5 ms·

Not using one of these in my life without a privacy-focused ROM. fingers crossed they get it ported, because the hardware truly looks insane. Xiaomi has a lot o

Not using one of these in my life without a privacy-focused ROM. fingers crossed they get it ported, because the hardware truly looks insane. Xiaomi has a lot of products like this: cheap, very low profit margin by production costs, but very ad-filled and data-collecting by default. I own a $30 mi band 5, with Gadgetbridge, an open source fitness tracker app. Absolutely worth the price if you can bypass the malware built into it.

pjmlp 5y ago
Yeah, we should strive to get European tech free of US three letter agencies power.
chii 5y ago
> worth the price if you can bypass the malware built into it. how much work is it to flash it to your own software? can a layperson follow some instructions and get it done without deeply knowing anything?
- kaladin-jasnah 5y ago
  Instructions are usually pretty clear (eg. XDA posts for ROM releases or LineageOS wiki pages are usually quite clear, the latter being more than the former IMO). It might be harder, but usually laypeople can get by (eg. aren't particularly knowledgeable but perhaps aren't afraid of using the command line either, even if it's just copypasting). At least that's the impression I get from people posting on XDA. Either way, I can usually flash ROMs without issue (I don't know a lot about Android but I do understand how my computer works, I guess), but when I do it I usually get incredibly nervous and panicky out of fear that I'll brick my phone or I forgot to back up something important.
- sodality2 5y ago
  Well, the fitness band didn't have its firmware flashed. that's not where the tracking is anyway. It's a different app being used to collect the data. Recent models of many Xiaomi bands require an authorization code that must be taken from an existing account that has linked with the watch. If someone's skilled enough to run a python script they can get the code and install Gadgetbridge.
- kyriakos 5y ago
  Tracking for mi band is in the android app rather than the band itself. All you need to do is replace it with a more privacy focused app.
secondaryacct 5y ago
There are two backdoor potential you know. The software, which on my Huawei I prevent with a whitelist firewall which works so insanely well that it doubled my battery life, and the radio chip. Sadly, whatever you do, on all phones manufactured in China or designed in the US, you risk a hardware backdoor you can never inspect. What do you know of the radio chipset, taking electricity to connect to the remote antenna: it can probably ping, get signal from the mic and gps, or the camera etc. If you re going to be paranoid, because you attack children or sell drugs, why the hell do you buy phones in the first place !?
- sodality2 5y ago
  IMO, the risk of a hardware backdoor is always there and perhaps less damaging if the country is across the world, depending on the threat model and damage model. realistically you're right, and I probably would deeply consider my options before thinking about it. But we can go down the list of lower and lower firmware that we cant verify (hell, I just reread Reflections on Trusting Trust this morning). Every device has Chinese-made chips. I suppose it's more risky than an American company but to me it seems like rearranging chairs on a sinking ship, which is why I never keep anything sensitive on my phone.
- 3np 5y ago
  > If you re going to be paranoid, because you attack children or sell drugs, why the hell do you buy phones in the first place !? While the rest of your comment is accurate, this is disingenuous. There are plenty of valid reasons to have concerns over this besides those drilled by the powers that be. Besides, it's still reasonable to want to reduce your potential attack surface. Sure, federal agencies may root you if they really want but that doesn't mean it's pointless to avoid OS-level preinstalled backdoors from the manufacturer.
  - deleted 5y ago
    [deleted]
- mdp2021 5y ago
  > If you re going to be paranoid, because you attack children or sell drugs, why the hell do you buy phones in the first place !? If you are going to joke, kindly mark it, so we do not misunderstand you, and so you do not cause internal damages to those who are not trained to always keep neurovegetative and limbic on guard while reading - you know, that occasional moment in which you trust what you read and the physiological reactions start, before the prefrontal goes "wait a moment, that may be not serious". People have -- a privacy to defend as a principle («privacy to defend», what times!), -- absurdity to keep at bay (interrobangs have a cost - the paragraph above is relevant), -- security to ensure (information which ends up in weakly protected repositories is basically public), -- safety to strengthen (sociopolitical systems can make people pay for any minor trait) and more?
kyriakos 5y ago
For someone not living in the US how much of a problem for privacy and tracking is it? Being tracked by US or Chinese government how is it different to me? Honest question by the way, not trolling.
- deleted 5y ago
  [deleted]
- fsflover 5y ago
  Apart from fighting political dissidents, tracking is used for targeted ads, i.e., to force you to buy staff you don't need. Many people are not fine with psycological manipulation.
  - kyriakos 5y ago
    If I am not mistaken those can be turned off on miui at least the ones embedded in the system apps.
    - sofixa 5y ago
      In jurisdictions under the GDPR that is indeed the case.
davidgerard 5y ago
author here: Xiaomi make Google and Facebook look restrained, it's true. That said, I basically declared data bankruptcy a while ago, and I'm literally one of the people who should know better (Open Rights Group founding member, etc). This phone is relatively new, and the open-source Android replacements are typically multiple models behind. So basically someone who can has to step up.

pjmlp 5y ago

Yeah, we should strive to get European tech free of US three letter agencies power.

chii 5y ago

> worth the price if you can bypass the malware built into it. how much work is it to flash it to your own software? can a layperson follow some instructions and get it done without deeply knowing anything?

kaladin-jasnah 5y ago
Instructions are usually pretty clear (eg. XDA posts for ROM releases or LineageOS wiki pages are usually quite clear, the latter being more than the former IMO). It might be harder, but usually laypeople can get by (eg. aren't particularly knowledgeable but perhaps aren't afraid of using the command line either, even if it's just copypasting). At least that's the impression I get from people posting on XDA. Either way, I can usually flash ROMs without issue (I don't know a lot about Android but I do understand how my computer works, I guess), but when I do it I usually get incredibly nervous and panicky out of fear that I'll brick my phone or I forgot to back up something important.
sodality2 5y ago
Well, the fitness band didn't have its firmware flashed. that's not where the tracking is anyway. It's a different app being used to collect the data. Recent models of many Xiaomi bands require an authorization code that must be taken from an existing account that has linked with the watch. If someone's skilled enough to run a python script they can get the code and install Gadgetbridge.
kyriakos 5y ago
Tracking for mi band is in the android app rather than the band itself. All you need to do is replace it with a more privacy focused app.

secondaryacct 5y ago

There are two backdoor potential you know. The software, which on my Huawei I prevent with a whitelist firewall which works so insanely well that it doubled my battery life, and the radio chip. Sadly, whatever you do, on all phones manufactured in China or designed in the US, you risk a hardware backdoor you can never inspect. What do you know of the radio chipset, taking electricity to connect to the remote antenna: it can probably ping, get signal from the mic and gps, or the camera etc. If you re going to be paranoid, because you attack children or sell drugs, why the hell do you buy phones in the first place !?

sodality2 5y ago
IMO, the risk of a hardware backdoor is always there and perhaps less damaging if the country is across the world, depending on the threat model and damage model. realistically you're right, and I probably would deeply consider my options before thinking about it. But we can go down the list of lower and lower firmware that we cant verify (hell, I just reread Reflections on Trusting Trust this morning). Every device has Chinese-made chips. I suppose it's more risky than an American company but to me it seems like rearranging chairs on a sinking ship, which is why I never keep anything sensitive on my phone.
3np 5y ago
> If you re going to be paranoid, because you attack children or sell drugs, why the hell do you buy phones in the first place !? While the rest of your comment is accurate, this is disingenuous. There are plenty of valid reasons to have concerns over this besides those drilled by the powers that be. Besides, it's still reasonable to want to reduce your potential attack surface. Sure, federal agencies may root you if they really want but that doesn't mean it's pointless to avoid OS-level preinstalled backdoors from the manufacturer.
- deleted 5y ago
  [deleted]
mdp2021 5y ago
> If you re going to be paranoid, because you attack children or sell drugs, why the hell do you buy phones in the first place !? If you are going to joke, kindly mark it, so we do not misunderstand you, and so you do not cause internal damages to those who are not trained to always keep neurovegetative and limbic on guard while reading - you know, that occasional moment in which you trust what you read and the physiological reactions start, before the prefrontal goes "wait a moment, that may be not serious". People have -- a privacy to defend as a principle («privacy to defend», what times!), -- absurdity to keep at bay (interrobangs have a cost - the paragraph above is relevant), -- security to ensure (information which ends up in weakly protected repositories is basically public), -- safety to strengthen (sociopolitical systems can make people pay for any minor trait) and more?

kyriakos 5y ago

For someone not living in the US how much of a problem for privacy and tracking is it? Being tracked by US or Chinese government how is it different to me? Honest question by the way, not trolling.

deleted 5y ago
[deleted]
fsflover 5y ago
Apart from fighting political dissidents, tracking is used for targeted ads, i.e., to force you to buy staff you don't need. Many people are not fine with psycological manipulation.
- kyriakos 5y ago
  If I am not mistaken those can be turned off on miui at least the ones embedded in the system apps.
  - sofixa 5y ago
    In jurisdictions under the GDPR that is indeed the case.

davidgerard 5y ago

author here: Xiaomi make Google and Facebook look restrained, it's true. That said, I basically declared data bankruptcy a while ago, and I'm literally one of the people who should know better (Open Rights Group founding member, etc). This phone is relatively new, and the open-source Android replacements are typically multiple models behind. So basically someone who can has to step up.