> The data that Xiaomi was sending was admittedly “encrypted”, but it was encoded in base64, which can easily be decoded. Base64 isn't encryption. It's encodin

> The data that Xiaomi was sending was admittedly “encrypted”, but it was encoded in base64, which can easily be decoded. Base64 isn't encryption. It's encoding. Not the same thing. In truth then, the data was not encrypted, it was sent in the clear (or at least with no additional encryption layered over the web protocol), having been compressed with gzip and then encoded using base 64. Not sure it matters though. Doesn't seem clear whether it was sent over HTTPS, which would count as encryption, but doesn't much ameliorate the privacy concerns. That Xiaomi appears to be straight-up lying about it is all the more damning.