6 ms·

I recently wiped my factory-unlocked Samsung S20, enabled debug mode, and ran "pm list packages" over ADB. The results were beyond startling. There were close t

I recently wiped my factory-unlocked Samsung S20, enabled debug mode, and ran "pm list packages" over ADB. The results were beyond startling. There were close to 100 packages running under com.samsung and other various namespaces with tons of sensitive permissions. Most of these processes I could not identify what they existed for. And I still can't figure out why a freshly wiped unlocked phone w/ a Sprint SIM is running a Verizon provisioning process. I do not trust any of these Android manufacturers to do right by people. Even the Pixel phones have a "Support" application that has camera permissions -- which last I checked, couldn't be changed regardless of whether you need support or not. What's going to happen when some obscure team within Google pushes an update to this app to do something without user approval?

101404 6y ago
I wonder if it is illegal under GDPR to include spying apps on phones without telling the user.
- nicbou 6y ago
  It most certainly is.
- pacamara619 6y ago
  It is, there is no doubt about that.
- Nextgrid 6y ago
  The question of the GDPR is not whether it's illegal but whether anything is done to crack down on offenders. Facebook, Google and thousands of marketing/analytics/advertising companies are still around and are stalking users with total disregard of the GDPR, so that's a clear negative.
  - tgsovlerkhgsel 6y ago
    Would someone who is downvoting this be willing to explain why? Because I have the same impression (that many GDPR rules are simply being ignored because enforcement is lacking).
    - Nextgrid 6y ago
      The typical response I get to such comments is that Google did get fined 50M once in France. The problem is that not only is it pocket money to them but Google continues to violate people's privacy (Google Analytics still tries to stalk me everywhere without asking for consent first). When it comes to Facebook I am not aware of any investigation or enforcement action being taken despite them being even worse than Google when it comes to privacy and having proven their malicious intent and complete disregard for the privacy multiple times.
      - hetspookjee 6y ago
        Well you can get rid of Google analytics, you just have to install their Opt-out Google Analytics browser extension and fill in some data. I really wish the EU actually did something worthwhile with the GDPR.
        Nextgrid 6y ago
        The point of the GDPR is that you don’t have to opt-out, you have to opt-in if you are happy with tracking.
      - def_true_false 6y ago
        It seems there has been more activity since then, see here https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ Sort by amount fined.
- tdsamardzhiev 6y ago
  There was a joke that the fastest reader in the world is a Romanian who read 54 pages of terms and conditions in 2 seconds. So... yeah, most likely the user has "agreed".
- badpun 6y ago
  I work in GDPR-compliance related area in a multibillion UE corporation and I can say that right now, it's all a big joke. We have multiple huge violations and we don't do anything about it (partially because the law is so demanding that implementing it would be a massive effort). And yet, we don't get fined - partially probably because no one blew the whistle yet. I'm pretty sure the situation is very similar in all of our competitors. It seems to me that the lawyers who wrote GDPR might have been out of touch with realities of large and old companies and now the preference on regulators side might not to just not enforce the more bonkers parts of the bill? Interesting how it will play out over the next 5-10 years.
- coribuci 6y ago
  > I wonder if it is illegal under GDPR to include spying apps on phones without telling the user. It is illegal but it is not enforced.
curiousgal 6y ago
This is why I root my device and only allow apps I trust internet access.
- jotm 6y ago
  Doesn't that permanently disable some features on Samsung? I read they use a goddamn eFuse for it
  - curiousgal 6y ago
    I am using a Google Pixel device. I have no idea whether Magisk works on Samsung phones.
  - pongo1231 6y ago
    Yup, IIRC that disables Knox features and secure folder permanently (trips an e-fuse so there's no turning back). I don't remember if Samsung also intentionally degraded camera quality like some other vendors (Sony at least used to once you unlocked your bootloader).
- amoshi 6y ago
  Root and then get flagged by Google's SafetyNet, preventing you from Netflix, banking apps etc? That's a brave but big sacrifice
  - NikolaeVarius 6y ago
    Systemless root + root hiding is a thing. I run a custom rom and pass safety check and have access to all my apps including banking.
    - AWildC182 6y ago
      This is why people need to start rejecting closed ecosystems. If you own the hardware you can control everything that happens on it including companies trying to force their will upon you
0xy 6y ago
I get a very uneasy feeling using Samsung's products because their privacy record is atrocious, they cram ads everywhere on flagship devices and the quality of their software is just mediocre. Unfortunately, Android has emerged as the tracking and advertising platform. Look at every single Android TV on the market, they're privacy-invading garbage and such practices are explicitly enabled and encouraged by Google.
g_p 6y ago
> And I still can't figure out why a freshly wiped unlocked phone w/ a Sprint SIM is running a Verizon provisioning process. Samsung has a rather "interesting" (to say the least) firmware development process (if you can call it a process). It seems that most handsets certainly used to ship with if-gated Verizon specific hacks all over the firmwares, regardless of market the device was for. I believe this was just for simplicity's sake. It sounds like nothing has changed there. As much as Samsung loves to advertise enterprise security like Knox, it only takes a few minutes of digging through the history of Knox to see some blunders from the early days, like storing the plaintext Knox PIN, to really wonder how on earth they can secure it. Call me old fashioned, but I just don't have any confidence in the development practices of any phone vendor these days - even plain pure AOSP Android has so many external library dependencies, each of which is receiving CVEs and patches regularly (hopefully), and needs to be kept updated by AOSP maintainers. I used to track the ancient kernel CVEs that were being rediscovered in Android due to poor or non existent source code control in OEM kernels. I gave up as it was pretty much a flood of 2 or 3 year old bugs being rediscovered as unlatched on Android or Qualcomm kernels.

101404 6y ago

I wonder if it is illegal under GDPR to include spying apps on phones without telling the user.

nicbou 6y ago
It most certainly is.
pacamara619 6y ago
It is, there is no doubt about that.
Nextgrid 6y ago
The question of the GDPR is not whether it's illegal but whether anything is done to crack down on offenders. Facebook, Google and thousands of marketing/analytics/advertising companies are still around and are stalking users with total disregard of the GDPR, so that's a clear negative.
- tgsovlerkhgsel 6y ago
  Would someone who is downvoting this be willing to explain why? Because I have the same impression (that many GDPR rules are simply being ignored because enforcement is lacking).
  - Nextgrid 6y ago
    The typical response I get to such comments is that Google did get fined 50M once in France. The problem is that not only is it pocket money to them but Google continues to violate people's privacy (Google Analytics still tries to stalk me everywhere without asking for consent first). When it comes to Facebook I am not aware of any investigation or enforcement action being taken despite them being even worse than Google when it comes to privacy and having proven their malicious intent and complete disregard for the privacy multiple times.
    - hetspookjee 6y ago
      Well you can get rid of Google analytics, you just have to install their Opt-out Google Analytics browser extension and fill in some data. I really wish the EU actually did something worthwhile with the GDPR.
      - Nextgrid 6y ago
        The point of the GDPR is that you don’t have to opt-out, you have to opt-in if you are happy with tracking.
    - def_true_false 6y ago
      It seems there has been more activity since then, see here https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ Sort by amount fined.
tdsamardzhiev 6y ago
There was a joke that the fastest reader in the world is a Romanian who read 54 pages of terms and conditions in 2 seconds. So... yeah, most likely the user has "agreed".
badpun 6y ago
I work in GDPR-compliance related area in a multibillion UE corporation and I can say that right now, it's all a big joke. We have multiple huge violations and we don't do anything about it (partially because the law is so demanding that implementing it would be a massive effort). And yet, we don't get fined - partially probably because no one blew the whistle yet. I'm pretty sure the situation is very similar in all of our competitors. It seems to me that the lawyers who wrote GDPR might have been out of touch with realities of large and old companies and now the preference on regulators side might not to just not enforce the more bonkers parts of the bill? Interesting how it will play out over the next 5-10 years.
coribuci 6y ago
> I wonder if it is illegal under GDPR to include spying apps on phones without telling the user. It is illegal but it is not enforced.

curiousgal 6y ago

This is why I root my device and only allow apps I trust internet access.

jotm 6y ago
Doesn't that permanently disable some features on Samsung? I read they use a goddamn eFuse for it
- curiousgal 6y ago
  I am using a Google Pixel device. I have no idea whether Magisk works on Samsung phones.
- pongo1231 6y ago
  Yup, IIRC that disables Knox features and secure folder permanently (trips an e-fuse so there's no turning back). I don't remember if Samsung also intentionally degraded camera quality like some other vendors (Sony at least used to once you unlocked your bootloader).
amoshi 6y ago
Root and then get flagged by Google's SafetyNet, preventing you from Netflix, banking apps etc? That's a brave but big sacrifice
- NikolaeVarius 6y ago
  Systemless root + root hiding is a thing. I run a custom rom and pass safety check and have access to all my apps including banking.
  - AWildC182 6y ago
    This is why people need to start rejecting closed ecosystems. If you own the hardware you can control everything that happens on it including companies trying to force their will upon you

0xy 6y ago

I get a very uneasy feeling using Samsung's products because their privacy record is atrocious, they cram ads everywhere on flagship devices and the quality of their software is just mediocre. Unfortunately, Android has emerged as the tracking and advertising platform. Look at every single Android TV on the market, they're privacy-invading garbage and such practices are explicitly enabled and encouraged by Google.

g_p 6y ago

> And I still can't figure out why a freshly wiped unlocked phone w/ a Sprint SIM is running a Verizon provisioning process. Samsung has a rather "interesting" (to say the least) firmware development process (if you can call it a process). It seems that most handsets certainly used to ship with if-gated Verizon specific hacks all over the firmwares, regardless of market the device was for. I believe this was just for simplicity's sake. It sounds like nothing has changed there. As much as Samsung loves to advertise enterprise security like Knox, it only takes a few minutes of digging through the history of Knox to see some blunders from the early days, like storing the plaintext Knox PIN, to really wonder how on earth they can secure it. Call me old fashioned, but I just don't have any confidence in the development practices of any phone vendor these days - even plain pure AOSP Android has so many external library dependencies, each of which is receiving CVEs and patches regularly (hopefully), and needs to be kept updated by AOSP maintainers. I used to track the ancient kernel CVEs that were being rediscovered in Android due to poor or non existent source code control in OEM kernels. I gave up as it was pretty much a flood of 2 or 3 year old bugs being rediscovered as unlatched on Android or Qualcomm kernels.