3 ms·
While I’m opposed to companies trying to extract “telemetry” data like they own it, I think most responses in this thread are overreacting. The equipment phone
by 8fingerlouie 7y ago
While I’m opposed to companies trying to extract “telemetry” data like they own it, I think most responses in this thread are overreacting.
The equipment phones home, but realistically what can it transmit ? Things like number of devices connected, IP scope, network neighbors, public IP, MAC addresses, and of course the traffic itself.
I think it’s safe to assume that it’s not sending the traffic, as we’d have noticed on the firewall egress.
Public IP and MAC addresses are bad, and probably conflicting with the GDPR as these can be used to identify you, especially if coupled with your account. As UBNT states in the comments, they claim to be GDPR compliant, with data anonymizes, so we can assume they’re not gathering these as well.
That leaves device statistics, such as clients connected, memory/cpu used, private IP ranges. Are those really that bad ?
UBNT also states there is no penalty for blocking these devices from contacting the internet, and while I would prefer an opt-in solution, it’s no worse than when Microsoft invented “opt out by renaming your WiFi or we share your password with friends of friends”
- wutanc 7y agoGiven that they've commented on the fact that all traffic is end-to-end encrypted you'd not notice them sending things you don't want to be send. Maybe they're sending a list of all sites you visits? How about them sending any login information that you add on sites that for whatever reason isn't doing tls? One important point here is that they "claim" to be GDPR compliant but are already somewhat breaking GDPR. All data is encrypted on the APs so we can't really know what is sent. This is a complete buy in in trust from us, the customers. We're supposed to trust them that they're not sending anything they shouldn't, even tho they selected not to tell us at all about them implementing this. It's horribly sketchy at best, if ont illegal.
- 8fingerlouie 7y agoI would certainly have preferred to be informed beforehand, as well as opting in, and the whole "oh by the way, we do this now, and we only tell you because someone discovered it" approach is extremely sketchy. That is of course assuming that the GDPR is being honoured, and that's a pretty big if. Most european companies are still struggling to be compliant, as _EVERYTHING_ that can identify you as an individual is to be handled. It also includes backups, and also when the authorities requires you to store data for 5-15 years, but also allows the right to be forgotten. I know we've had our fun devising a scheme to delete records from archived backups. The only way to check is to request your personal data from UBNT. The GDPR allows this free of charge, and they're obligated to hand over all personal information they have on you. In any case, I already block all internet access for networking equipment, and based on this I added trace.svc.ui.com to PFBlockerNG, just to make it resolve to something local.
- wutanc 7y agoYeah, all this screams sketchy sadly. I know first hand how hard it is to get GDPR right, I've been extensivly involved in updating systems to comply. It's a lot of hard work and talking back and forth with lawyers to make sure we don't do anything stupid.
- wutanc 7y agoAlso worth nothing that they originally had a bug where the APs would crash if you did actually block this data from being sent.
- Silhouette 7y agoThe equipment phones home, but realistically what can it transmit ? It doesn't matter. That's the point. If you're at all serious about privacy and security, any unauthorised exfiltration of data from your system is a problem.