21 ms·

Xiaomi Recording ‘Private’ Web and Phone Use

526 points by rock_artist 6y ago

mikestew 6y ago
There's too much to quote, but scroll down to Xiamoi's responses. Man, that is the quintessential example of gaslighting. "No we didn't, that's not true at all. Well, we kinda did, but it's 'anonymized', so it's okay." "But we have video of your device sending data to..." "...but, but, anonymized!" "I thought you said you weren't sending data at all, now it's just anonymized browser data, but we see your devices sending device usage outside the brows..." "ANONYMIZED!!!!11"
- 0xy 6y ago
  There's no such thing as anonymized when it comes to data tracking. "Anonymized" tracking itself is gaslighting.
  - nicbou 6y ago
    It's anonymized in the sense that you don't know who it will be sold to and what they will do with it. In all seriousness, this is a point GDPR struggles with. It's really hard to properly define what constitutes personal data.
    - tjoff 6y ago
      Personally Identifiable information is data that can be used to identify a person with reasonable effort (getting a warrant is not reasonable for instance). The same data can be both PII and not PII depending on the context. Not sure what the struggle is?
    - bostik 6y ago
      Disclosure: I'm writing this with my DPO hat on. The GDPR does specify what is personal data, but doesn't go out giving real-life interpretation examples. The categories given in the regulation are direct identifiers and indirect identifiers. The categories even include a good sampling of information types that belong in each. Direct allows to identify an individual or a very small group from a single datapoint. Indirect allows to identify larger groups. Or to put in terms most of us here understand.. Direct identifiers are personal information that would allow to send marketing junk to selected individuals. Indirect ones are those you would use to build marketing cohorts. So if it's data your marketing department would like to grab, you can bet it's personal information under GDPR.
    - coribuci 6y ago
      > It's anonymized in the sense that you don't know who it will be sold to and what they will do with it. So "It's anonymized" but It's not anonymized. > In all seriousness, this is a point GDPR struggles with. It's really hard to properly define what constitutes personal data. GDPR is good. The problem is that GDPR is not enforced because it might upset Uncle Sam
- thefounder 6y ago
  Rome was not built in a day! They need time to aquire the sophistication of the US data brokers.
  - cik 6y ago
    And yet the empire was brought down from within...
schoolornot 6y ago
I recently wiped my factory-unlocked Samsung S20, enabled debug mode, and ran "pm list packages" over ADB. The results were beyond startling. There were close to 100 packages running under com.samsung and other various namespaces with tons of sensitive permissions. Most of these processes I could not identify what they existed for. And I still can't figure out why a freshly wiped unlocked phone w/ a Sprint SIM is running a Verizon provisioning process. I do not trust any of these Android manufacturers to do right by people. Even the Pixel phones have a "Support" application that has camera permissions -- which last I checked, couldn't be changed regardless of whether you need support or not. What's going to happen when some obscure team within Google pushes an update to this app to do something without user approval?
- 101404 6y ago
  I wonder if it is illegal under GDPR to include spying apps on phones without telling the user.
  - nicbou 6y ago
    It most certainly is.
  - pacamara619 6y ago
    It is, there is no doubt about that.
  - Nextgrid 6y ago
    The question of the GDPR is not whether it's illegal but whether anything is done to crack down on offenders. Facebook, Google and thousands of marketing/analytics/advertising companies are still around and are stalking users with total disregard of the GDPR, so that's a clear negative.
    - tgsovlerkhgsel 6y ago
      Would someone who is downvoting this be willing to explain why? Because I have the same impression (that many GDPR rules are simply being ignored because enforcement is lacking).
throwaway9587 6y ago
Before you go shaming those bad, bad Chinese companies, imagine my surprise when I restored my Apple iPhone from iCloud only to find my (always set to private!) Safari back there with every tab I ever opened.
- gruez 6y ago
  It's entirely possible to implement that behavior in a privacy preserving way. Just encrypt "sensitive" data with a key that's stored on the secure element. That way if you restore to the same device, you get everything back. Sadly, I don't feel like wiping my phone to test this out, so whether Apple actually does that is an open question at this point.
  - deleted 6y ago
    [deleted]
- coolspot 6y ago
  Your backup is encrypted https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
  - centimeter 6y ago
    That chart from Apple is quite misleading. Apple abandoned full strong encryption for iCloud data, apparently due to pressure from the US Government. https://9to5mac.com/2020/01/21/apple-reportedly-abandoned-end-to-end-icloud/ https://9to5mac.com/2020/01/21/apple-reportedly-abandoned-en... Only the things under "End-to-end encrypted data" are actually encrypted in a meaningful way - everything else just sits on servers that use disk encryption, but that fails to defend from 99% of realistic attack scenarios. A lot of content - including photos (which I used to use to take pictures of sensitive personal data, like ID cards) - is not meaningfully encrypted. Thankfully, Safari tab data is actually encrypted as of iOS 13. While Apple has done a good job of protecting user privacy compared to the alternatives, they still have a lot of work to do before we can accurately say things like "iCloud backups are encrypted".
- 6y ago
bottled_poe 6y ago
This is surprising? I thought this was a feature.
- gruez 6y ago
  >I thought this was a feature. ??? In what way does this benefit the user?
  - eanzenberg 6y ago
    Give my data to the glorious red state, for the greater good of the people!
  - Hnrobert42 6y ago
    Improved user experience. /s
qppo 6y ago
The fucking huevos on Forbes to publish this article alongside the most godawful CCPA opt-out flow I've seen yet... Clicking the "do not sell my info" link takes you to a page where it asks you for your personal information to request to opt out... with the fine print telling you that you can actually opt out by going back to the previous dialog, selecting more info, then selecting one of the three cookie sections (which is not labeled "do not sell my info" or anything similar). There's then a timer where it takes about a minute to update the cookie preferences. I know Forbes has turned into a glorified blogging site for "journalists" these days but come on. Talking about privacy and misleading information on the same site that makes you jump through hoops to remain anonymous while browsing? Pot calling the kettle black much.
- cambalache 6y ago
  If you are a native English speaker kudos for writing "huevos" and not "Cahones" or other of its similar cringy misspellings. But 90% chance you are from the south cone so carry on.
  - ebg13 6y ago
    https://www.merriam-webster.com/dictionary/cojones https://www.merriam-webster.com/dictionary/cojones ?
  - ficklepickle 6y ago
    To be fair, they both appear on the wikipedia page for Spanish profanity[0]. [0] https://en.wikipedia.org/wiki/Spanish_profanity#References_to_the_male_genitalia https://en.wikipedia.org/wiki/Spanish_profanity#References_t...
    - cambalache 6y ago
      You misunderstood, it is not the word "cojones" I was mocking, just the hilarious misspeling some people use, I have seen "Cohones","Cahones", "Koojonehs" and so on
  - maximente 6y ago
ptx 6y ago
How does Windows 10 compare? It also tracks and reports which websites you visit, but maybe it doesn't in private browsing mode? Edit: People asking for sources, go to Settings -> Diagnostics & Feedback. See the part where it says "Send ... info about websites you browse"? You might also be interested in the setting below it; when you enable it "Microsoft will collect samples of the content you type"[1]. [1] https://support.microsoft.com/en-us/help/4468236/ https://support.microsoft.com/en-us/help/4468236/
- gruez 6y ago
  >anti-china thread >whataboutism reply defending china/chinese company color me surprised
  - myopenid 6y ago
    What's wrong with that?
- ChuckNorris89 6y ago
  Source?
- drevil-v2 6y ago
  Citation needed. The device telemetry does not include browsing history.
  - ptx 6y ago
    Citation needed. Microsoft's documentation says it includes "information about the websites you browse". It also says that "data items collected in Windows diagnostics are subject to change to give Microsoft flexibility to collect the data needed", so even if they aren't collecting that data today, they reserve the right to take whatever they want whenever they feel like it.
thoraway1010 6y ago
I know apple keeps on getting headlines for breaking privacy (and also making phones that supposedly get thrown away because they don't have right to repair) My own sense is android phones are MUCH less private and secure AND have much shorter useful lives.
- edoceo 6y ago
  But maybe easier to load a custom rom?
- LeoPanthera 6y ago
  > I know apple keeps on getting headlines for breaking privacy Seems like they're mostly in the news for the exact opposite.
mbdesign 6y ago
On a Xiaomi device myself. Recently I've setup Nextdns.io to resolve all the DNS requests through it. Very frequent callbacks to Xiaomi servers for tracking. Blocked a bunch of them now, but it's half a solution.
- xiii1408 6y ago
  Other than the tracking, would you recommend it? Is LineageOS available? I've been curious about trying a Chinese phone for a while, but would only do it if Lineage is available, since I'm annoyed by anything more busy than stock Android.
  - deleted 6y ago
    [deleted]
  - yorwba 6y ago
    LineageOS supports a lot of different Xiaomi devices: https://wiki.lineageos.org/devices/#xiaomi https://wiki.lineageos.org/devices/#xiaomi I have a tissot with LineageOS 16.0, not sure yet whether it will get 17 ported to it as well. The hardware is great for the price (bought it a year after launch, heavily discounted). I bought it specifically to run LineageOS on it, so I have no idea what the stock experience is like.
    - tiii 6y ago
      Official tissot support was dropped this month. No more security updates. https://forum.xda-developers.com/showpost.php?p=82234015&postcount=2243 https://forum.xda-developers.com/showpost.php?p=82234015&pos...
      - yorwba 6y ago
        Thanks for the heads-up. I guess I'll have to flee to a different ROM, then.
  - searchableguy 6y ago
    Yeah. I am using cdroid android v10(based on lineage). Last update was this month. Running it for 2 years now.
TLightful 6y ago
For those more expert than I, is Apple any better in this regard? If not, which mobile is ideal?
- centimeter 6y ago
  > is Apple any better in this regard Yes
- djrogers 6y ago
  > For those more expert than I, is Apple any better in this regard? Yes, and unequivocally so. Apple is not know to track browsing behavior, search terms, etc. Most of the data that your phone collects about you either remains in your phone (that’s why they’ve been shipping with NPUs for several years - they do A lot of machine learning in device rather than in-cloud) or is analyzed using differential privacy mechanisms. The amount of data that Apple refuses to collect in Apple Maps for example is astounding. Start and end points of any journey are not used for example. Your trip is broken up into a bunch of segments, and only the middle ones are analyzed for traffic pattern, and even then only after being anonymized. And most of the details behind all of this are published in a well written and frequently updated privacy whitepapers. [1] https://www.apple.com/privacy/features/ https://www.apple.com/privacy/features/
  - izacus 6y ago
    You ignored iCloud though, which isn't E2E reencode and uploads personal photos, contacts, location and some other data to Apple. They can decrypt this data and regularly share it with the governments. So your post is kinda misleading when you leave these details out - it creates a false sense of safety. (And before someone complains: Yes, Apple is infinitely better at privacy than Xiaomi. We still shouldn't hide privacy risks though.)
    - foxrider 6y ago
      However, there is an elephant in the room - any Xiaomi device can unlock its bootloader, and the flash an open firmware, like LOS. This instantly makes it much better than Apple phones or any phones on the market - you can even ignore google software. With Apple you cant even run apps that haven't gotten through Apple censors, and the closest you can get to owning your hardware is "jailbreaking" it.
cmoscoso 6y ago
I think they call it backup.
amiga-workbench 6y ago
Stuff like this is why without fail, every phone I own gets LineageOS installed immediately. Xiaomi phones have a bootloader unlock timer to try and mitigate sites reselling their phones with modified software, so I had to leave my Mix 2s alone for a few days before I could make it safe to use.
- fastball 6y ago
  This is why, without fail, I buy iPhones.
  - amiga-workbench 6y ago
    With the Bootloader exploit on iPhone X and older, its actually worth looking at them now.
    - fastball 6y ago
      Checkm8 is a tethered exploit, so probably not super useful if you want to sideload another OS and not have a bad time.
      - Nextgrid 6y ago
        I remember back in the days of the iPhone 3G(s?) there was an attempt at a battery-powered dongle that could re-jailbreak a phone in the field in case of a reboot. The same technology could be built into a battery case or similar, not to mention recent technological advances mean it can be done in a small package the size of a Lightning connector or a Yubikey and you can carry it on your keyring.
        ThatPlayer 6y ago
        There's a similar product for Nintendo Switch jailbreaking: NS-Atmosphere or RCMLoader. Since it's a bigger device, some of them are soldered internally using a Trinket M0
        6y ago
zaro 6y ago
“It’s a lot worse than any of the mainstream browsers I have seen,” It's a lot worse than Chrome ? The Xiaomi browser tracks your browsing. The Google browser in combination with the most of the sites in the internet track your browsing, your location, and a lot of other things. Choosing the lesser evil is quite popular now days, and it's obvious which one it is.
- Tijdreiziger 6y ago
  > it's obvious which one it is. Indeed: it's Firefox.
  - m463 6y ago
    Firefox does a lot of phone home stuff too. (Not like chrome's built-in tracking)
- gruez 6y ago
  That argument only makes sense if they're mutually exclusive. Opting out of Chrome in favor of Xiaomi browser doesn't magically remove all the google tracking throughout the internet (unless it has integrated adblocker, which it doesn't seem to have). So really, the choices are Google vs Google + Xiaomi.
  - kevin_thibedeau 6y ago
    Chrome steers you into logging into your Google account for improved tracking. Android Chrome already has this info via OS integration.
- mrtweetyhack 6y ago
  The difference being Goggle does it to make money, China does it to hack you, your friends, your neighbors
- kofejnik 6y ago
  I'd much rather be tracked by Google than CPC
baq 6y ago
i didn't know for sure that such things would happen but expected it. one of the reasons i'm on an iphone for 2+ years. i've got zero trust in chinese manufacturers, in my mind they're just extensions of the CCP.
- deleted 6y ago
  [deleted]
- thelittleone 6y ago
  Same. I found this wiki page with a list of smartphone manufacturers by Country. https://en.m.wikipedia.org/wiki/List_of_mobile_phone_brands_by_country https://en.m.wikipedia.org/wiki/List_of_mobile_phone_brands_... I’ve visited Taiwan for work quite a few times and met with some of the big tech manufacturers. Very professional teams of engineers and a beautiful country. It would be super interesting if a Taiwanese manufacturer developed a smartphone + ecosystem whose selling point was no spyware and openness, at the price point of the Chinese manufacturers.
  - mekster 6y ago
    How much influence does China have over Taiwan? Can they completely decline any malicious orders?
    - djrogers 6y ago
      > How much influence does China have over Taiwan? Right now their only influence is financial, which Taiwan work pretty hard to resist where possible.
cantrevealname 6y ago
Just wait till they: - start encrypting all the data they collect (with real encryption, not base64 encoding) - saving up the data for hours or days at time and sending it in bursts (so there is no immediate connection to a remote server) - sending the data to plausible U.S.-registered domains (rather than to Singapore and Russia) - monitoring at the kernel or firmware level so that it doesn't matter what browser or apps you use - turning off data collection when it suspects a security researcher (due to signs of debuggers, development tools, network monitoring, usual network settings like to proxies or DNS, etc) We won't be able to prove anything. So disheartening.
- WrtCdEvrydy 6y ago
  > due to signs of debuggers, development tools, network monitoring, usual network settings like to proxies or DNS, etc Then that's your counter measure... run a debugger 24/7.
- LeoPanthera 6y ago
  I wonder how many devices already do this.
  - coribuci 6y ago
    > I wonder how many devices already do this. All Android phones. But they send the data to google and facebook so they must be good.
    - vinay427 6y ago
      Source needed. The amount in the article is staggering compared to what Google claims to collect which is in line with the (admittedly not definitive) DNS query logs I monitor every now and then. Also, much of it (e.g. location) can be disabled and there are Android phones that are entirely free of Google and Facebook.
      - freeflight 6y ago
        I do know for a fact that Android contacts querries Google severs to pull data from Google services, like YouTube, to fill in extra contact details on the phone. Knowing what Google's business is, I doubt they don't merge that data for a more complete profile. You can try this yourself: Create a YouTube account, upload a picture for the account, don't add details like a phone number. Now create a contact on Android, add a phone number (as most people do with contacts on their phone) and add the email address you registered the YouTube account, the Android contacts app will pull the profile picture from the YouTube account, and put it on the phone as the picture for the contact. Gave me quite a little scare when I discovered this by seeing my YouTube profile picture as the contact picture on a (rather privacy and tech-illiterate) friend's Android phone, even tho I never added any phone number to any of my Google accounts, all he did was add my email address to the contact.
ravenstine 6y ago
I'm sure they won't be able to deanonymize the data at the government's behest.
fulyscentedking 6y ago
Don't use Xiaomi, Huawei or other Chinese smart phone brands if you don't want to your information collected by those Chinese companies and the CCP. That being said Google, Apple and other American companies collect your information too, maybe not as bad, just maybe. We really need good free and open source OS options for smart phones. Like the GNU/Linux options available on desktops.
- djrogers 6y ago
  > That being said Google, Apple and other American companies collect your information too Can you point to examples of Apple collecting your browsing behavior or other similar data?
- abawany 6y ago
  My Pinephone UBPorts edition is on order: https://store.pine64.org/?product=pinephone-community-edition-ubports-limited-edition-linux-smartphone https://store.pine64.org/?product=pinephone-community-editio... . I expect it will be quite a bit unrefined initially but I hope to give it a fair try and contribute if possible.
- Hnrobert42 6y ago
  Off-handedly casting Google and Apple in the same lot with CPC sponsored phone companies is absurd.
  - morsch 6y ago
    Maybe so, but you're not making much of an argument of it.
    - Hnrobert42 6y ago
      I will not be baited into distinguishing between the two. As noted, saying they are the same on its face. If you believe they are the same/similar, I encourage you to write an article about it and post it for a discussion here on HN. If you let me know, I’ll happily respond there. Otherwise, I will assume you agree with me.
neonate 6y ago
https://archive.md/rhr59 https://archive.md/rhr59
i_am_nomad 6y ago
Many comments here boil down to “if you want privacy, buy an iPhone.” While true, this is another exhibit of privacy now being only for people who can afford it.
- andrepd 6y ago
  >While true Is it? I never understood the reasoning. What makes you think Apple is better than Xiaomi/Samsung/Google/whatever?
  - i_am_nomad 6y ago
    Maybe I should qualify that with, “outside of China.” If you’re using Apple phones in China, you should assume your data are available to the CCP. Otherwise, I have yet to see any evidence or indication that Apple collects data in a manner similar to what’s described in this article.
    - RealStickman_ 6y ago
      So basically Apple only protects you when they think they won't loose too much? No thanks, I'll take LineageOS + microG every day.
  - diminish 6y ago
    As Apple & Samsung(an ally) falls in slow motion behind Huawei soon behind Xiaomi, Oppo, Vivo - Chinese intelligence gets a strong advantage against US Intelligence in backdooring. So I think beyond the occasional bashing of Lenovo, Huawei, now Xiaomi we shall see more fight going on and same should be happening in Chinese press too. - https://www.gsmarena.com/counterpoint_smartphone_sales_in_q1_2020_decline_13_on_a_global_scale-news-42974.php https://www.gsmarena.com/counterpoint_smartphone_sales_in_q1... The draconian smartphone (as a a backdoor & tracking device) beloved by the intelligence officers are now an area of a bitter fight.
- Hnrobert42 6y ago
  This is a good point. Much of ~Google’s service~ the internet is “free” because you pay for it with personal information.
evross 6y ago
Just following the surveillance model pioneered by Google, Facebook etc. I'm glad tech surveillance is being covered and some awareness and opposition is visible here. Xiaomi aren't the only ones taking a mile of advantage from the inch of 'good telemetry' promoted by some companies.
djrogers 6y ago
Wow, just... Wow. > Xiaomi said, “The research claims are untrue,” and > When Forbes provided Xiaomi with a video made by Cirlig showing how his Google search for “porn” and a visit to the site PornHub were sent to remote servers, even when in incognito mode, the company spokesperson continued to deny that the information was being recorded. “This video shows the collection of anonymous browsing data, which is one of the most common solutions adopted by internet companies to improve the overall browser product experience through analyzing non-personally identifiable information,” they added. "We're not doing that. And everyone does that, so it's OK that we do that".
- MaxBarraclough 6y ago
  I'm reminded of something Christopher Hitchens once wrote about this sort of 'defence in depth', which I'll try to recount as best I can: One often hears from undemocratic regimes that they aren't torturing people in the manner accused, and that if they were it wouldn't be so bad, and that if it were bad it would still be well justified. On hearing these three in combination, little doubt should remain that the accusers have it right.
Proven 6y ago
"Your privacy is very important to us and the CCP, because we profit when we violate it" Don't buy anything from a company that ultimately answers only to the Party. What else is there to say? Other products may be just as crap, but they'll never be potentially crappier.
guug 6y ago
It was only a matter of time before forign companies followed Google and Microsoft's lead and started slurping user data. Expecting any other outcome would be nothing short of delusional. Screw Xiaomi and screw Google and Microsoft.
peterwwillis 6y ago
Google has been doing this for like a decade, and we've known 5-Eyes has been collecting this data from them for like a decade. So I guess the news is that China is late to the party.
0x49d1 6y ago
Anyone thought that they don't?! Cmon, they sell nice smartphones for 80-100$, why would they do that? They have built-in ads, so they probably study our behavior to send more relevant ads and make more proper contracts for advertisements.
e13bdde8c206707 6y ago
This has seriously made me paranoid about buying any kind of tech from China. I am a long time ThinkPad user and might probably have brought the Fedora powered once as soon as it hit the markets here but unfortunately I'll have to think again. Dell is my second choice but if there is anything Snowden as shown, it is that neither US companies can be trusted. The problem is fundamentally different, we need tech that are more open and transparent.
Causality1 6y ago
We need legislation that triggers automatic import bans when malfeasance of this magnitude is discovered. The only way to stop companies from doing this is financial disembowelment. Anything less just becomes the cost of doing business.
itronitron 6y ago
...by purchasing a license to use our phone, you (the user) consent to send all data about about your use of our phone while using our phone that you have been granted a license to use by us
rawoke083600 6y ago
Ag no man ! Xiaomi is my fav android phone brand.
mtsx 6y ago
typical Chinese company
neurostimulant 6y ago
Xiaomi produces one of the best bang for your bucks hardware in the market. Their software is crap though. Ads in the system apps, ui customization that arguably looks worse than stock android, and now blanket tracking like this, though it was always pinging their tracking servers frequently. My pihole logs pretty much full with blocked xiaomi requests until I flashed the phone. Best thing to do when you got an android phone, especially from a chinese manufacturer, is to flash LineageOS on it.
- tastroder 6y ago
  Is that a recent thing? My Xiaomi Mi A1 ran Android One that gets official updates to this day, as far as I could tell it was pretty stock and the data collection in their "Mi Services" could be disabled in the settings UI, so not unlike pretty much any cheap manufacturer.
  - neurostimulant 6y ago
    Mi A1 is probably an exception as it's part of Android One program. The rest of xiaomi lineups are using their miui rom which contains ads and tracking mentioned in the article.
- brnt 6y ago
  LineageOS (and a few other Android distros) are the only mobile OSes I trust and use. Not any different with laptops and desktops BTW: I don't trust any preinstalled OS and not any distro for which I can't browse the source.
- raindropm 6y ago
  Problem is lately many banking app required you to use non-root phone, at least in my country. There used to be workaround, but it is not work anymore. I have Redmi phone and I hates it as soon as I found that there is ads in their rom. It's so disappointing. I mean, other Chinese brand have their own crapware yes, but ads? I then flash my phone to pure Pixel rom and never been happier, until the bank app incident happened. So I have to use their original rom for now until I get a new phone. No matter how rave the Mi phone review be, or how it is great 'bang for the bucks' brand, I will never touch their phone again.
askafriend 6y ago
Much better to pay the Apple tax than to have to worry about this kind of stuff to save a couple bucks.
- tonyedgecombe 6y ago
  Yes, that extra margin is the reason Apple doesn't have to stoop to some of the practices of companies on much slimmer margins.
ComodoHacker 6y ago
This is old news. Just run Lumen on any Xiaomi device and see for yourself.
est 6y ago
Wait, people still use stock MIUI after they bought Xiaomi phone? It was nick named ADUI after all.
pier25 6y ago
Does this also happen with Android One phones?
- korax_nyx 6y ago
  I would love to know that too
mdpopescu 6y ago
So... the browser on Xiaomi phones is doing what the other browsers have been doing for years? The horror!
seemslegit 6y ago
As opposed to ?
seemslegit 6y ago
> One message was clear to the researcher: when you’re listening, Xiaomi is listening, too. So does one or more of: Google, Facebook, Samsung, Apple, Amazon
mrwww 6y ago
Google accusing apple of "Selling privacy as a luxury good", well, isn't it? Clearly, if you don't want to be spied on you're going to have to pay a premium.
- blaser-waffle 6y ago
  The profit from your data offsets the cost of the hardware. If they're not selling your data, then you get to pay full price for the phone. Not a crazy idea, really, but I wish that was made clearer.
  - foxrider 6y ago
    Yet Apple ecosystem is an insane walled garden and you don't really own your hardware, because you can't even run applications not downloaded from the app store.
devit 6y ago
Are there going to be legal consequences for this? I would expect this to carry the heaviest penalties possible including massive penalties against China if they fail to enforce them, but I guess nothing is going to happen given the current state of society.
solarkraft 6y ago
Why is it surprising that proprietary software, especially from China, would steal your data? The incentive is pretty clear.
lostmsu 6y ago
So if you do not use preinstalled Xiaomi software, you are mostly OK? (until they start stealing Firefox browsing history) Having a Xiaomi phone myself there's a trade-off between using the official ROM, that provides full device encryption and SE Linux enforcement, but tracks what you do in settings, and unofficial LineageOS (PHH GSI), that does not encrypt the device data and has SE Linux off on most Xiaomi phones, I ended up sticking with MIUI.
zrth 6y ago
Serious question: How is this different from what google is doing?
hkai 6y ago
Why would you even consider using a Chinese phone? We wouldn't use a North Korean phone, so why do we treat China differently?

526 points by rock_artist 6y ago

There's too much to quote, but scroll down to Xiamoi's responses. Man, that is the quintessential example of gaslighting. "No we didn't, that's not true at all. Well, we kinda did, but it's 'anonymized', so it's okay." "But we have video of your device sending data to..." "...but, but, anonymized!" "I thought you said you weren't sending data at all, now it's just anonymized browser data, but we see your devices sending device usage outside the brows..." "ANONYMIZED!!!!11"

0xy 6y ago
There's no such thing as anonymized when it comes to data tracking. "Anonymized" tracking itself is gaslighting.
- nicbou 6y ago
  It's anonymized in the sense that you don't know who it will be sold to and what they will do with it. In all seriousness, this is a point GDPR struggles with. It's really hard to properly define what constitutes personal data.
  - tjoff 6y ago
    Personally Identifiable information is data that can be used to identify a person with reasonable effort (getting a warrant is not reasonable for instance). The same data can be both PII and not PII depending on the context. Not sure what the struggle is?
  - bostik 6y ago
    Disclosure: I'm writing this with my DPO hat on. The GDPR does specify what is personal data, but doesn't go out giving real-life interpretation examples. The categories given in the regulation are direct identifiers and indirect identifiers. The categories even include a good sampling of information types that belong in each. Direct allows to identify an individual or a very small group from a single datapoint. Indirect allows to identify larger groups. Or to put in terms most of us here understand.. Direct identifiers are personal information that would allow to send marketing junk to selected individuals. Indirect ones are those you would use to build marketing cohorts. So if it's data your marketing department would like to grab, you can bet it's personal information under GDPR.
  - coribuci 6y ago
    > It's anonymized in the sense that you don't know who it will be sold to and what they will do with it. So "It's anonymized" but It's not anonymized. > In all seriousness, this is a point GDPR struggles with. It's really hard to properly define what constitutes personal data. GDPR is good. The problem is that GDPR is not enforced because it might upset Uncle Sam
thefounder 6y ago
Rome was not built in a day! They need time to aquire the sophistication of the US data brokers.
- cik 6y ago
  And yet the empire was brought down from within...

schoolornot 6y ago

I recently wiped my factory-unlocked Samsung S20, enabled debug mode, and ran "pm list packages" over ADB. The results were beyond startling. There were close to 100 packages running under com.samsung and other various namespaces with tons of sensitive permissions. Most of these processes I could not identify what they existed for. And I still can't figure out why a freshly wiped unlocked phone w/ a Sprint SIM is running a Verizon provisioning process. I do not trust any of these Android manufacturers to do right by people. Even the Pixel phones have a "Support" application that has camera permissions -- which last I checked, couldn't be changed regardless of whether you need support or not. What's going to happen when some obscure team within Google pushes an update to this app to do something without user approval?

101404 6y ago
I wonder if it is illegal under GDPR to include spying apps on phones without telling the user.
- nicbou 6y ago
  It most certainly is.
- pacamara619 6y ago
  It is, there is no doubt about that.
- Nextgrid 6y ago
  The question of the GDPR is not whether it's illegal but whether anything is done to crack down on offenders. Facebook, Google and thousands of marketing/analytics/advertising companies are still around and are stalking users with total disregard of the GDPR, so that's a clear negative.
  - tgsovlerkhgsel 6y ago
    Would someone who is downvoting this be willing to explain why? Because I have the same impression (that many GDPR rules are simply being ignored because enforcement is lacking).

throwaway9587 6y ago

Before you go shaming those bad, bad Chinese companies, imagine my surprise when I restored my Apple iPhone from iCloud only to find my (always set to private!) Safari back there with every tab I ever opened.

gruez 6y ago
It's entirely possible to implement that behavior in a privacy preserving way. Just encrypt "sensitive" data with a key that's stored on the secure element. That way if you restore to the same device, you get everything back. Sadly, I don't feel like wiping my phone to test this out, so whether Apple actually does that is an open question at this point.
- deleted 6y ago
  [deleted]
coolspot 6y ago
Your backup is encrypted https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- centimeter 6y ago
  That chart from Apple is quite misleading. Apple abandoned full strong encryption for iCloud data, apparently due to pressure from the US Government. https://9to5mac.com/2020/01/21/apple-reportedly-abandoned-end-to-end-icloud/ https://9to5mac.com/2020/01/21/apple-reportedly-abandoned-en... Only the things under "End-to-end encrypted data" are actually encrypted in a meaningful way - everything else just sits on servers that use disk encryption, but that fails to defend from 99% of realistic attack scenarios. A lot of content - including photos (which I used to use to take pictures of sensitive personal data, like ID cards) - is not meaningfully encrypted. Thankfully, Safari tab data is actually encrypted as of iOS 13. While Apple has done a good job of protecting user privacy compared to the alternatives, they still have a lot of work to do before we can accurately say things like "iCloud backups are encrypted".
6y ago

bottled_poe 6y ago

This is surprising? I thought this was a feature.

gruez 6y ago
>I thought this was a feature. ??? In what way does this benefit the user?
- eanzenberg 6y ago
  Give my data to the glorious red state, for the greater good of the people!
- Hnrobert42 6y ago
  Improved user experience. /s

qppo 6y ago

The fucking huevos on Forbes to publish this article alongside the most godawful CCPA opt-out flow I've seen yet... Clicking the "do not sell my info" link takes you to a page where it asks you for your personal information to request to opt out... with the fine print telling you that you can actually opt out by going back to the previous dialog, selecting more info, then selecting one of the three cookie sections (which is not labeled "do not sell my info" or anything similar). There's then a timer where it takes about a minute to update the cookie preferences. I know Forbes has turned into a glorified blogging site for "journalists" these days but come on. Talking about privacy and misleading information on the same site that makes you jump through hoops to remain anonymous while browsing? Pot calling the kettle black much.

cambalache 6y ago
If you are a native English speaker kudos for writing "huevos" and not "Cahones" or other of its similar cringy misspellings. But 90% chance you are from the south cone so carry on.
- ebg13 6y ago
  https://www.merriam-webster.com/dictionary/cojones https://www.merriam-webster.com/dictionary/cojones ?
- ficklepickle 6y ago
  To be fair, they both appear on the wikipedia page for Spanish profanity[0]. [0] https://en.wikipedia.org/wiki/Spanish_profanity#References_to_the_male_genitalia https://en.wikipedia.org/wiki/Spanish_profanity#References_t...
  - cambalache 6y ago
    You misunderstood, it is not the word "cojones" I was mocking, just the hilarious misspeling some people use, I have seen "Cohones","Cahones", "Koojonehs" and so on
- maximente 6y ago

ptx 6y ago

How does Windows 10 compare? It also tracks and reports which websites you visit, but maybe it doesn't in private browsing mode? Edit: People asking for sources, go to Settings -> Diagnostics & Feedback. See the part where it says "Send ... info about websites you browse"? You might also be interested in the setting below it; when you enable it "Microsoft will collect samples of the content you type"[1]. [1] https://support.microsoft.com/en-us/help/4468236/ https://support.microsoft.com/en-us/help/4468236/

gruez 6y ago
>anti-china thread >whataboutism reply defending china/chinese company color me surprised
- myopenid 6y ago
  What's wrong with that?
ChuckNorris89 6y ago
Source?
drevil-v2 6y ago
Citation needed. The device telemetry does not include browsing history.
- ptx 6y ago
  Citation needed. Microsoft's documentation says it includes "information about the websites you browse". It also says that "data items collected in Windows diagnostics are subject to change to give Microsoft flexibility to collect the data needed", so even if they aren't collecting that data today, they reserve the right to take whatever they want whenever they feel like it.

thoraway1010 6y ago

I know apple keeps on getting headlines for breaking privacy (and also making phones that supposedly get thrown away because they don't have right to repair) My own sense is android phones are MUCH less private and secure AND have much shorter useful lives.

edoceo 6y ago
But maybe easier to load a custom rom?
LeoPanthera 6y ago
> I know apple keeps on getting headlines for breaking privacy Seems like they're mostly in the news for the exact opposite.

mbdesign 6y ago

On a Xiaomi device myself. Recently I've setup Nextdns.io to resolve all the DNS requests through it. Very frequent callbacks to Xiaomi servers for tracking. Blocked a bunch of them now, but it's half a solution.

xiii1408 6y ago
Other than the tracking, would you recommend it? Is LineageOS available? I've been curious about trying a Chinese phone for a while, but would only do it if Lineage is available, since I'm annoyed by anything more busy than stock Android.
- deleted 6y ago
  [deleted]
- yorwba 6y ago
  LineageOS supports a lot of different Xiaomi devices: https://wiki.lineageos.org/devices/#xiaomi https://wiki.lineageos.org/devices/#xiaomi I have a tissot with LineageOS 16.0, not sure yet whether it will get 17 ported to it as well. The hardware is great for the price (bought it a year after launch, heavily discounted). I bought it specifically to run LineageOS on it, so I have no idea what the stock experience is like.
  - tiii 6y ago
    Official tissot support was dropped this month. No more security updates. https://forum.xda-developers.com/showpost.php?p=82234015&postcount=2243 https://forum.xda-developers.com/showpost.php?p=82234015&pos...
    - yorwba 6y ago
      Thanks for the heads-up. I guess I'll have to flee to a different ROM, then.
- searchableguy 6y ago
  Yeah. I am using cdroid android v10(based on lineage). Last update was this month. Running it for 2 years now.

TLightful 6y ago

For those more expert than I, is Apple any better in this regard? If not, which mobile is ideal?

centimeter 6y ago
> is Apple any better in this regard Yes
djrogers 6y ago
> For those more expert than I, is Apple any better in this regard? Yes, and unequivocally so. Apple is not know to track browsing behavior, search terms, etc. Most of the data that your phone collects about you either remains in your phone (that’s why they’ve been shipping with NPUs for several years - they do A lot of machine learning in device rather than in-cloud) or is analyzed using differential privacy mechanisms. The amount of data that Apple refuses to collect in Apple Maps for example is astounding. Start and end points of any journey are not used for example. Your trip is broken up into a bunch of segments, and only the middle ones are analyzed for traffic pattern, and even then only after being anonymized. And most of the details behind all of this are published in a well written and frequently updated privacy whitepapers. [1] https://www.apple.com/privacy/features/ https://www.apple.com/privacy/features/
- izacus 6y ago
  You ignored iCloud though, which isn't E2E reencode and uploads personal photos, contacts, location and some other data to Apple. They can decrypt this data and regularly share it with the governments. So your post is kinda misleading when you leave these details out - it creates a false sense of safety. (And before someone complains: Yes, Apple is infinitely better at privacy than Xiaomi. We still shouldn't hide privacy risks though.)
  - foxrider 6y ago
    However, there is an elephant in the room - any Xiaomi device can unlock its bootloader, and the flash an open firmware, like LOS. This instantly makes it much better than Apple phones or any phones on the market - you can even ignore google software. With Apple you cant even run apps that haven't gotten through Apple censors, and the closest you can get to owning your hardware is "jailbreaking" it.

cmoscoso 6y ago

I think they call it backup.

amiga-workbench 6y ago

Stuff like this is why without fail, every phone I own gets LineageOS installed immediately. Xiaomi phones have a bootloader unlock timer to try and mitigate sites reselling their phones with modified software, so I had to leave my Mix 2s alone for a few days before I could make it safe to use.

fastball 6y ago
This is why, without fail, I buy iPhones.
- amiga-workbench 6y ago
  With the Bootloader exploit on iPhone X and older, its actually worth looking at them now.
  - fastball 6y ago
    Checkm8 is a tethered exploit, so probably not super useful if you want to sideload another OS and not have a bad time.
    - Nextgrid 6y ago
      I remember back in the days of the iPhone 3G(s?) there was an attempt at a battery-powered dongle that could re-jailbreak a phone in the field in case of a reboot. The same technology could be built into a battery case or similar, not to mention recent technological advances mean it can be done in a small package the size of a Lightning connector or a Yubikey and you can carry it on your keyring.
      - ThatPlayer 6y ago
        There's a similar product for Nintendo Switch jailbreaking: NS-Atmosphere or RCMLoader. Since it's a bigger device, some of them are soldered internally using a Trinket M0
      - 6y ago

zaro 6y ago

“It’s a lot worse than any of the mainstream browsers I have seen,” It's a lot worse than Chrome ? The Xiaomi browser tracks your browsing. The Google browser in combination with the most of the sites in the internet track your browsing, your location, and a lot of other things. Choosing the lesser evil is quite popular now days, and it's obvious which one it is.

Tijdreiziger 6y ago
> it's obvious which one it is. Indeed: it's Firefox.
- m463 6y ago
  Firefox does a lot of phone home stuff too. (Not like chrome's built-in tracking)
gruez 6y ago
That argument only makes sense if they're mutually exclusive. Opting out of Chrome in favor of Xiaomi browser doesn't magically remove all the google tracking throughout the internet (unless it has integrated adblocker, which it doesn't seem to have). So really, the choices are Google vs Google + Xiaomi.
- kevin_thibedeau 6y ago
  Chrome steers you into logging into your Google account for improved tracking. Android Chrome already has this info via OS integration.
mrtweetyhack 6y ago
The difference being Goggle does it to make money, China does it to hack you, your friends, your neighbors
kofejnik 6y ago
I'd much rather be tracked by Google than CPC

baq 6y ago

i didn't know for sure that such things would happen but expected it. one of the reasons i'm on an iphone for 2+ years. i've got zero trust in chinese manufacturers, in my mind they're just extensions of the CCP.

deleted 6y ago
[deleted]
thelittleone 6y ago
Same. I found this wiki page with a list of smartphone manufacturers by Country. https://en.m.wikipedia.org/wiki/List_of_mobile_phone_brands_by_country https://en.m.wikipedia.org/wiki/List_of_mobile_phone_brands_... I’ve visited Taiwan for work quite a few times and met with some of the big tech manufacturers. Very professional teams of engineers and a beautiful country. It would be super interesting if a Taiwanese manufacturer developed a smartphone + ecosystem whose selling point was no spyware and openness, at the price point of the Chinese manufacturers.
- mekster 6y ago
  How much influence does China have over Taiwan? Can they completely decline any malicious orders?
  - djrogers 6y ago
    > How much influence does China have over Taiwan? Right now their only influence is financial, which Taiwan work pretty hard to resist where possible.

cantrevealname 6y ago

Just wait till they: - start encrypting all the data they collect (with real encryption, not base64 encoding) - saving up the data for hours or days at time and sending it in bursts (so there is no immediate connection to a remote server) - sending the data to plausible U.S.-registered domains (rather than to Singapore and Russia) - monitoring at the kernel or firmware level so that it doesn't matter what browser or apps you use - turning off data collection when it suspects a security researcher (due to signs of debuggers, development tools, network monitoring, usual network settings like to proxies or DNS, etc) We won't be able to prove anything. So disheartening.

WrtCdEvrydy 6y ago
> due to signs of debuggers, development tools, network monitoring, usual network settings like to proxies or DNS, etc Then that's your counter measure... run a debugger 24/7.
LeoPanthera 6y ago
I wonder how many devices already do this.
- coribuci 6y ago
  > I wonder how many devices already do this. All Android phones. But they send the data to google and facebook so they must be good.
  - vinay427 6y ago
    Source needed. The amount in the article is staggering compared to what Google claims to collect which is in line with the (admittedly not definitive) DNS query logs I monitor every now and then. Also, much of it (e.g. location) can be disabled and there are Android phones that are entirely free of Google and Facebook.
    - freeflight 6y ago
      I do know for a fact that Android contacts querries Google severs to pull data from Google services, like YouTube, to fill in extra contact details on the phone. Knowing what Google's business is, I doubt they don't merge that data for a more complete profile. You can try this yourself: Create a YouTube account, upload a picture for the account, don't add details like a phone number. Now create a contact on Android, add a phone number (as most people do with contacts on their phone) and add the email address you registered the YouTube account, the Android contacts app will pull the profile picture from the YouTube account, and put it on the phone as the picture for the contact. Gave me quite a little scare when I discovered this by seeing my YouTube profile picture as the contact picture on a (rather privacy and tech-illiterate) friend's Android phone, even tho I never added any phone number to any of my Google accounts, all he did was add my email address to the contact.

ravenstine 6y ago

I'm sure they won't be able to deanonymize the data at the government's behest.

fulyscentedking 6y ago

Don't use Xiaomi, Huawei or other Chinese smart phone brands if you don't want to your information collected by those Chinese companies and the CCP. That being said Google, Apple and other American companies collect your information too, maybe not as bad, just maybe. We really need good free and open source OS options for smart phones. Like the GNU/Linux options available on desktops.

djrogers 6y ago
> That being said Google, Apple and other American companies collect your information too Can you point to examples of Apple collecting your browsing behavior or other similar data?
abawany 6y ago
My Pinephone UBPorts edition is on order: https://store.pine64.org/?product=pinephone-community-edition-ubports-limited-edition-linux-smartphone https://store.pine64.org/?product=pinephone-community-editio... . I expect it will be quite a bit unrefined initially but I hope to give it a fair try and contribute if possible.
Hnrobert42 6y ago
Off-handedly casting Google and Apple in the same lot with CPC sponsored phone companies is absurd.
- morsch 6y ago
  Maybe so, but you're not making much of an argument of it.
  - Hnrobert42 6y ago
    I will not be baited into distinguishing between the two. As noted, saying they are the same on its face. If you believe they are the same/similar, I encourage you to write an article about it and post it for a discussion here on HN. If you let me know, I’ll happily respond there. Otherwise, I will assume you agree with me.

neonate 6y ago

https://archive.md/rhr59 https://archive.md/rhr59

i_am_nomad 6y ago

Many comments here boil down to “if you want privacy, buy an iPhone.” While true, this is another exhibit of privacy now being only for people who can afford it.

andrepd 6y ago
>While true Is it? I never understood the reasoning. What makes you think Apple is better than Xiaomi/Samsung/Google/whatever?
- i_am_nomad 6y ago
  Maybe I should qualify that with, “outside of China.” If you’re using Apple phones in China, you should assume your data are available to the CCP. Otherwise, I have yet to see any evidence or indication that Apple collects data in a manner similar to what’s described in this article.
  - RealStickman_ 6y ago
    So basically Apple only protects you when they think they won't loose too much? No thanks, I'll take LineageOS + microG every day.
- diminish 6y ago
  As Apple & Samsung(an ally) falls in slow motion behind Huawei soon behind Xiaomi, Oppo, Vivo - Chinese intelligence gets a strong advantage against US Intelligence in backdooring. So I think beyond the occasional bashing of Lenovo, Huawei, now Xiaomi we shall see more fight going on and same should be happening in Chinese press too. - https://www.gsmarena.com/counterpoint_smartphone_sales_in_q1_2020_decline_13_on_a_global_scale-news-42974.php https://www.gsmarena.com/counterpoint_smartphone_sales_in_q1... The draconian smartphone (as a a backdoor & tracking device) beloved by the intelligence officers are now an area of a bitter fight.
Hnrobert42 6y ago
This is a good point. Much of ~Google’s service~ the internet is “free” because you pay for it with personal information.

evross 6y ago

Just following the surveillance model pioneered by Google, Facebook etc. I'm glad tech surveillance is being covered and some awareness and opposition is visible here. Xiaomi aren't the only ones taking a mile of advantage from the inch of 'good telemetry' promoted by some companies.

djrogers 6y ago

Wow, just... Wow. > Xiaomi said, “The research claims are untrue,” and > When Forbes provided Xiaomi with a video made by Cirlig showing how his Google search for “porn” and a visit to the site PornHub were sent to remote servers, even when in incognito mode, the company spokesperson continued to deny that the information was being recorded. “This video shows the collection of anonymous browsing data, which is one of the most common solutions adopted by internet companies to improve the overall browser product experience through analyzing non-personally identifiable information,” they added. "We're not doing that. And everyone does that, so it's OK that we do that".

MaxBarraclough 6y ago
I'm reminded of something Christopher Hitchens once wrote about this sort of 'defence in depth', which I'll try to recount as best I can: One often hears from undemocratic regimes that they aren't torturing people in the manner accused, and that if they were it wouldn't be so bad, and that if it were bad it would still be well justified. On hearing these three in combination, little doubt should remain that the accusers have it right.

Proven 6y ago

"Your privacy is very important to us and the CCP, because we profit when we violate it" Don't buy anything from a company that ultimately answers only to the Party. What else is there to say? Other products may be just as crap, but they'll never be potentially crappier.

guug 6y ago

It was only a matter of time before forign companies followed Google and Microsoft's lead and started slurping user data. Expecting any other outcome would be nothing short of delusional. Screw Xiaomi and screw Google and Microsoft.

peterwwillis 6y ago

Google has been doing this for like a decade, and we've known 5-Eyes has been collecting this data from them for like a decade. So I guess the news is that China is late to the party.

0x49d1 6y ago

Anyone thought that they don't?! Cmon, they sell nice smartphones for 80-100$, why would they do that? They have built-in ads, so they probably study our behavior to send more relevant ads and make more proper contracts for advertisements.

e13bdde8c206707 6y ago

This has seriously made me paranoid about buying any kind of tech from China. I am a long time ThinkPad user and might probably have brought the Fedora powered once as soon as it hit the markets here but unfortunately I'll have to think again. Dell is my second choice but if there is anything Snowden as shown, it is that neither US companies can be trusted. The problem is fundamentally different, we need tech that are more open and transparent.

Causality1 6y ago

We need legislation that triggers automatic import bans when malfeasance of this magnitude is discovered. The only way to stop companies from doing this is financial disembowelment. Anything less just becomes the cost of doing business.

itronitron 6y ago

...by purchasing a license to use our phone, you (the user) consent to send all data about about your use of our phone while using our phone that you have been granted a license to use by us

rawoke083600 6y ago

Ag no man ! Xiaomi is my fav android phone brand.

mtsx 6y ago

typical Chinese company

neurostimulant 6y ago

Xiaomi produces one of the best bang for your bucks hardware in the market. Their software is crap though. Ads in the system apps, ui customization that arguably looks worse than stock android, and now blanket tracking like this, though it was always pinging their tracking servers frequently. My pihole logs pretty much full with blocked xiaomi requests until I flashed the phone. Best thing to do when you got an android phone, especially from a chinese manufacturer, is to flash LineageOS on it.

tastroder 6y ago
Is that a recent thing? My Xiaomi Mi A1 ran Android One that gets official updates to this day, as far as I could tell it was pretty stock and the data collection in their "Mi Services" could be disabled in the settings UI, so not unlike pretty much any cheap manufacturer.
- neurostimulant 6y ago
  Mi A1 is probably an exception as it's part of Android One program. The rest of xiaomi lineups are using their miui rom which contains ads and tracking mentioned in the article.
brnt 6y ago
LineageOS (and a few other Android distros) are the only mobile OSes I trust and use. Not any different with laptops and desktops BTW: I don't trust any preinstalled OS and not any distro for which I can't browse the source.
raindropm 6y ago
Problem is lately many banking app required you to use non-root phone, at least in my country. There used to be workaround, but it is not work anymore. I have Redmi phone and I hates it as soon as I found that there is ads in their rom. It's so disappointing. I mean, other Chinese brand have their own crapware yes, but ads? I then flash my phone to pure Pixel rom and never been happier, until the bank app incident happened. So I have to use their original rom for now until I get a new phone. No matter how rave the Mi phone review be, or how it is great 'bang for the bucks' brand, I will never touch their phone again.

askafriend 6y ago

Much better to pay the Apple tax than to have to worry about this kind of stuff to save a couple bucks.

tonyedgecombe 6y ago
Yes, that extra margin is the reason Apple doesn't have to stoop to some of the practices of companies on much slimmer margins.

ComodoHacker 6y ago

This is old news. Just run Lumen on any Xiaomi device and see for yourself.

est 6y ago

Wait, people still use stock MIUI after they bought Xiaomi phone? It was nick named ADUI after all.

pier25 6y ago

Does this also happen with Android One phones?

korax_nyx 6y ago
I would love to know that too

mdpopescu 6y ago

So... the browser on Xiaomi phones is doing what the other browsers have been doing for years? The horror!

seemslegit 6y ago

As opposed to ?

seemslegit 6y ago

> One message was clear to the researcher: when you’re listening, Xiaomi is listening, too. So does one or more of: Google, Facebook, Samsung, Apple, Amazon

mrwww 6y ago

Google accusing apple of "Selling privacy as a luxury good", well, isn't it? Clearly, if you don't want to be spied on you're going to have to pay a premium.

blaser-waffle 6y ago
The profit from your data offsets the cost of the hardware. If they're not selling your data, then you get to pay full price for the phone. Not a crazy idea, really, but I wish that was made clearer.
- foxrider 6y ago
  Yet Apple ecosystem is an insane walled garden and you don't really own your hardware, because you can't even run applications not downloaded from the app store.

devit 6y ago

Are there going to be legal consequences for this? I would expect this to carry the heaviest penalties possible including massive penalties against China if they fail to enforce them, but I guess nothing is going to happen given the current state of society.

solarkraft 6y ago

Why is it surprising that proprietary software, especially from China, would steal your data? The incentive is pretty clear.

lostmsu 6y ago

So if you do not use preinstalled Xiaomi software, you are mostly OK? (until they start stealing Firefox browsing history) Having a Xiaomi phone myself there's a trade-off between using the official ROM, that provides full device encryption and SE Linux enforcement, but tracks what you do in settings, and unofficial LineageOS (PHH GSI), that does not encrypt the device data and has SE Linux off on most Xiaomi phones, I ended up sticking with MIUI.

zrth 6y ago

Serious question: How is this different from what google is doing?

hkai 6y ago

Why would you even consider using a Chinese phone? We wouldn't use a North Korean phone, so why do we treat China differently?