8 ms·
Just wait till they: - start encrypting all the data they collect (with real encryption, not base64 encoding) - saving up the data for hours or days at time a
by cantrevealname 6y ago
Just wait till they:
- start encrypting all the data they collect (with real encryption, not base64 encoding)
- saving up the data for hours or days at time and sending it in bursts (so there is no immediate connection to a remote server)
- sending the data to plausible U.S.-registered domains (rather than to Singapore and Russia)
- monitoring at the kernel or firmware level so that it doesn't matter what browser or apps you use
- turning off data collection when it suspects a security researcher (due to signs of debuggers, development tools, network monitoring, usual network settings like to proxies or DNS, etc)
We won't be able to prove anything. So disheartening.
- WrtCdEvrydy 6y ago> due to signs of debuggers, development tools, network monitoring, usual network settings like to proxies or DNS, etc Then that's your counter measure... run a debugger 24/7.
- LeoPanthera 6y agoI wonder how many devices already do this.
- coribuci 6y ago> I wonder how many devices already do this. All Android phones. But they send the data to google and facebook so they must be good.
- vinay427 6y agoSource needed. The amount in the article is staggering compared to what Google claims to collect which is in line with the (admittedly not definitive) DNS query logs I monitor every now and then. Also, much of it (e.g. location) can be disabled and there are Android phones that are entirely free of Google and Facebook.
- freeflight 6y agoI do know for a fact that Android contacts querries Google severs to pull data from Google services, like YouTube, to fill in extra contact details on the phone. Knowing what Google's business is, I doubt they don't merge that data for a more complete profile. You can try this yourself: Create a YouTube account, upload a picture for the account, don't add details like a phone number. Now create a contact on Android, add a phone number (as most people do with contacts on their phone) and add the email address you registered the YouTube account, the Android contacts app will pull the profile picture from the YouTube account, and put it on the phone as the picture for the contact. Gave me quite a little scare when I discovered this by seeing my YouTube profile picture as the contact picture on a (rather privacy and tech-illiterate) friend's Android phone, even tho I never added any phone number to any of my Google accounts, all he did was add my email address to the contact.
- vinay427 6y agoUnfortunately I can't easily test this as my phone doesn't have the Google Contacts app and I sync my contacts with a CardDAV server, not my Google account.
- gentleman11 6y agoAs I said elsewhere on this page, Google Play gets an update from your phone every 2 minutes 24/7 with a lot of privacy settings enabled. Turn on a firewall, I think it was disconnect that showed me this
- vinay427 6y agoThe content of these updates is what is potentially concerning. Considering how much Play Services now handles, regular updates aren't that surprising, and like I said Android ≠ Google so this doesn't apply to all Android phones. The mechanism described in the article sent every visited URL in the browser and opened app or settings menu on the phone to Xiaomi.
- gentleman11 6y agoI ran a firewall on my Android once. It blocked a request to google play services every 2 minutes, 24/7. I use an iPhone now and really want a librem
- nogabebop23 6y agoWhy would they go to all that trouble? Just 1. keep sending any and all data without any obfuscation 2. blanket denial of any wrong doing, regardless of how obvious 3. decent hardware for zero down on a contract profit!!! your way is so much more work...
- thelittleone 6y agoParents option would likely get around privacy regulations in some countries. So they can do the “much more work” you mentioned and also sell decent hardware for zero down on a contract, getting a bigger total market and more surveillance info.
- nickff 6y agoWell the EU and Canada seem to be terrified of putting a foot wrong with the CPC, so my guess is that Chinese companies will violate people's privacy until it becomes so blatant that they get a polite request to tone it down (and obfuscate the collection).
- TomMarius 6y agoThe EU is not terrified, it (or rather, the local politicians) is corrupt; the politicians are willing to go as far as kissing the Chinese flag but that does not say anything about us, the citizens.
- morsch 6y agoThis brand of sharp minded and well sourced political analysis is what I appreciate about HN. The good thing is, I keep seeing more and more of it.
- orestarod 6y agoYou expect a URL for every word written? The stories showing how everyone in the West bends in order not to anger CPC are out there and well known. You can't have a recap of human history in every comment.
- ct520 6y agoWhen a new guy on the team refers to base64 encoding as encryption. /me - oh you must be new here? Serious note - welcome to the future. Nothing is private anymore.
- foobiekr 6y agoWith some fleshing out, this is an excellent rendition of the { DRM, malware, spyware } evolutionary path, pretty close to what was described to me by RealNetworks back in the dotcom era. Need to add anti-reverse-engineering techniques - obfuscation, self-modifying code, custom and hard to reason about embedded VMs, etc. other than anti-debugger and test harness detection. I think earlier on.
- paulryanrogers 6y agoI thought it went: DRM, spyware, then co-opted for malware by others.
- diminish 6y agoUnfortunately I tend to think RM Stallman is right - smartphones are a prison with tracking enabled. We're all foolish to yield that much power to vendors. Most software on the smartphones aren't under our control, we aren't able to stop them, disable them, inspect them, or see the source code. I think we should undo everything done in the smartphone since 2008 and come up with a true open source smartphone.
- badsectoracula 6y agoThe vast majority of people do not understand why this might be needed and even many of those who understand do not really believe or see it as a problem (or even see it as a benefit if they are profiting from it). Some even consider it as a good thing because it is presented as "security" and for many anything that could be secure in theory is enough to make them shut down their brains and try to see the negative sides. To make what you mention work, that smartphone will not only need to be open source, but also be much better in both UX and features and cheaper than anything similar.
- blaser-waffle 6y agoPurism is working on it. I think they're selling them now. No idea if it is good just that it's happening.
- est31 6y agoYou can still open the firmware update file in ghidra, cutter or ida pro. But yeah the trend is troubling. I also believe that it's only a matter of time once the "smart" devices (fridges, TVs, etc) start shipping with 5G modules enabled that send data to the mothership whether you set up WiFi for them or not. Because while you can't buy non-smart TVs, many users don't enable smart features by not connecting them to the network. The 5G module will probably only exist for tracking purposes and maybe firmware updates, but not for the netflix/youtube app.
- saagarjha 6y agoUntil the chip prevents copying out the firmware…
- patrickk 6y agoPerhaps a counter trend will emerge from spyware appliances will emerge, where people will pay a premium for "dumb" TVs or fridges from privacy respecting manufacturers. I've read about people already trying to purchase display model/commercial versions of TVs, which doesn't have any unnecessary smart features. The attraction is avoiding unneeded bloat, presumably longevity, and of course, privacy. There was an interesting discussion on HN recently regarding appliances that can handle open source firmware[1]. Several advantages I've found with open firmware include stability, security, avoiding unnecessary e-waste, you're not locked into a manufacturer that might discontinue support for the device, and privacy. If such appliances existed, I would certainly consider them when purchasing an appliance. [1] https://news.ycombinator.com/item?id=23001017 https://news.ycombinator.com/item?id=23001017
- rjzzleep 6y agoOTOH Xiaomi also sent out dev devices to custom rom developers. Well technically it's Poco the Xiaomi subsidiary[1] Is there any word on whether that is true for european region phones as well? From what I remember they disabled certain functionality like Face Unlock in the EU. Not sure if it was due to privacy or patents, but given the GDPR I wouldn't be surprised if it was due to privacy. [1]: https://www.xda-developers.com/poco-x2-custom-rom-kernel-developer-program/ https://www.xda-developers.com/poco-x2-custom-rom-kernel-dev...
- solarkraft 6y agoOh! That explains why my F1 has such good ROM support, it was a major reason for buying it (another one is cheap replacement parts). They still disrespect ROM users: You have to go through a convoluted process involving Windows software and a Xiaomi account AND wait 3 days to unlock the phone - but that's way down from the 6 weeks I've read about on other Xiaomis, so you can be sure I'm not going to buy one of those.
- em-bee 6y agothe delay appears to be random. my first one was 3 days, my second was more than a week until just a day before the person that i wanted to give the phone to was leaving.
- JetSpiegel 6y agoThe worse part is requiring a SIM card on the phone the whole time, hoovering your IMEI and phone number in the process.
- myrloc 6y agoExcuse my naïveté, but who would actually work on such things? How can someone have such low moral standards to, day after day, build systems that secretly remove privacy from otherwise innocent people?
- orestarod 6y agoMoney lowers moral standards.
- Fishmanos 6y agolawyers?
- gentleman11 6y ago“Money makes a man act funny” -Eminem. I have had friends suddenly get very selfish when the chance to get even $10 is available. I had a regular at a retail job once who came in every day... he asked to borrow $1 once to help pay for something. To avoid paying it back, he never returned, likely walking an extra several km to the next nearest store of the type every day. For $1
- nexus2045 6y agoMost people are just following orders at their job, where they've got bills to pay. Morals are not so important on the hierarchy of needs. It might not even be something that crosses those worker's minds because of a much different upbringing/education than yours.
- throwaway_pdp09 6y agoWhat is it with you saddos that you have to drag your apathy into everything and project your helplessness (or laziness more like) onto all others. "We're so screwed, we can't do anything, can't prove/so disheartening" You don't deserve to live in a free society if you're so willing to curl up like a prodded slug at such trivial adversities. Join the EFF, do something FFS, don't whine.
- krick 6y agoYeah, it would be indistinguishable from what Google does. Oh, wait...
- bythckr 6y agoI know I am being naive, but what I can do? A normal used that is wants privacy? I expected some Volkswagen like defeat device to in phones to evade security audit. But what can "I" do, considering that the bodies & Govt that are suppose to do something are busy stuffing their own pockets and busy with petty politics. Open-source hardware progress is very slow and low RAM. How safe will I be if I just run LineageOS on a Xiaomi device?
- st1ck 6y agoAs a normal user who wants privacy, you'll be just fine with LineageOS on Xiaomi. Assuming you don't install spyware later. You don't even have to install Google apps (see f-droid and Aurora store).