9 ms·

I noticed all the recent printers from HP required a setup which... - Required me to install an app - Required me to enable gps on my device (and allow app to

I noticed all the recent printers from HP required a setup which... - Required me to install an app - Required me to enable gps on my device (and allow app to access) - Printer phoned home after / during setup (as did the app) They really don’t need the dots any more when they know the gps coordinates and have the ability to send anything they want to and from the device. I personally spoofed the gps, ran a vpn and blocked the device from phoning home (after setup). Had me saying “what the f**!?” a couple of times.

NavinF 5y ago
I assume you're talking about WiFi setup? Ethernet to your switch or USB to a RPi should be a lot more reliable and works without an app. Then again, I haven't set up a printer in a decade.
JoshTriplett 5y ago
I just recently set up one of those printers. They have a lot of dark patterns trying to steer you towards the app (and the "instant ink" junk), but it was still possible to skip over that and do all the setup on the printer itself, at which point it became a normal discoverable network printer.
MaxBarraclough 5y ago
Do you have the option of using Free and Open Source drivers?
lsiq 5y ago
I stopped buying HP printers a decade ago when I found tons of HP spyware when doing some system cleaning.
- unixhero 5y ago
  Just use a Unix based OS like OSX and Linux. No spyware / adware drivers needed. Solved
  - squarefoot 5y ago
    Using an Open Source OS helps with malware hidden into drivers or the related installed junk, but unfortunately most network printers phone home, officially to download updates, as soon as they detect a network connection, and there's no way to know or control what they'll do with that connection, short of putting them behind a dedicated firewall. We have approached the era in which all networked devices should be considered as potentially harmful and dealt appropriately. From TVs to household appliances, home automation systems etc, everything could be used to grab personal information. Hiding a mic or a micro camera into a printer, or any other device, as of today is cheap and trivial. We should consider an untrusted separated network path for all these devices in the home network, so that they can't access our files and their connection attempts would be actively monitored and controlled.
    - Silhouette 5y ago
      We have approached the era in which all networked devices should be considered as potentially harmful and dealt appropriately. We're well into that era, but neither the technological protections nor the legal ones have kept up. Tech laws are still barely on the level of requiring manufacturers of network devices not to use the same default password every time and manufacturers of kitchen appliances to accept some basic "right to repair" provisions. These are steps in the right direction of course but they are small steps at the start of a marathon. I think a lot of political leaders fail to appreciate the danger here. This has somehow remained true even as tech crime is rocketing. We are seeing more and more headlines about how some aspect of critical infrastructure has been brought down due to some form of technological attack, businesses have lost money due to data losses, people have had their identities stolen after data breaches, etc. Meanwhile, the tech firms best placed to defend ordinary people and businesses against these kinds of attack are often the ones carrying out the attacks. The fox is guarding the hen house. Just yesterday, there was a news story in the UK[1] about some home car charging stations being vulnerable to simple attacks. These devices get connected to both home networks and electricity grids. The specific models in question were government-approved too. I think typical open-by-default networking is fundamentally broken today. It's like software for non-experts that doesn't have the option to install security updates automatically, or a browser or mobile OS that doesn't sandbox web pages or apps individually. Professionals use many tools to lock down organisational networks, audit and manage connected devices, and deal with modern challenges like bring-your-own-device, and they still get hit from time to time. Meanwhile home users are basically expected to install a new Trojan every time they buy a new device. This is not going to end well. [1] https://www.bbc.co.uk/news/technology-58011014 https://www.bbc.co.uk/news/technology-58011014
- mcv 5y ago
  I have a Samsung printer, but support for that also switched to HP a number of years ago. I would really like to know if there's a good printer manufacturer that makes simple, high quality printers that just work, don't require all these needless hoops, and respect the customer. Sounds like there should be a market for that, and yet somehow all printer manufacturers seem to suck.
  - deleted 5y ago
    [deleted]
  - tpxl 5y ago
    Isn't brother in that ballpark?
    - pnutjam 5y ago
      Yeah, brother is my go to now. Laser b/w for less then $150. I have a color 4040 that I got a great deal on.
    - sgtnoodle 5y ago
      I have a $100 brother laser printer, and it's not too bad. It took me a while to get it working on arch Linux reliably over wifi, but that was more of an arch issue.
      - mcv 5y ago
        Well, my Samsung doesn't work reliably over wifi from Windows and Mac, so this issue is hardly limited to Brother and Arch.
        sgtnoodle 5y ago
        Specifically, arch wasn't running any zero-conf services out of the box. CUPS would auto-detect the printer just fine, but then try to connect to it via an mDNS hostname, and the connection would fail. Once I figured that out and got mDNS working, it's been reliable. A lot of wifi problems are due to bad/flaky access point hardware. Notably, a lot of the internet recommended "good" consumer wifi gear actually sucks from a reliability point of view. It took me months to get my home setup reliable enough to take it for granted.
Renaud 5y ago
Any device that requires someone to install and app and register to make it work should have a prominent label on the box. There should be a labelling standard for this where the manufacturer must disclose if any registration is required to operate the device to its full potential, if any app or special software is needed other than a system driver, if any phone-home data is being sent, and what data is actually sent, when and why. "Buyer beware" but most of the time you have no idea what the experience will be like. It's usually not disclosed on the box, reviews rarely mention it and I'd like to have a sure way of being informed before I make my purchase. It's a similar thing with software, software and apps that require registration for no other reason than add you to their marketing list, but it's particularly egregious with physical items.
- R0b0t1 5y ago
  If you don't want to install the app or create an account you can return the device at no cost. I don't think most box stores will fight you on this. Online sellers usually will, return shipping can be very expensive.
  - boomboomsubban 5y ago
    The time spent trying to set it up is worth requiring a label on the box. I sort of assume it is already required. You need to agree to conditions to create an account anywhere, surely a product needs to tell you about it's data vacuum before you spend hundreds of dollars on it.
  - thelittleone 5y ago
    Depends on the country you're in. Doubt you'd have much luck returning it for this reason in Indonesia.
    - R0b0t1 5y ago
      They have no buyer protection at all? A jurisdiction which breaks the assumption you are sold working objects is a problem, I suppose.
  - 5y ago
Ieghaehia9 5y ago
That makes me wonder: wouldn't there be a market for a printer that clearly doesn't leak any information? Say one with open firmware that parses PCL5 or Postscript or whatever the modern analog is. "Keep your secrets safe with Printer X". Or would the state come down hard on any such manufacturer?
- remontoire 5y ago
  I suspect that the company would get a visit from the secret service
  - zodiakzz 5y ago
    The default assumption should always be that everything is backdoored, _especially_ these "privacy-first" products
    - Ieghaehia9 5y ago
      That's why it would need a software equivalent of nothing-up-my-sleeve numbers, i.e. open-source firmware. There's still Trusting Trust, but that's rather harder to pull off.
      - fsflover 5y ago
        https://ryf.fsf.org https://ryf.fsf.org
        nine_k 5y ago
        Interestingly, there's not even a section for printers in that list.
        fsflover 5y ago
        Yes, there is no single printer that respects your rights.
TroisM 5y ago
I recently got a HP LaserJet Pro M15W Printer and I didn't need to install an app... But I don't use it's wifi capabilities and plug it in with a USB cable.
nwallin 5y ago
Why do people buy printers that aren't from Brother?
- Ballas 5y ago
  Although I agree with the statement for other reasons, do you know that Brother does not do anything similar to what is reported in the article?
  - hitpointdrew 5y ago
    If you follow the link in the article to the EFF site, they basically warn that they no longer maintain a list of printers that have these dots, because every modern printer has these. Basically there are no options if you don’t want these dots.
- R0b0t1 5y ago
  I remember the advice to buy a brother circa 2015-2017. Apparently it has changed? Personally unsure, I just bought one, as I worked backwards from "which printer has the cheapest toner" and it is still brother. There is no way to force the business models to keep printing on a full cartridge that has met its page limit(per reviews on Amazon), and the salesman at a store told me brothers have replaceable parts in them now besides the toner carts that they force you to replace.
- spiritplumber 5y ago
  I have a HL-1440 that is old enough to still have a Centronics connector (in addition to USB1) and it's a tank. I had to take it apart once between 2008, when I got it from a university that was throwing it out, and today. It prints all my shipping labels.
- diamondo25 5y ago
  Brother software has always been the worst experience for me. Its like some ancient Windows XP setup that you have to download from a 2003 website that sometimes gives errors and isnt very helpful. Uninstalling feels like Norton, where you probably need extra software to remove the crud it left behind.
seszett 5y ago
Permission to access location on Android is needed to scan for wireless networks (because such a scan allows to find your location from the networks in range). It doesn't necessarily mean that the app accessed your GPS location. Depending on your device, actual access might be shown, I recently installed an Epson printer and while the app needed location permission, it did not access might coordinates, it only scanned for wifi networks.
- AshamedCaptain 5y ago
  people are ridicously paranoid with the "gps permission", when usually just connecting a device to the internet is likely to allow it to obtain its location with more accuracy than gps for over 50% of homes.
  - guerrilla 5y ago
    There's a difference between being paranoid and not willing to risk it. You don't actually know which it was asking for, being that the access controls aren't fine grained enough is the problem here.
    - slavik81 5y ago
      It's the same permission because WiFi networks are basically landmarks. If you see the Eiffel tower, you know you're in Paris. Similarly, if you see network id X, you know you're near location Y. One day, the camera permission will probably have the same problem. The time of day and position of the sun can give a coarse location, and perhaps future algorithms will be able to search Google Street View to find your exact location.
      - godelski 5y ago
        > perhaps future algorithms will be able to search Google Street View to find your exact location. So actually intelligence organizations already do this. If they have a mundane picture of an adversary they will try to pinpoint where the picture was taken. Of course there's more clues that they have because they know things about the target, but I guess I'm saying it's not unreasonable to believe such a thing could exist today.
bobmaxup 5y ago
Good luck finding a company that does things much differently. There is a printer cartel, and they want every penny they can squeeze out of those things.
- grishka 5y ago
  What exactly is stopping people from designing an open-source printer? Even if it is patents, surely many of them should have expired by now?
  - willis936 5y ago
    It's the size of the market. The startup cost of making a competitively cheap printer is much larger than the expected revenue. Would you pay $2000 for a whitebox printer? Would anyone? It'd be a cool passion project, but making a legitimate business out of it would be hard. One big question I have: "is it legal to sell a printer that requires the use of someone else's toner?". If so, then the concern about sourcing toner after the whitebox company fails can be addressed in the design stage. What I really want to know is why there is no BYOPK whitebox TPM product. That should be easy to make and could dominate the market.
    - grishka 5y ago
      Toner or ink shouldn't be much of a problem IMO — you can buy off-brand ink and toner for DIY cartridge refills for existing proprietary printers.
ta988 5y ago
Never buy HP, sane brands like Brother don't require that.

NavinF 5y ago

I assume you're talking about WiFi setup? Ethernet to your switch or USB to a RPi should be a lot more reliable and works without an app. Then again, I haven't set up a printer in a decade.

JoshTriplett 5y ago

I just recently set up one of those printers. They have a lot of dark patterns trying to steer you towards the app (and the "instant ink" junk), but it was still possible to skip over that and do all the setup on the printer itself, at which point it became a normal discoverable network printer.

MaxBarraclough 5y ago

Do you have the option of using Free and Open Source drivers?

lsiq 5y ago

I stopped buying HP printers a decade ago when I found tons of HP spyware when doing some system cleaning.

unixhero 5y ago
Just use a Unix based OS like OSX and Linux. No spyware / adware drivers needed. Solved
- squarefoot 5y ago
  Using an Open Source OS helps with malware hidden into drivers or the related installed junk, but unfortunately most network printers phone home, officially to download updates, as soon as they detect a network connection, and there's no way to know or control what they'll do with that connection, short of putting them behind a dedicated firewall. We have approached the era in which all networked devices should be considered as potentially harmful and dealt appropriately. From TVs to household appliances, home automation systems etc, everything could be used to grab personal information. Hiding a mic or a micro camera into a printer, or any other device, as of today is cheap and trivial. We should consider an untrusted separated network path for all these devices in the home network, so that they can't access our files and their connection attempts would be actively monitored and controlled.
  - Silhouette 5y ago
    We have approached the era in which all networked devices should be considered as potentially harmful and dealt appropriately. We're well into that era, but neither the technological protections nor the legal ones have kept up. Tech laws are still barely on the level of requiring manufacturers of network devices not to use the same default password every time and manufacturers of kitchen appliances to accept some basic "right to repair" provisions. These are steps in the right direction of course but they are small steps at the start of a marathon. I think a lot of political leaders fail to appreciate the danger here. This has somehow remained true even as tech crime is rocketing. We are seeing more and more headlines about how some aspect of critical infrastructure has been brought down due to some form of technological attack, businesses have lost money due to data losses, people have had their identities stolen after data breaches, etc. Meanwhile, the tech firms best placed to defend ordinary people and businesses against these kinds of attack are often the ones carrying out the attacks. The fox is guarding the hen house. Just yesterday, there was a news story in the UK[1] about some home car charging stations being vulnerable to simple attacks. These devices get connected to both home networks and electricity grids. The specific models in question were government-approved too. I think typical open-by-default networking is fundamentally broken today. It's like software for non-experts that doesn't have the option to install security updates automatically, or a browser or mobile OS that doesn't sandbox web pages or apps individually. Professionals use many tools to lock down organisational networks, audit and manage connected devices, and deal with modern challenges like bring-your-own-device, and they still get hit from time to time. Meanwhile home users are basically expected to install a new Trojan every time they buy a new device. This is not going to end well. [1] https://www.bbc.co.uk/news/technology-58011014 https://www.bbc.co.uk/news/technology-58011014
mcv 5y ago
I have a Samsung printer, but support for that also switched to HP a number of years ago. I would really like to know if there's a good printer manufacturer that makes simple, high quality printers that just work, don't require all these needless hoops, and respect the customer. Sounds like there should be a market for that, and yet somehow all printer manufacturers seem to suck.
- deleted 5y ago
  [deleted]
- tpxl 5y ago
  Isn't brother in that ballpark?
  - pnutjam 5y ago
    Yeah, brother is my go to now. Laser b/w for less then $150. I have a color 4040 that I got a great deal on.
  - sgtnoodle 5y ago
    I have a $100 brother laser printer, and it's not too bad. It took me a while to get it working on arch Linux reliably over wifi, but that was more of an arch issue.
    - mcv 5y ago
      Well, my Samsung doesn't work reliably over wifi from Windows and Mac, so this issue is hardly limited to Brother and Arch.
      - sgtnoodle 5y ago
        Specifically, arch wasn't running any zero-conf services out of the box. CUPS would auto-detect the printer just fine, but then try to connect to it via an mDNS hostname, and the connection would fail. Once I figured that out and got mDNS working, it's been reliable. A lot of wifi problems are due to bad/flaky access point hardware. Notably, a lot of the internet recommended "good" consumer wifi gear actually sucks from a reliability point of view. It took me months to get my home setup reliable enough to take it for granted.

Renaud 5y ago

Any device that requires someone to install and app and register to make it work should have a prominent label on the box. There should be a labelling standard for this where the manufacturer must disclose if any registration is required to operate the device to its full potential, if any app or special software is needed other than a system driver, if any phone-home data is being sent, and what data is actually sent, when and why. "Buyer beware" but most of the time you have no idea what the experience will be like. It's usually not disclosed on the box, reviews rarely mention it and I'd like to have a sure way of being informed before I make my purchase. It's a similar thing with software, software and apps that require registration for no other reason than add you to their marketing list, but it's particularly egregious with physical items.

R0b0t1 5y ago
If you don't want to install the app or create an account you can return the device at no cost. I don't think most box stores will fight you on this. Online sellers usually will, return shipping can be very expensive.
- boomboomsubban 5y ago
  The time spent trying to set it up is worth requiring a label on the box. I sort of assume it is already required. You need to agree to conditions to create an account anywhere, surely a product needs to tell you about it's data vacuum before you spend hundreds of dollars on it.
- thelittleone 5y ago
  Depends on the country you're in. Doubt you'd have much luck returning it for this reason in Indonesia.
  - R0b0t1 5y ago
    They have no buyer protection at all? A jurisdiction which breaks the assumption you are sold working objects is a problem, I suppose.
- 5y ago

Ieghaehia9 5y ago

That makes me wonder: wouldn't there be a market for a printer that clearly doesn't leak any information? Say one with open firmware that parses PCL5 or Postscript or whatever the modern analog is. "Keep your secrets safe with Printer X". Or would the state come down hard on any such manufacturer?

remontoire 5y ago
I suspect that the company would get a visit from the secret service
- zodiakzz 5y ago
  The default assumption should always be that everything is backdoored, _especially_ these "privacy-first" products
  - Ieghaehia9 5y ago
    That's why it would need a software equivalent of nothing-up-my-sleeve numbers, i.e. open-source firmware. There's still Trusting Trust, but that's rather harder to pull off.
    - fsflover 5y ago
      https://ryf.fsf.org https://ryf.fsf.org
      - nine_k 5y ago
        Interestingly, there's not even a section for printers in that list.
        fsflover 5y ago
        Yes, there is no single printer that respects your rights.

TroisM 5y ago

I recently got a HP LaserJet Pro M15W Printer and I didn't need to install an app... But I don't use it's wifi capabilities and plug it in with a USB cable.

nwallin 5y ago

Why do people buy printers that aren't from Brother?

Ballas 5y ago
Although I agree with the statement for other reasons, do you know that Brother does not do anything similar to what is reported in the article?
- hitpointdrew 5y ago
  If you follow the link in the article to the EFF site, they basically warn that they no longer maintain a list of printers that have these dots, because every modern printer has these. Basically there are no options if you don’t want these dots.
R0b0t1 5y ago
I remember the advice to buy a brother circa 2015-2017. Apparently it has changed? Personally unsure, I just bought one, as I worked backwards from "which printer has the cheapest toner" and it is still brother. There is no way to force the business models to keep printing on a full cartridge that has met its page limit(per reviews on Amazon), and the salesman at a store told me brothers have replaceable parts in them now besides the toner carts that they force you to replace.
spiritplumber 5y ago
I have a HL-1440 that is old enough to still have a Centronics connector (in addition to USB1) and it's a tank. I had to take it apart once between 2008, when I got it from a university that was throwing it out, and today. It prints all my shipping labels.
diamondo25 5y ago
Brother software has always been the worst experience for me. Its like some ancient Windows XP setup that you have to download from a 2003 website that sometimes gives errors and isnt very helpful. Uninstalling feels like Norton, where you probably need extra software to remove the crud it left behind.

seszett 5y ago

Permission to access location on Android is needed to scan for wireless networks (because such a scan allows to find your location from the networks in range). It doesn't necessarily mean that the app accessed your GPS location. Depending on your device, actual access might be shown, I recently installed an Epson printer and while the app needed location permission, it did not access might coordinates, it only scanned for wifi networks.

AshamedCaptain 5y ago
people are ridicously paranoid with the "gps permission", when usually just connecting a device to the internet is likely to allow it to obtain its location with more accuracy than gps for over 50% of homes.
- guerrilla 5y ago
  There's a difference between being paranoid and not willing to risk it. You don't actually know which it was asking for, being that the access controls aren't fine grained enough is the problem here.
  - slavik81 5y ago
    It's the same permission because WiFi networks are basically landmarks. If you see the Eiffel tower, you know you're in Paris. Similarly, if you see network id X, you know you're near location Y. One day, the camera permission will probably have the same problem. The time of day and position of the sun can give a coarse location, and perhaps future algorithms will be able to search Google Street View to find your exact location.
    - godelski 5y ago
      > perhaps future algorithms will be able to search Google Street View to find your exact location. So actually intelligence organizations already do this. If they have a mundane picture of an adversary they will try to pinpoint where the picture was taken. Of course there's more clues that they have because they know things about the target, but I guess I'm saying it's not unreasonable to believe such a thing could exist today.

bobmaxup 5y ago

Good luck finding a company that does things much differently. There is a printer cartel, and they want every penny they can squeeze out of those things.

grishka 5y ago
What exactly is stopping people from designing an open-source printer? Even if it is patents, surely many of them should have expired by now?
- willis936 5y ago
  It's the size of the market. The startup cost of making a competitively cheap printer is much larger than the expected revenue. Would you pay $2000 for a whitebox printer? Would anyone? It'd be a cool passion project, but making a legitimate business out of it would be hard. One big question I have: "is it legal to sell a printer that requires the use of someone else's toner?". If so, then the concern about sourcing toner after the whitebox company fails can be addressed in the design stage. What I really want to know is why there is no BYOPK whitebox TPM product. That should be easy to make and could dominate the market.
  - grishka 5y ago
    Toner or ink shouldn't be much of a problem IMO — you can buy off-brand ink and toner for DIY cartridge refills for existing proprietary printers.

ta988 5y ago

Never buy HP, sane brands like Brother don't require that.