6 ms·
This paragraph stood out to me: > The intention here seems to be that aigt is the timestamp when the ID was generated. So if that timestamp deviates from curre
by danpalmer 6y ago
This paragraph stood out to me:
> The intention here seems to be that aigt is the timestamp when the ID was generated. So if that timestamp deviates from current time by more than 7776000000 milliseconds (90 days) a new ID is going to be generated. However, this implementation is buggy, it will update aigt on every call rather than only when a new ID is generated. So the only scenario where a new ID will be generated is: this method wasn’t called for 90 days, meaning that the browser wasn’t started for 90 days. And that’s rather unlikely, so one has to consider this ID permanent.
If we assume that Xiaomi aren't literally trying to spy for a government and are in fact just poorly calibrated on what's legitimate to collect for product analytics purposes, this paragraph highlights why that's still incredibly dangerous despite "good intentions".
I remember the UK government investigation into Huawei concluding that not only was their security posture insufficient for critical infrastructure, but their engineering practices were likely a decade away from being at a point where they could start to claim good security practice.
This paragraph seems to suggest a similar problem at Xiaomi. This should have been caught at a security review stage during design, it should have been caught at the code review stage, it should have been caught by automated tests, it should have been caught by QA, it should have been caught once live by data tests, it should have been seen once live by analysts, it should have been fixed at so many different points. The fact it wasn't suggests that these stages either don't exist or are insufficient.
- michaelcampbell 6y ago> If we assume that Xiaomi aren't literally trying to spy for a government Is that even allowed by Chinese law?
- Craighead 6y agoNo
- buildbot 6y agoI believe the implication would be they are spying for China in this case, and therefore as legal as they want it to be.
- michaelcampbell 6y agoRight, I meant is it allowed by Chinese law to NOT spy for the government. As I understand it, to be allowed to operate in China as a Chinese company, you are under the obligation to provide any information you collect to the gov't upon request. Is that not the case?
- thoughtstheseus 6y agoThat is the case.
- onethought 6y agoAustralia has similar laws also.
- stjohnswarts 6y agoNot sure why you're getting downvoted, what you stated is correct. https://phys.org/news/2018-12-australia-cyber-snooping-laws-global.html https://phys.org/news/2018-12-australia-cyber-snooping-laws-...
- Daho0n 6y agoSo does the US. The only real difference between countries is not if it is different but how each has implemented it in law. The result is the same.
- dodobirdlord 6y agoGoogle publishes a transparency report with aggregate information on government requests for user data, and regularly challenges requests to reduce their scope. To pretend that this is the same as China is a joke. https://support.google.com/transparencyreport/answer/9713961 https://support.google.com/transparencyreport/answer/9713961
- onethought 6y ago
- duxup 6y agoI believe they're required to comply if asked. In theory they could have not been asked...
- ajsnigrutin 6y agoBetter question is, why are those devices allowed to be sold in EU/US/...
- wonnage 6y agoif you mean this in the sense that "all chinese companies are automatically spy agencies", then no, that's certainly not true. But would they have to comply with a government request - yeah, probably, just like any other company.
- michaelcampbell 6y agoThat feels like a distinction without a difference. The gov't has access to all the the data of all Chinese companies, and those companies are not required to divulge that to their consumers.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- sammorrowdrums 6y agoGenuinely, I really want to see Purism succeed and increasing numbers of competitors in that space, because we need tools that don't require so much blind trust. Whether caused by inept software devs, scope for malicious code / backdoors in firmware, analytics spyware, and whether this stuff is well intentioned or not, if it can be abused, it will be. Open source and verifiable down to the firmware is the only chance we have at any real level of trust, otherwise as is always apparent in these conversations, it often falls otherwise to who you think could compromise your device and making your bed with it, like USA not China or vice versa
- cosmodisk 6y agoThe problem is that purism doesn't pay as much as all the tracking, preinstalled bloatware, random 3rd party utilities and other stuff. This will never ever be solved through competition,because people either don't care, or there aren't enough of those who do. Legislation is the only way to make it work, but then again, that's hardly an option for most of the world.
- javajosh 6y agoThere is clearly at least a niche market for "transparent devices". See https://www.crowdsupply.com/sutajio-kosagi/precursor https://www.crowdsupply.com/sutajio-kosagi/precursor for example.
- fsflover 6y agoPurism are trying to lobby for the legislation [0] and to change the industry [1]. [0] https://puri.sm/posts/purisms-ceo-todd-weaver-testifies-at-state-senate/ https://puri.sm/posts/purisms-ceo-todd-weaver-testifies-at-s... [1] https://wp.puri.sm/posts/breaking-ground/ https://wp.puri.sm/posts/breaking-ground/
- africanboy 6y agoas much as I am eager to see open source mobile OS succeed, tracking happens at the app level. What happens when I install the FB app on a Purism enabled device? My way to go until now has been installing as many OSS apps on my smartphone as possible, to the point that even the keyboard and the launcher on my smartphone are installed through f-droid. That's the main reason why I prefer Android phones over Apple ones.
- africanboy 6y agoI'm writing this from a Xiaomi smartphone. I know Xiaomi is not the best brand to buy for privacy, but I consider their products one of the best in terms of value for money I own a few Xiaomi devices, I simply install Blokada on each one of them and I think you would be surprised by how many non Chinese domains it blocks, Google being one of the worst offenders. EDIT: see this screenshot https://imgur.com/a/UO0BGCy https://imgur.com/a/UO0BGCy EDIT 2: paradoxically knowing that Xiaomi is a Chinese company make buyers more aware of the privacy risks involved. It breaks that false sense of security associated with electronic devices that many people believe in.
- petra 6y agoHow do you whether Xiaomi's spyware doesn't bypass Blockada ?
- africanboy 6y agoHonestly I don't, the same way I don't know if Google is bypassing them. But according to the logs on my router Blokada is working. p.s. blokada actually also blocks ads on the formula 1 official app that are served through websockets
- ignoramous 6y agoThere are a lot of binaries other than Android that run on Smartphones that you cannot possibly control from within Android even with fully-privileged apps (let alone restricted user-space apps). And, even within Android, because Blokada doesn't support "Block connection without VPN", there's no guarantee that apps don't bypass the VPN it sets up. Besides, Blokada leaks DNS requests over TCP (only handles the UDP ones) [0]. All of this is discounting the fact that Blokada has a hard-coded list of applications it blanket allows by-default [1]. Also, these fingerprinting bits in their code-base doesn't inspire confidence either [2][3]. I'd not consider Blokada a serious security app at this point, though it does have the potential to be one. disclosure: I co-develop a similar foss app. [0] https://github.com/blokadaorg/blokada/blob/65992cdc/android5/app/src/engine/kotlin/engine/PacketLoopForLibre.kt#L93 https://github.com/blokadaorg/blokada/blob/65992cdc/android5... [1] https://github.com/blokadaorg/blokada/blob/8702350602b/android5/app/src/main/java/repository/AppRepository.kt#L49 https://github.com/blokadaorg/blokada/blob/8702350602b/andro... [2] one identifier too many for a user-agent: https://github.com/blokadaorg/blokada/blob/8702350602b/android5/app/src/main/java/service/EnvironmentService.kt#L27-L38 https://github.com/blokadaorg/blokada/blob/8702350602b/andro... [3] unique identifier per installation: https://github.com/blokadaorg/blokada/blob/04efb84e06e1/android5/app/src/main/java/ui/MainActivity.kt#L230 https://github.com/blokadaorg/blokada/blob/04efb84e06e1/andr...
- UnpossibleJim 6y ago|This should have been caught at a security review stage during design, it should have been caught at the code review stage, it should have been caught by automated tests, it should have been caught by QA, it should have been caught once live by data tests, it should have been seen once live by analysts, it should have been fixed at so many different points.| If the very first people (presumably the "higher ups"/more prestigious designers) in the design process miss such things, it is very hard to call them out in a societal construct that is the business construct that has become Xiaomi and the Chinese Government. It's hard enough in some companies for QA to question software engineers and not catch backlash in the US when making games. Companies like EA, Atari and Nintendo are notorious for it. Apple used to shitcan QA who didn't treat "the talent" nice enough, and they weren't a quasi governmental entity. You're right, of course. But man, that's a big frog in your throat to go up to your manager and say, "Sir, I'm sorry but this whole process has issues. Here's the fix, but it means a redesign of a core process." That's tough. That's double tough.
- danpalmer 6y agoThis is something that a company with a mature security posture needs though. Yes it's hard, but that's the point. There are many ways to work around this, having teams whos incentives are tied to finding issues, maybe in a different reporting chain or office or country to those writing the software is one way.
- UnpossibleJim 6y agoI think incentivizing and anonymizing issue finding by restructure sound like amazing ideas, to be honest. Having batch issues come in to the devs via bug tracking software and conversations be labeled with a user ID rather than name would make a world of difference; so would basic professionalism. An understanding that it isn't team against team. Sdets (and manual testers) are not adversaries to devs or management... Though, I think a lot of devs realize this but project management/producers have a harder time understanding this. This is where I think a basic understanding of coding and the development pipeline would help a lot. But, here we are. In the real world =/
- 6y ago
- rsj_hn 6y agoThat can be explained as a bug, but tracking what you typed into youtube search boxes doesn't seem like a bug and has no justification in terms of performance optimization.
- 45ure 6y ago>I remember the UK government investigation into Huawei concluding that not only was their security posture insufficient for critical infrastructure, but their engineering practices were likely a decade away from being at a point where they could start to claim good security practice. This paragraph seems to suggest a similar problem at Xiaomi. ASFAIK, Xiaomi does not sell any critical infrastructure equipment, nor is it installed anywhere; not entirely sure why GCHQ or NCSC would be involved, especially when there is ambiguity around which/what equipment they should be conducting a code review upon? With regard to Huawei, there was no decisive conclusion, despite a comprehensive security review. Furthermore, it has been business as usual for currently installed equipment. All future decisions will be based around the 5G infrastructure.
- cmeacham98 6y agoPresumably phones used by government employees in relation to sensitive data are security critical? I'm not aware if their phones are being used in the wild in such a way but it's not hard to imagine such use cases.
- thw0rted 6y agoHere in Europe, Huawei and Xiaomi are two of the most popular phone brands I see in shops. Even if the government isn't actually buying them to issue as "work phones" for employees, those employees are certainly buying them for personal use, carrying them to sensitive places, and leaking their own life details. You'd have to be a complete idiot to believe that the CCP isn't happily digging through all the data they send back.
- dreamcompiler 6y ago> This should have been caught at a security review stage during design, it should have been caught at the code review stage, it should have been caught by automated tests, it should have been caught by QA, it should have been caught once live by data tests, it should have been seen once live by analysts, it should have been fixed at so many different points. Seems more likely this was done on purpose so if they got caught they could say "Junior engineer made a mistake. So sorry."
- soared 6y agoHanlon's razor is a principle or rule of thumb that states "never attribute to malice that which is adequately explained by stupidity"
- learnstats2 6y agoI find it a bad principle which absolves responsibility. Stupidity is the same as malice, if the outcome is the same.
- dreamcompiler 6y agoMy corollary to Hanlon's Razor is "When you and/or your associates have been caught being malicious multiple times, Hanlon's Razor no longer applies to you."
- ComodoHacker 6y agoAnother possible explanation is this isn't a bug, but intended behavior. If the browser hasn't been used for 90 days, this might be a good indication that the phone has changed hands, and you need to generate a new ID.