8 ms·

I think you would have to be mad to leave the stock ROM running on a Xiaomi phone, IIRC they were caught logging peoples browser history a few years ago. Severa

I think you would have to be mad to leave the stock ROM running on a Xiaomi phone, IIRC they were caught logging peoples browser history a few years ago. Several models have mainline LineageOS support, I'm running Lineage on my Mix 2S and hope to have years worth of updates going forward. The hardware is really good value as long as you install an non-tainted OS.

pier25 5y ago
What about Android One?
- amiga-workbench 5y ago
  I believe Xiaomi left the Android One program last year.
  - pier25 5y ago
    Yes but there are plenty of Mi A1, A2, and A3 in use today.
- kspacewalk2 5y ago
  Android One is moribund and is basically just Nokia now[0]. [0] https://en.wikipedia.org/wiki/Android_One#2020 https://en.wikipedia.org/wiki/Android_One#2020
  - alias_neo 5y ago
    > moribund 1. Approaching death, about to die. 2. Reaching obsolescence. I learned a new word today, thank you.
EveYoung 5y ago
Not to sound paranoid, but won't even LinageOS phones have to run closed-sourced firmware and drivers?
- amiga-workbench 5y ago
  Correct, its entirely possible they could be doing more insidious stuff at the firmware level, but dumb keyword checking is almost certainly implemented in userspace. I don't think you can trust any proprietary firmware out there, its just a question of which you trust less than the others.
  - halfstar91 5y ago
    And based on recent discoveries it sounds like Xiaomi should be trusted less than others.
    - hef19898 5y ago
      As stupid as it might sound, I do trust Pixel phones, and an hypothetical iPhone running a different OS, the most of all alternatives. If one want's a smartphone, if not just take a 20+ year old dumb phone. Or BlackBerry.
      - kelnos 5y ago
        Good luck getting that 20 year old phone to connect to any modern wireless network. I don't think anyone is running a 2G network anymore.
        hef19898 5y ago
        I totally forgot that even 3G is going to be phased out.
  - summm 5y ago
    Not only firmware. Custom ROMs actually have to use binary blobs in kernelspace and userspace as well, in order to be able to use the hardware.
  - FpUser 5y ago
    >"its just a question of which you trust less than the others." Simple. I do not "trust less". I just do not trust. My phone is a phone. No Internet activity. I spend enough time in front of my desktop, dragging another computer anywhere I go is the last thing on my mind.
DanAtC 5y ago
You can replace the user-facing software, but can/would you trust the baseband?
- sudosysgen 5y ago
  Isn't the baseband Qualcomm code? Do you think Qualcomm allowed Xiaomi to run their own baseband on it?
  - nottorp 5y ago
    Do you think a Chinese company would even ask for permission? :)
    - sudosysgen 5y ago
      You can't exactly do it without permission though. You need to crack the bootloader for the baseband and that's way easier said than done and immediately noticeable.
      - mschuster91 5y ago
        > You need to crack the bootloader for the baseband and that's way easier said than done There have been more than enough cases of people poking holes in bootloaders, including secret services. For what it's worth, Huawei and Xiaomi can be considered as part of the Chinese CCP dictatorship and I'd expect them to have access to such exploits. > and immediately noticeable. How is an user supposed to notice a modified baseband firmware? The only thing that a user can see is if the device has been rooted, but with a factory-supplied backdoor even that doesn't help.
        sudosysgen 5y ago
        There's a difference between poking a hole the device bootloader and the baseband bootloader. The second is wayyy more lockdown and has a tiny attack surface. A user can directly download the baseband image from the chipset using for example QFIL. Then you can check if it's signed with Qualcomm's key or another. Exploiting this would require Xiaomi to hide two baseband firmwares in the baseband firmware which isn't feasible, and it would also require them to completely rewrite the baseband bootloader instead of just exploiting it. But even then you'd be able to read the eMMC and notice that there are two baseband firmwares. If you want to figure it out, you're free to buy any Xiaomi phone, read the eMMC, and check how many baseband images there are, then you'll be able to definitively know. Let me know if you do it. When I said immediately noticeable I meant by Qualcomm, not by the end user though. They have contractual obligations to lock down their baseband and their licensing system relies on it so they have a large incentive.
gpderetta 5y ago
I was stupid enough to buy a Xiaomi phone without enough due diligence. Aside from all spying that is going on, the software is abysmal. The problem with replacing the OS is that I believe most banking apps I use will stop working. Might just need to write this phone off.
- hxii 5y ago
  I have installed an AOSP-based rom on my Xiaomi 9T and banking apps (well, at least one) seems to be working fine.
  - 5e92cb50239222b 5y ago
    Did you have any problems with AOSP? I want to replace the stock spyware on me mom's 9T, but the experience seems to be mixed, judging by a couple of forum discussions.
    - hxii 5y ago
      Minor inconveniences mostly, but that's probably because I keep flashing different ROMs to try stuff out. My only "issue" is that because of my escapedes with flashing I now have only Widevine L3 support, so no full-HD videos on Netflix. But this should be easily fixed by flashing xiaomi.eu ROM and then going back to AOSP. This is my daily driver: https://forum.xda-developers.com/t/rom-11-0-official-davinci-crdroid-v7-x.4207823/ https://forum.xda-developers.com/t/rom-11-0-official-davinci...
      - 5e92cb50239222b 5y ago
        Cool, thank you.
- beerandt 5y ago
  Banking has to be the dumbest "security" industry there is. Restrict apps, but can still log in via browser. I have one bank app that actually says to screenshot a payment screen for your records, while blocking screenshots via app policy.
dukeofdoom 5y ago
Most people don't care if another country spies on them, since their laws don't apply to them. They would care much more if they are profiled by their own government. Or more like tech companies on behalf of the government spying on them, and them being discriminated, harassed, or jailed based on that data. So in a way its actually kind of smart to go with a Chinese phone if you live in America.
- zzzbra 5y ago
  Galaxy Brain take.
- deleted 5y ago
  [deleted]
Causality1 5y ago
Good value assuming you're on the right carrier. AT&T in the US and its MVNOs are moving to a whitelist model in February, making Xiaomi phones unusable for anyone in the US not on T-Mobile.
selfhoster11 5y ago
On a related note, Realme recently bricked two (maybe more) phone models with an update that caused a soft-boot loop if the weather service (!) was removed by the user to reduce bloat. The problem is not fixed. People have lost data. I personally put Realme on my "never do business with" list. If their engineering is so poor that they haven't caught this in time, nor reacted by releasing a one-line software patch that can be applied manually (cause users sure as hell can't do it themselves - stock can only apply signed updates), they shouldn't be trusted with anything.

pier25 5y ago

What about Android One?

amiga-workbench 5y ago
I believe Xiaomi left the Android One program last year.
- pier25 5y ago
  Yes but there are plenty of Mi A1, A2, and A3 in use today.
kspacewalk2 5y ago
Android One is moribund and is basically just Nokia now[0]. [0] https://en.wikipedia.org/wiki/Android_One#2020 https://en.wikipedia.org/wiki/Android_One#2020
- alias_neo 5y ago
  > moribund 1. Approaching death, about to die. 2. Reaching obsolescence. I learned a new word today, thank you.

EveYoung 5y ago

Not to sound paranoid, but won't even LinageOS phones have to run closed-sourced firmware and drivers?

amiga-workbench 5y ago
Correct, its entirely possible they could be doing more insidious stuff at the firmware level, but dumb keyword checking is almost certainly implemented in userspace. I don't think you can trust any proprietary firmware out there, its just a question of which you trust less than the others.
- halfstar91 5y ago
  And based on recent discoveries it sounds like Xiaomi should be trusted less than others.
  - hef19898 5y ago
    As stupid as it might sound, I do trust Pixel phones, and an hypothetical iPhone running a different OS, the most of all alternatives. If one want's a smartphone, if not just take a 20+ year old dumb phone. Or BlackBerry.
    - kelnos 5y ago
      Good luck getting that 20 year old phone to connect to any modern wireless network. I don't think anyone is running a 2G network anymore.
      - hef19898 5y ago
        I totally forgot that even 3G is going to be phased out.
- summm 5y ago
  Not only firmware. Custom ROMs actually have to use binary blobs in kernelspace and userspace as well, in order to be able to use the hardware.
- FpUser 5y ago
  >"its just a question of which you trust less than the others." Simple. I do not "trust less". I just do not trust. My phone is a phone. No Internet activity. I spend enough time in front of my desktop, dragging another computer anywhere I go is the last thing on my mind.

DanAtC 5y ago

You can replace the user-facing software, but can/would you trust the baseband?

sudosysgen 5y ago
Isn't the baseband Qualcomm code? Do you think Qualcomm allowed Xiaomi to run their own baseband on it?
- nottorp 5y ago
  Do you think a Chinese company would even ask for permission? :)
  - sudosysgen 5y ago
    You can't exactly do it without permission though. You need to crack the bootloader for the baseband and that's way easier said than done and immediately noticeable.
    - mschuster91 5y ago
      > You need to crack the bootloader for the baseband and that's way easier said than done There have been more than enough cases of people poking holes in bootloaders, including secret services. For what it's worth, Huawei and Xiaomi can be considered as part of the Chinese CCP dictatorship and I'd expect them to have access to such exploits. > and immediately noticeable. How is an user supposed to notice a modified baseband firmware? The only thing that a user can see is if the device has been rooted, but with a factory-supplied backdoor even that doesn't help.
      - sudosysgen 5y ago
        There's a difference between poking a hole the device bootloader and the baseband bootloader. The second is wayyy more lockdown and has a tiny attack surface. A user can directly download the baseband image from the chipset using for example QFIL. Then you can check if it's signed with Qualcomm's key or another. Exploiting this would require Xiaomi to hide two baseband firmwares in the baseband firmware which isn't feasible, and it would also require them to completely rewrite the baseband bootloader instead of just exploiting it. But even then you'd be able to read the eMMC and notice that there are two baseband firmwares. If you want to figure it out, you're free to buy any Xiaomi phone, read the eMMC, and check how many baseband images there are, then you'll be able to definitively know. Let me know if you do it. When I said immediately noticeable I meant by Qualcomm, not by the end user though. They have contractual obligations to lock down their baseband and their licensing system relies on it so they have a large incentive.

gpderetta 5y ago

I was stupid enough to buy a Xiaomi phone without enough due diligence. Aside from all spying that is going on, the software is abysmal. The problem with replacing the OS is that I believe most banking apps I use will stop working. Might just need to write this phone off.

hxii 5y ago
I have installed an AOSP-based rom on my Xiaomi 9T and banking apps (well, at least one) seems to be working fine.
- 5e92cb50239222b 5y ago
  Did you have any problems with AOSP? I want to replace the stock spyware on me mom's 9T, but the experience seems to be mixed, judging by a couple of forum discussions.
  - hxii 5y ago
    Minor inconveniences mostly, but that's probably because I keep flashing different ROMs to try stuff out. My only "issue" is that because of my escapedes with flashing I now have only Widevine L3 support, so no full-HD videos on Netflix. But this should be easily fixed by flashing xiaomi.eu ROM and then going back to AOSP. This is my daily driver: https://forum.xda-developers.com/t/rom-11-0-official-davinci-crdroid-v7-x.4207823/ https://forum.xda-developers.com/t/rom-11-0-official-davinci...
    - 5e92cb50239222b 5y ago
      Cool, thank you.
beerandt 5y ago
Banking has to be the dumbest "security" industry there is. Restrict apps, but can still log in via browser. I have one bank app that actually says to screenshot a payment screen for your records, while blocking screenshots via app policy.

dukeofdoom 5y ago

Most people don't care if another country spies on them, since their laws don't apply to them. They would care much more if they are profiled by their own government. Or more like tech companies on behalf of the government spying on them, and them being discriminated, harassed, or jailed based on that data. So in a way its actually kind of smart to go with a Chinese phone if you live in America.

zzzbra 5y ago
Galaxy Brain take.
deleted 5y ago
[deleted]

Causality1 5y ago

Good value assuming you're on the right carrier. AT&T in the US and its MVNOs are moving to a whitelist model in February, making Xiaomi phones unusable for anyone in the US not on T-Mobile.

selfhoster11 5y ago

On a related note, Realme recently bricked two (maybe more) phone models with an update that caused a soft-boot loop if the weather service (!) was removed by the user to reduce bloat. The problem is not fixed. People have lost data. I personally put Realme on my "never do business with" list. If their engineering is so poor that they haven't caught this in time, nor reacted by releasing a one-line software patch that can be applied manually (cause users sure as hell can't do it themselves - stock can only apply signed updates), they shouldn't be trusted with anything.