TV doesn't report similar things to Apple. I feel like I want that kind of collection made illegal as an invasion of privacy with very large fines for non-compliance and I don't feel like my only option should be run nothing but open source software and by open source hardware. ...sigh...

jstanley 7y ago
> other than using 100% open source software what can we do? Why is that option not on the table? That is the thing to do.
- greggman2 7y ago
  Because none of the software I want to run nor hardware I want to run is open source and there are no useful open source alternatives. AFAIK you can't use a Vive or an Oculus without proprietary drivers that spy on you. On top of which all the interesting content is also not open source. I don't actually mind paying for propretary software, especially entertainment software. I just care that now that all computers are networked nearly all software spies on you. Even an honest company is probably using 10, 20, 30 3rd party libraries which might also be spying on you.

aj7 7y ago

Ha ha coincidence. I live in a high rise, so you can pick up about 10 wifi signals. My Brother all-in-one scanned three times last night on its own. I’m turning it off and on manually now.

tr33house 7y ago

HP really lost their way. Now it's all about selling ink and perhaps user data. As a side note, I'm always surprised by how bad printer software still is(even on device). I'd be more than happy to support a startup in this space. HP, Canon etc frustrate customers by their aggressive actions to sell ink eg software updates that made it almost impossible to refill ink

ga-vu 7y ago

No offense, but this guy is overhyping this more than I can stomach. HP is collecting basic telemetry, analytics, and metadata, similar to... let me check... EVERYONE. If you've ever worked in a large company, you'll know that you need that telemetry for debugging, first and foremost. It's almost useless for analytic purposes. Let's be honest here. What advertiser cares about the number of pages you printed on Tuesday. Give me a break.

ajb 7y ago
"If you've ever worked in a large company, you'll know that you need that telemetry for debugging, first and foremost." If you worked in a large company before telemetry was available, you know it's actually possible to make a product that works out of the box, rather ship something barely working and use users as unpaid QA testers.

alimbada 7y ago

They're staunch supporters of apartheid in Palestine so this is not surprising. https://www.foa.org.uk/campaign/rebootyourethics/ https://www.foa.org.uk/campaign/rebootyourethics/

rasz 7y ago

go to https://binisoft.org/ https://binisoft.org/ install Windows Firewall Control, set up your whitelist policy, no more spying. This can even stop W10 telemetry.