23 ms·

Pixel sent to Google for replacement. They used it to post wife's nudes online

333 points by po1nter 5y ago

hdjdjdnbehsh 5y ago
Where are they?
kf6nux 5y ago
The link offers no proof, but that's somewhat understandable (I wouldn't want to dox myself either after such an event). If the claim is true, I hope they find an appropriate way of broadcasting it with credibility.
hardlianotion 5y ago
The poster account has been deleted. Don't know what that means.
- deleted 5y ago
  [deleted]
- drbacon 5y ago
  My very naive speculation is that OP finally talked to a lawyer who advised: STOP TALKING SPECIFICS ON SOCIAL MEDIA.
raxxorrax 5y ago
Really should think about just paying another few hundred bucks and just keep the device if it contains nude photos of your wife which you cannot wipe. Don't send that device anywhere... Provided this story is true, I would guess the device might never have reached Google and it might have been stolen on the way there. Don't know what that would mean for liability.
- mabbo 5y ago
  Seriously? You're blaming the victim?
  - ARandomerDude 5y ago
    Somebody: "I can't believe it! I like to leave stacks of $100 bills on the seat in my car and my car keeps getting broken into. Outrageous!" Somebody else: "You should probably take or hide the cash when you get out of your car." Offering wisdom for how to avoid a bad situation twice is not the same thing as blaming the victim.
    - criddell 5y ago
      As far as wisdom goes, it's pretty weak and probably doesn't need to be said.
      - ARandomerDude 5y ago
        If it didn't need to be said, you wouldn't see "Lock, Take, Hide" signs in many cities.
        criddell 5y ago
        There's a big difference offering that advice in a areas with a crime problem before anything is stolen than telling a person they should have hidden something after the theft. At that point you aren't being helpful.
      - raxxorrax 5y ago
        I believe that any egregious behavior is on the one that leaked the private data. I don't think that has to be said honestly.
    - advisedwang 5y ago
      A better analogy is a mechanic stealing money out of your car. And not money on view either, some place they'd have to look for it like in the visor.
      - BiteCode_dev 5y ago
        It still works. I would blame the mechanic, sue if necessary, but it's still good advice not to let any valuable in your car if you lend it to a 3rd party.
- ortusdux 5y ago
  Per the link: "The last ping from the old phone (which was today) was the same as the place we shipped it. The exact location down to the very building." The phone was successfully RMA'ed a month ago, which presumably would include Google confirming possession.
- jaclaz 5y ago
  BTW it seems: > They had access to the Google account which is where the photos were. like the photos were not on the device, but rather on some Google service, but the phone had remained logged in that account. It should be possible in such cases to access the Goggle account with another device and change password (I believe, kicking out the broken phone login).
  - blfr 5y ago
    You can even log out particular devices on account.google.com (security tab → your devices). This is a weak protection, however, since they're probably cached on the phone.
JoeAltmaier 5y ago
The apocryphal 'they'. Not knowing who that is, there is no story. Could have been the guy himself; the mailman; somebody in the mail room at Google; somebody where the device was mis-delivered. Could even be the wife, indulging an exhibitionist urge. Who knows.
VortexDream 5y ago
I'm sick of people, so I'm not going to read the inevitable comments that are going to come. Look, face it, some people like taking nude photos of themselves and they like sharing them with their partners. There is absolutely nothing wrong with this. It's not their fault if something like this happens. People should be able to feel secure in the tech that they use, in the companies that they entrust their information with. It's a fuckload of bullshit victim blaming and I see it every time the topic comes up. I'm sick of it.
- INTPenis 5y ago
  It's definitely the fault of some individual related to the service. BUT, you must be pretty stupid to send a device away that contains sensitive information. And unfortunately, a lot of people in society don't expect this type of intrusion by a company they trust. But they should. And I don't think you can blame Google for any of this.
  - imbnwa 5y ago
    > BUT, you must be pretty stupid to send a device away that contains sensitive information. Irrelevant
    - INTPenis 5y ago
      It is relevant because there's a massive deficit in basic infosec among the populations of the world. Why keep blaming big corporations when we need to get smarter ourselves?
      - ska 5y ago
        > Why keep blaming big corporations when we need to get smarter ourselves? Why do we pretend that a practical answer to anything is "well people should stop behaving like people" ? Systems should be designed to work with people as they actually behave, not an idealized version.
      - kelnos 5y ago
game_the0ry 5y ago
There are a lot of leaked nude selfies on the net 0 like a lot. It makes me wonder how many we were leaked the same way these were.
encryptluks2 5y ago
Not here to victim blame, but just point out some things to help others in the future. 1. Use a password and encryption 2. If you can still turn on the device, wipe it before you send it off for an RMA. 3. If you can't access the device, login to your account online and remove access to it. You should do this even after you wipe it. 4. Save everything sensitive on removable storage medium by default.
- vmception 5y ago
  These guys sent it in for RMA because it couldn't be turned on Also the photos were in the google account so none of this advice would have mattered anyway aside from the advice #4 about not doing it, which is moot. They and many people probably auto backup all photos on the device to the google account. Not sure if there is a way to distinguish which photos are too sensitive for online backup with that service.
  - encryptluks2 5y ago
    It would have mattered because you can deauthorize a device from your Google account on a computer, like a phone and if they are saved locally as well you can remove SD card before sending it back. The only thing I'm unsure of is if thumbnails are saved in a standard image format but those should get removed as well during the notification that the device has stopped syncing, but if mobile data is turned off it may cache a few low res thumbnails.
    - orthecreedence 5y ago
      Where's the SD card on a Pixel?
      - encryptluks2 5y ago
        I'm not saying it has one, again the point was for people RMA'ing devices in the future to help prevent issues like this. A startup password with encryption could have helped prevent this.
lewantmontreal 5y ago
I’ve taken my iPhone to a couple of repair shops. They always ask for the pin code and I always refuse and say it’s a work phone. Very much hoping the secure enclave works and my data has not left the phone.
- deleted 5y ago
  [deleted]
- admn2 5y ago
  Even when I took my phone into a third party repair place for a new screen they required me to give them my passcode and disable Find My Phone. Seemed super unnecessary.
  - Noturos 5y ago
    I used to work as a certified apple tech. Turning off find my iPhone is standard procedure for every repair. But techs are never supposed to ask for your passcode. Most diagnostics can be performed outside the OS, and those that can't are supposed to be performed in front of the client.
- gharper 5y ago
  After reading far too many similar stories to this one, I've always made a fresh backup and completely wiped my phone before walking into the store. Any testing they need to do can be done on a factory default installation, and restoring from backup is relatively painless these days.
- nvarsj 5y ago
  Even the Apple store does this when you take your phone for repair. I only did it once and they did a crap job anyways (screen replacement, and they got dust in the camera lens area somehow).
- aj3 5y ago
  The official repair shops that Apple Repair will guide you to should never ask for the pin, afaik. There is that mode for diagnostics which you need to approve, but you don't need to provide the pin - just unlock the phone and press approve button yourself.
dandare 5y ago
How do you disable your old phones especially those those that do not work (due to shattered screen mostly) before giving them up for recycling or buyback? I am always worried someone will fix and misuse my old phone.
- throwaway81523 5y ago
  I wonder if there is a way to connect to it through usb in order to wipe it.
  - crtasm 5y ago
    There is, it's called adb https://developer.android.com/studio/command-line/adb https://developer.android.com/studio/command-line/adb My phone has a button combination to hold when powering on to get into a recovery mode, then you can wipe it with adb.
  - dinkelberg 5y ago
    It might not be possible to wipe the data off the flash memory, due to how flash memory works. As you can only reset bits on the flash memory some amount of times, flash memory controllers try to avoid resetting bits and they try to distribute resets evenly on the memory (called wear leveling), so that it doesn't happen that parts of the memory are already worn out while other parts are healthy. So "deleting" and even "zeroing" flash memory might not do what you would expect. Instead of resetting the bits of the original content, it might put the zeros somewhere completely different. And wipe commands that one can send to flash memory chips are sometimes broken too (they might be implemented as no-ops). Edit: Also, even if you tell it to write zeros everywhere, it might not delete the content, because there is hidden extra memory on flash memory chips.
    - jeffbee 5y ago
      This is FUD. Flash is fundamentally easier to wipe than hard disk drives. You’re just using a defective mental model for the process. While magnetic recording needs to be overwritten, flash memory does not. Flash has a dedicated erase command. Flash can only be written if it was erased. You can erase an entire flash device in a split second.
betwixthewires 5y ago
I've worked in these contract cellphone repair/refurbishment facilities many years ago, the big warehouses where telecoms and manufacturers send these warranty phones to be triaged and repaired, and let me tell you, something like this is not surprising at all. Most of the people there did good work, but all it takes is one. Personally I'd never send my phone in to repair, and I'm skittish about buying any refurbished phones.
- kingcharles 5y ago
  I had to buy dozens of old phones on eBay once for testing a new SMS product and I can tell you that most of the phones were not wiped and lots had naughty photos and videos still on them :|
  - mythrwy 5y ago
    Maybe because thieves can't be assed to wipe the phone before putting on ebay?
- deleted 5y ago
  [deleted]
- arbuge 5y ago
  I bought 2 "refurbished" Google Assistant smart speakers from Ebay over the last year or so. Bought of them came still logged in to their prior owner's Google accounts. All that was necessary on the part of the refurbishers was to spend a few seconds doing a factory reset (which was the first thing I did at my end), but even that was too much to ask, apparently.
- ilamont 5y ago
  Years ago I had some friends who worked in a local photo shop, and once I stopped by and they showed me around. This was in the days when 99% of the population developed film and made prints by dropping off the little canisters at such shops with an order form. It usually took a few days to get them back. Everyone made assumptions that the process for developing photos was anonymous and private - you dropped off a canister, and picked up photos and negatives in a clean, sealed envelope a few days later. How wrong we were. The process was semi-automated using these gargantuan machines in a back room, but the staff usually looked at each frame as went through the process. They made extra copies of spicy ones which went straight into a special binder kept on a nearby shelf. This shop had two or three of these binders. Some years later I was in another country and photographed violent demonstrations right outside the hostel where I was staying. When I went to pick up the photos, the staff made it clear that they had seen the images. They were supportive (they wanted to get the word out internationally) but what if copies had been sent to the local intelligence services instead? Nowadays the tech is different, but when there are no barriers to viewing private information, we see similar types of behavior.
bhawks 5y ago
The RMA instructions should include using android.com/find to lock and wipe an inoperable device if it ever gets turned on again. https://support.google.com/accounts/answer/6160491?hl=en https://support.google.com/accounts/answer/6160491?hl=en
- mattnewton 5y ago
  This is what apple asks you to do IIRC. They could have just copied that practice instead of having to learn the hard way why ಠ,_｣ಠ Though, this apparently didn't save apple in at least one recent case: https://www.theverge.com/2021/6/7/22522560/apple-repair-multimillion-iphone-nude-photos-privacy-settlement-pegatron https://www.theverge.com/2021/6/7/22522560/apple-repair-mult...
  - rootusrootus 5y ago
    > this apparently didn't save apple I can't imagine it would. It isn't a contract, just a best practices guide. Apple and Google are still ultimately responsible for what their employees do on the job.
- deadbunny 5y ago
  I would suggest that this should also be part of the RMA process for the repair center. I'd assume it can be done on some device id basis, so 1) Check in phone 2) Initiate wipe 3) put in service tech queue
- qwertox 5y ago
  > About a month ago my wife broke her pixel phone. It couldn't be turned on so we couldn't wipe it. That says it all. You can't expect them to try 24/7 until they get a confirmation. In addition, I doubt that they would have included the SIM card in the RMA, which means that the device would not be online through mobile, and there's no reason for the repair shop to connect the device to the WiFi as the first step, so that any erase-request can come through. You either trust the RMA process or you burn your phone.
  - 5y ago
BiteCode_dev 5y ago
I've lost a laptop in an airport shuttle with intimate pics on it once, and got worried sick. After that life lession, I always made sure to have a veracrypt partition for this stuff. But a separate, offline device is better of course.
- sannee 5y ago
  Modern Android actually does support disk encryption. And the Pixels even have TPMs that should (?) safeguard the key, preventing offline brute forcing the unlock pattern. I wonder what happened here that this did not work...
  - Consultant32452 5y ago
    I wonder what kinds of tickets, if any, justify them asking you for your unlock pattern.
    - BiteCode_dev 5y ago
      This week I was in a chat with the REAL support of a crypto currency. Unable to help me with my problem at first (we eventually figured it out), they felt they hit a dead end and said: "ok, just send us your wallet.dat, we'll fix it". I know those guy were the real deal. I knew they would not try to steal the money I had on this wallet, because it was so little it was not even worth the time. Yet, the fact they asked that proves how much support can badly educate their users. Of course, I didn't send my wallet, and found another solution since I'm tech saavy. But still...
      - Consultant32452 5y ago
        I once got my screen replaced at one of the phone fix-it places. It's a decent sized chain, not just some rando. On the form you fill out during drop-off it asks you for your unlock code.
        stjohnswarts 5y ago
jimbob45 5y ago
Bit of a shame that this will go viral and we’ll never know if Google would have properly handled this on their own. I’d like to think yes but it’s tough to believe the crook’s first attempt at this was also the first time they were caught. That said, I’m wondering if Google didn’t farm out their repair work to a 3rd party, leading to this situation.
- ocdtrekkie 5y ago
  > That said, I’m wondering if Google didn’t farm out their repair work to a 3rd party, leading to this situation. They almost certainly did, since a large portion of Google's offices are staffed by contractors as well. There is no way they're paying Google salaries and benefits to the guys handling RMA phones. And that's part of the problem. You send the phone to Google, a company you (very mistakenly) trust, and they immediately hand it over to a lowest bidder shady shop. These services should definitely be letting you know your phone is actually going to AAABob's Phone Repair Shop, and not some magical Google factory center.
kingcharles 5y ago
This sort of leaking is now a felony in most US jurisdictions, e.g. Illinois: https://www.criminaldefenselawyer.com/resources/revenge-porn-illinois.htm https://www.criminaldefenselawyer.com/resources/revenge-porn...
oxymoran 5y ago
This isn’t OP fault but it boggles my mind that people still use google products. How many times do companies like google and Facebook need to show that they don’t have your best interest at heart before you stop using their products? People won’t even buy genetically modified food but yet they have no problem shelling out thousands of dollars to authoritarian, surveillance centric parasites. Please stop.
- djbusby 5y ago
  Which phone tho? I don't have anything compatible with iOS so those are unusable. So, I get android. And nearly the only phones w/o crap-ware are Pixel or other Google Flagship. Advice?
  - Bud 5y ago
    You absolutely do have things compatible with iOS. You probably just don't know it yet. So the advice, is, try iOS. Stop rewarding Google for stealing iOS, creating Android, and then loosing this kind of bullshit on the world.
    - sulam 5y ago
      Android was created in 2003. Google bought the company in 2005. The first iPhone was released in 2007.
      - Bud 5y ago
        Are you being misleading on purpose, or was it just an accident? The first phone to run on Android debuted from Google in 2008 and was universally recognized as a hilariously obvious copy of iOS and everything about the iPhone. The early internal versions of Android bore absolutely no resemblance to what was finally released in 2008. There wasn't even a touchscreen at all, and they had a physical QWERTY Blackberry-esque keyboard. They magically changed after the iPhone was released. This is all quite well-documented. https://slate.com/technology/2008/11/what-the-google-phone-stole-from-the-iphone.html https://slate.com/technology/2008/11/what-the-google-phone-s... https://en.wikipedia.org/wiki/Android_(operating_system) https://en.wikipedia.org/wiki/Android_(operating_system)
rootusrootus 5y ago
We need to educate people on how to secure the data on their phones so that even the manufacturer cannot reach it. And if that is not possible for a particular device, that should be clearly understood so people can make an informed choice about what smartphone they use. Can't just tell people 'do not put nudes on your phone' because while it's good advice, it misses the point. And, of course, whoever does something like this should be strung up by their toenails in the public square.
- commandlinefan 5y ago
  > how to secure the data on their phones so that even the manufacturer cannot reach it If that were possible, the FBI would shut it down.
  - djbusby 5y ago
    Signal?
  - rootusrootus 5y ago
    Haven't they fought Apple on that in the past? AFAIK they still have to rely on exploits to get past the pin code. If that's not true I'd like to know.
  - jfrunyon 5y ago
    [citation needed]
- Bud 5y ago
  No. We don't need to "educate" people on how to magically dodge evil behavior. We need to punish the evil behavior. Like you said in your last sentence.
  - JohnFen 5y ago
    We need both.
  - jfrunyon 5y ago
marcodiego 5y ago
Wait! Text was deleted. How can we know this is legit?
- ZekeSulastin 5y ago
  Unddit is pretty good to read deleted or moderated posts as long as the deleted text was up long enough - https://www.unddit.com/r/legaladvice/comments/r632w5/sent_my_phone_to_google_for_replacement_they/ https://www.unddit.com/r/legaladvice/comments/r632w5/sent_my...
  - froh 5y ago
    And how does this prove anything other than there was a Reddit post making a wild claim?
- rootusrootus 5y ago
  Even if the poster had not deleted the text (I saw it before they deleted it, and the text is posted in this thread, however), that would not do anything to make it legit. It is just someone making a claim on the Internet. It is good fodder for a security discussion, though. The merits will have to be decided in a court of law.
dudeinjapan 5y ago
Well I just hope you and your wife learned your lesson never to remove your clothes again.
Bud 5y ago
And people wonder why Apple wants to try to keep control of iPhone repair processes. This is one of the big reasons why.
- izacus 5y ago
  I'm sure it's this and not the extra profit on increase new device sales and significantly higher cost of "original" replacement parts.
- tsrand0m 5y ago
  Wasn’t there a similar case with apple repair. I vaguely remember seeing that on hacker news too. Apple repair nude will get you there
  - MerelyMortal 5y ago
    That, and I remember years ago, someone claimed their cryptocurrency was stolen while their Apple laptop was in for repairs (wallet unencrypted on the laptop).
bayesian_horse 5y ago
One of the many reasons why I refuse to make or keep nudes of anyone...
f38zf5vdt 5y ago
These are the steps I take to repair my phone when it doesn't boot. 1. Remove phone case. 2. Desolder eMMC chip after looking it up which one it is online. 3. Put eMMC in old coffee grinder, grind away. 4. Buy new phone.
- reginold 5y ago
  "Phones are cheap, just buy another" WOW the privilege. From a thread about a similar incident on Twitter: https://mobile.twitter.com/mojonojo3/status/1467453133538611202 https://mobile.twitter.com/mojonojo3/status/1467453133538611...
WesolyKubeczek 5y ago
Last time I sent a phone into repair, I wiped and reset it, presumably so that techs could test it properly (broken screen and digitizer). I wish I didn’t have to; but when you’re logged into everything, your bank is there too, and your phone is the second factor in a lot of things, damn it’s too much of a risk. I wish phones could boot into some kind of field tech/diagnostics mode where all aspects of hardware could be tested as thoroughly as needed. Maybe there exists one and I’m just ignorant?
- not2b 5y ago
  From the original post: "About a month ago my wife broke her pixel phone. It couldn't be turned on so we couldn't wipe it."
  - beamatronic 5y ago
    Into the shredder it goes
  - WesolyKubeczek 5y ago
    I'm not trying to be smug here. Just saying that there were some circles of hell I wish I hadn't to go through. If the phone didn't even turn on enough to go into some DFU mode, I guess I'd be just as fucked. Just had an idea to get a burner phone, fill it with my own nudes and give it to repair. Let the perverts have nightmares for a while.
thatguy0900 5y ago
I used to work at a att store. This is common. One particular incident involved a ring of workers at multiple stores who had a shared Dropbox they would upload anything they found to. Any time you hand your phone over to underpaid 20 year old guys you should be erasing everything sensitive
flatiron 5y ago
It was deleted. Here is the OG Text: "Ok so this just happened. Buckle up. About a month ago my wife broke her pixel phone. It couldn't be turned on so we couldn't wipe it. We contact Google and used the device care to get an RMA. Today someone posted nude pictures of my wife and I to her social media accounts. They accessed her Google account and tried to lock us out. They used her PayPal to send someone $5 (a test probably). How could this happen? Well Facebook and Instagram show logins from Texas. The old phone still showed on our find my phone app and it was in Texas. Guess where we sent the phone for RMA? The last ping from the old phone (which was today) was the same as the place we shipped it. The exact location down to the very building. Clearly they fixed the old phone and since it wasn't wiped, was still logged into her Google account. I called Google and they basically said "woah that's fucked up we'll get back to you". We filed a police report but I don't expect they will do anything. What are my options here for sueing Google? I know that sounds insane but this breach of trust and privacy is egregious. Hundreds of people have now seen my penis including our friends kids. It's really fucked up. Any advice on what to do here?" my big question is whether this phone is password enabled. also this stinks because i know the first comment is "well do a factory reset" but if the phone doesn't turn on, etc. then i don't believe that is possible (short of possibly ADP which is out of the reach of 99% of people)
- t0mas88 5y ago
  Based on a previous case with Apple, this guy is going to be a millionaire. So at least he has that.
  - nikolay 5y ago
    Maybe he already is - thus the deleted comment.
    - tpmx 5y ago
      That's more of a sign that he got legal advice, hopefully from an actual lawyer that he hired.
  - oh_sigh 5y ago
obiwan14 5y ago
IS this title correct? The title on Reddit says: > Sent my phone to Google for replacement. They fixed the old one and used it to post nudes on my wife's social media and steal money It doesn't say they pulled wife's nudes from the phone and posted them online, but that they used the old phone to post nudes on the wife's social media... Or did I miss something?
paulgdp 5y ago
To be fair, when sending a Pixel for reparations, Google very clearly and explicitly asks to factory_reset the phone. I personally didn't reset it when I sent my Pixel 3 to fix the charging port because my Pixel was fully encrypted. All Pixels are encrypted by default as long as you have any kind of lock method enabled (PIN, password, shape...). I don't really understand how this person got his files in cleartext and accessible.
- KZeillmann 5y ago
  My impression from the (now deleted) text is that the phone wasn't booting or in a state where it could be factory reset, at least not without considerable effort.
- Tagbert 5y ago
  In this case, the phone would not turn on prior to repair and could not be wiped.
  - 2OEH8eoCRo0 5y ago
    How did the person conducting repair power it on and unlock it then? Edit: I mean how did they bypass the lock screen?
    - Johnny555 5y ago
      Sometimes letting the battery drain completely will clear a hung phone (which is like the old "take the battery out for 5 minutes, then try it again" trick). Or the service center knew the magic buttons to press to get it to boot. Or the battery was bad. Or one of a million other reasons that a phone can fail in a way that makes it appear dead, but a service tech knows how to get it running.
    - weswpg 5y ago
      by repairing it
    - open1414 5y ago
      maybe no password?
dekhn 5y ago
Flagged because the original post and its details were deleted. There's just a pointless conversation about whether you should contact a lawyer, which is literally the only thing this person should have done.
- echelon 5y ago
  I understand your take, but I would rather see the HN community's take on it rather than Reddit's. There are Google and Apple insiders, actual lawyers, repair techs, and more here. Even tangential threads can be interesting.
- blfr 5y ago
  OP's contents are posted in this thread: https://news.ycombinator.com/item?id=29406217 https://news.ycombinator.com/item?id=29406217
jfrunyon 5y ago
[dubious - discuss] There's a few things that make this pretty unlikely. Google doesn't triage or repair the phones themselves, they contract it out just like everyone else. And the people they contract it out to almost certainly have procedures in place which are meant to ensure that neither the devices themselves nor the data on them get out. I'm not saying it's false, but I would definitely take it with a grain of salt. That said, before you send any devices in for repair, you should wipe them to the best of your ability. Also, you should set a secure password (PIN, pattern, etc) - even if you set your device to not lock, you can encrypt/require password on startup, which would prevent the repairperson from seeing the photos much less posting them.
- jandrese 5y ago
  > And the people they contract it out to almost certainly have procedures in place which are meant to ensure that neither the devices themselves nor the data on them get out. I think your impression of what phone repair places are like may not match reality. The industry is far more ad-hoc and margin chasing than the rows of immaculate benches staffed by well paid professionals in a brightly lit facility like they might show in a brochure.
  - jfrunyon 5y ago
    I haven't personally worked in one of the big contract places but have close friends who did. I think your impression of these places as being simply "phone repair places" may not match reality, to be quite honest.
- throwaway19937 5y ago
  > There's a few things that make this pretty unlikely. Google doesn't triage or repair the phones themselves, they contract it out just like everyone else. And the people they contract it out to almost certainly have procedures in place which are meant to ensure that neither the devices themselves nor the data on them get out. Snowden and Manning smuggled out top secret information; it seems a bit much to assume that the low bidder on a phone repair contract has leak-proof security.
- 5y ago
KKKKkkkk1 5y ago
I read a history of the NSA recently [0], and what struck me is that every time the NSA's code-breaking techniques were invalidated, this was due to a US agent leaking secrets to adversaries. If the NSA cannot address every insider threat, why do we expect tech companies to be hermetically sealed? [0] Code Warriors, Stephen Budiansky (https://www.penguinrandomhouse.com/books/236807/code-warriors-by-stephen-budiansky/ https://www.penguinrandomhouse.com/books/236807/code-warrior...).
- rootusrootus 5y ago
  NSA agents have to know some secrets, or they can't do their job. Repair techs at Google/Apple/etc do not need to know any secrets in order to do their job.
  - inetknght 5y ago
    > Repair techs at Google/Apple/etc do not need to know any secrets in order to do their job. Certainly not state secrets. But they do need to know trade secrets. For example: exact (official) replacement products, procedures, and documentation steps in order to ensure the device doesn't show up as "this is fraudulent or pirated or hacked or modified or whatever the fuck the copyright overlords demand can't be done".
    - yjftsjthsd-h 5y ago
      Yeah, but we care a lot a lot less about the company's secrets than customer secrets.
Causality1 5y ago
This should be a reminder to the rest of us that IT and technicians are humans with human vices, and a large fraction of them will look at anything they can find. For every nude that gets posted online a thousand are added to personal collections. Unless they have someone looking over their shoulder or are in a hurry, they will scroll your photos for anything juicy.
exabrial 5y ago
Even worse: Never lend your google phones to friends. If they hard reset the phone before handing it back to you, Google will refuse to reactivate them. I exhausted every option with their support and am left with a $800 brick.
- TrueGeek 5y ago
  Your friend factory reset the phone and put their own password on it? To be fair to Google, they should refuse - if they agreed to wipe someone else's account that would be a HUGE breach of protocol based just on your word. What would keep people from selling used phones and then calling Google to deactivate them? Or just calling Google and deactivating random phones? If your "friend" refuses to log out and re-reset it then the correct thing to do here is to report it to your homeowners insurance. Your friend basically stole your phone. Insurance should pay for it and then they can go after your friend to get their money back.
  - clort 5y ago
    s/friend/ex-friend/g
- jonathantf2 5y ago
  Why would they hard reset them? You've confused me
xanaxagoras 5y ago
What would reddit be without heavy handed moderators deleting interesting and relevant comment replies? You can read a lot more of the discussion here: https://www.reveddit.com/v/legaladvice/comments/r632w5/sent_my_phone_to_google_for_replacement_they/?ps_after=1638337537 https://www.reveddit.com/v/legaladvice/comments/r632w5/sent_...
jpambrun 5y ago
Somewhat related, but not long ago my Macbook had a bulging battery issue and the Apple just flat refused to service it under warranty because I would give them the credentials to unlock the bios. The "genius" told me "but you leave your keys when you drop your car at the garage!". I had to send the computer across the country for corporate IT to wipe it before getting it serviced, for a battery replacement..
grupthink 5y ago
Mirror https://archive.md/iRAcz https://archive.md/iRAcz
ChrisArchitect 5y ago
Normal link https://www.reddit.com/r/legaladvice/comments/r632w5/sent_my_phone_to_google_for_replacement_they/ https://www.reddit.com/r/legaladvice/comments/r632w5/sent_my...
ksec 5y ago
May be I am cynical. I think we need to wait for more information because something about this seems slightly suspicious.
rambojazz 5y ago
Post has been deleted. Can somebody explain what happened exactly? I have a hard time believing Google posted nudes on social media and stole money from him.

333 points by po1nter 5y ago

Where are they?

The link offers no proof, but that's somewhat understandable (I wouldn't want to dox myself either after such an event). If the claim is true, I hope they find an appropriate way of broadcasting it with credibility.

hardlianotion 5y ago

The poster account has been deleted. Don't know what that means.

deleted 5y ago
[deleted]
drbacon 5y ago
My very naive speculation is that OP finally talked to a lawyer who advised: STOP TALKING SPECIFICS ON SOCIAL MEDIA.

raxxorrax 5y ago

Really should think about just paying another few hundred bucks and just keep the device if it contains nude photos of your wife which you cannot wipe. Don't send that device anywhere... Provided this story is true, I would guess the device might never have reached Google and it might have been stolen on the way there. Don't know what that would mean for liability.

mabbo 5y ago
Seriously? You're blaming the victim?
- ARandomerDude 5y ago
  Somebody: "I can't believe it! I like to leave stacks of $100 bills on the seat in my car and my car keeps getting broken into. Outrageous!" Somebody else: "You should probably take or hide the cash when you get out of your car." Offering wisdom for how to avoid a bad situation twice is not the same thing as blaming the victim.
  - criddell 5y ago
    As far as wisdom goes, it's pretty weak and probably doesn't need to be said.
    - ARandomerDude 5y ago
      If it didn't need to be said, you wouldn't see "Lock, Take, Hide" signs in many cities.
      - criddell 5y ago
        There's a big difference offering that advice in a areas with a crime problem before anything is stolen than telling a person they should have hidden something after the theft. At that point you aren't being helpful.
    - raxxorrax 5y ago
      I believe that any egregious behavior is on the one that leaked the private data. I don't think that has to be said honestly.
  - advisedwang 5y ago
    A better analogy is a mechanic stealing money out of your car. And not money on view either, some place they'd have to look for it like in the visor.
    - BiteCode_dev 5y ago
      It still works. I would blame the mechanic, sue if necessary, but it's still good advice not to let any valuable in your car if you lend it to a 3rd party.
ortusdux 5y ago
Per the link: "The last ping from the old phone (which was today) was the same as the place we shipped it. The exact location down to the very building." The phone was successfully RMA'ed a month ago, which presumably would include Google confirming possession.
jaclaz 5y ago
BTW it seems: > They had access to the Google account which is where the photos were. like the photos were not on the device, but rather on some Google service, but the phone had remained logged in that account. It should be possible in such cases to access the Goggle account with another device and change password (I believe, kicking out the broken phone login).
- blfr 5y ago
  You can even log out particular devices on account.google.com (security tab → your devices). This is a weak protection, however, since they're probably cached on the phone.

JoeAltmaier 5y ago

The apocryphal 'they'. Not knowing who that is, there is no story. Could have been the guy himself; the mailman; somebody in the mail room at Google; somebody where the device was mis-delivered. Could even be the wife, indulging an exhibitionist urge. Who knows.

VortexDream 5y ago

I'm sick of people, so I'm not going to read the inevitable comments that are going to come. Look, face it, some people like taking nude photos of themselves and they like sharing them with their partners. There is absolutely nothing wrong with this. It's not their fault if something like this happens. People should be able to feel secure in the tech that they use, in the companies that they entrust their information with. It's a fuckload of bullshit victim blaming and I see it every time the topic comes up. I'm sick of it.

INTPenis 5y ago
It's definitely the fault of some individual related to the service. BUT, you must be pretty stupid to send a device away that contains sensitive information. And unfortunately, a lot of people in society don't expect this type of intrusion by a company they trust. But they should. And I don't think you can blame Google for any of this.
- imbnwa 5y ago
  > BUT, you must be pretty stupid to send a device away that contains sensitive information. Irrelevant
  - INTPenis 5y ago
    It is relevant because there's a massive deficit in basic infosec among the populations of the world. Why keep blaming big corporations when we need to get smarter ourselves?
    - ska 5y ago
      > Why keep blaming big corporations when we need to get smarter ourselves? Why do we pretend that a practical answer to anything is "well people should stop behaving like people" ? Systems should be designed to work with people as they actually behave, not an idealized version.
    - kelnos 5y ago

game_the0ry 5y ago

There are a lot of leaked nude selfies on the net 0 like a lot. It makes me wonder how many we were leaked the same way these were.

encryptluks2 5y ago

Not here to victim blame, but just point out some things to help others in the future. 1. Use a password and encryption 2. If you can still turn on the device, wipe it before you send it off for an RMA. 3. If you can't access the device, login to your account online and remove access to it. You should do this even after you wipe it. 4. Save everything sensitive on removable storage medium by default.

vmception 5y ago
These guys sent it in for RMA because it couldn't be turned on Also the photos were in the google account so none of this advice would have mattered anyway aside from the advice #4 about not doing it, which is moot. They and many people probably auto backup all photos on the device to the google account. Not sure if there is a way to distinguish which photos are too sensitive for online backup with that service.
- encryptluks2 5y ago
  It would have mattered because you can deauthorize a device from your Google account on a computer, like a phone and if they are saved locally as well you can remove SD card before sending it back. The only thing I'm unsure of is if thumbnails are saved in a standard image format but those should get removed as well during the notification that the device has stopped syncing, but if mobile data is turned off it may cache a few low res thumbnails.
  - orthecreedence 5y ago
    Where's the SD card on a Pixel?
    - encryptluks2 5y ago
      I'm not saying it has one, again the point was for people RMA'ing devices in the future to help prevent issues like this. A startup password with encryption could have helped prevent this.

lewantmontreal 5y ago

I’ve taken my iPhone to a couple of repair shops. They always ask for the pin code and I always refuse and say it’s a work phone. Very much hoping the secure enclave works and my data has not left the phone.

deleted 5y ago
[deleted]
admn2 5y ago
Even when I took my phone into a third party repair place for a new screen they required me to give them my passcode and disable Find My Phone. Seemed super unnecessary.
- Noturos 5y ago
  I used to work as a certified apple tech. Turning off find my iPhone is standard procedure for every repair. But techs are never supposed to ask for your passcode. Most diagnostics can be performed outside the OS, and those that can't are supposed to be performed in front of the client.
gharper 5y ago
After reading far too many similar stories to this one, I've always made a fresh backup and completely wiped my phone before walking into the store. Any testing they need to do can be done on a factory default installation, and restoring from backup is relatively painless these days.
nvarsj 5y ago
Even the Apple store does this when you take your phone for repair. I only did it once and they did a crap job anyways (screen replacement, and they got dust in the camera lens area somehow).
aj3 5y ago
The official repair shops that Apple Repair will guide you to should never ask for the pin, afaik. There is that mode for diagnostics which you need to approve, but you don't need to provide the pin - just unlock the phone and press approve button yourself.

dandare 5y ago

How do you disable your old phones especially those those that do not work (due to shattered screen mostly) before giving them up for recycling or buyback? I am always worried someone will fix and misuse my old phone.

throwaway81523 5y ago
I wonder if there is a way to connect to it through usb in order to wipe it.
- crtasm 5y ago
  There is, it's called adb https://developer.android.com/studio/command-line/adb https://developer.android.com/studio/command-line/adb My phone has a button combination to hold when powering on to get into a recovery mode, then you can wipe it with adb.
- dinkelberg 5y ago
  It might not be possible to wipe the data off the flash memory, due to how flash memory works. As you can only reset bits on the flash memory some amount of times, flash memory controllers try to avoid resetting bits and they try to distribute resets evenly on the memory (called wear leveling), so that it doesn't happen that parts of the memory are already worn out while other parts are healthy. So "deleting" and even "zeroing" flash memory might not do what you would expect. Instead of resetting the bits of the original content, it might put the zeros somewhere completely different. And wipe commands that one can send to flash memory chips are sometimes broken too (they might be implemented as no-ops). Edit: Also, even if you tell it to write zeros everywhere, it might not delete the content, because there is hidden extra memory on flash memory chips.
  - jeffbee 5y ago
    This is FUD. Flash is fundamentally easier to wipe than hard disk drives. You’re just using a defective mental model for the process. While magnetic recording needs to be overwritten, flash memory does not. Flash has a dedicated erase command. Flash can only be written if it was erased. You can erase an entire flash device in a split second.

betwixthewires 5y ago

I've worked in these contract cellphone repair/refurbishment facilities many years ago, the big warehouses where telecoms and manufacturers send these warranty phones to be triaged and repaired, and let me tell you, something like this is not surprising at all. Most of the people there did good work, but all it takes is one. Personally I'd never send my phone in to repair, and I'm skittish about buying any refurbished phones.

kingcharles 5y ago
I had to buy dozens of old phones on eBay once for testing a new SMS product and I can tell you that most of the phones were not wiped and lots had naughty photos and videos still on them :|
- mythrwy 5y ago
  Maybe because thieves can't be assed to wipe the phone before putting on ebay?
deleted 5y ago
[deleted]
arbuge 5y ago
I bought 2 "refurbished" Google Assistant smart speakers from Ebay over the last year or so. Bought of them came still logged in to their prior owner's Google accounts. All that was necessary on the part of the refurbishers was to spend a few seconds doing a factory reset (which was the first thing I did at my end), but even that was too much to ask, apparently.
ilamont 5y ago
Years ago I had some friends who worked in a local photo shop, and once I stopped by and they showed me around. This was in the days when 99% of the population developed film and made prints by dropping off the little canisters at such shops with an order form. It usually took a few days to get them back. Everyone made assumptions that the process for developing photos was anonymous and private - you dropped off a canister, and picked up photos and negatives in a clean, sealed envelope a few days later. How wrong we were. The process was semi-automated using these gargantuan machines in a back room, but the staff usually looked at each frame as went through the process. They made extra copies of spicy ones which went straight into a special binder kept on a nearby shelf. This shop had two or three of these binders. Some years later I was in another country and photographed violent demonstrations right outside the hostel where I was staying. When I went to pick up the photos, the staff made it clear that they had seen the images. They were supportive (they wanted to get the word out internationally) but what if copies had been sent to the local intelligence services instead? Nowadays the tech is different, but when there are no barriers to viewing private information, we see similar types of behavior.

bhawks 5y ago

The RMA instructions should include using android.com/find to lock and wipe an inoperable device if it ever gets turned on again. https://support.google.com/accounts/answer/6160491?hl=en https://support.google.com/accounts/answer/6160491?hl=en

mattnewton 5y ago
This is what apple asks you to do IIRC. They could have just copied that practice instead of having to learn the hard way why ಠ,_｣ಠ Though, this apparently didn't save apple in at least one recent case: https://www.theverge.com/2021/6/7/22522560/apple-repair-multimillion-iphone-nude-photos-privacy-settlement-pegatron https://www.theverge.com/2021/6/7/22522560/apple-repair-mult...
- rootusrootus 5y ago
  > this apparently didn't save apple I can't imagine it would. It isn't a contract, just a best practices guide. Apple and Google are still ultimately responsible for what their employees do on the job.
deadbunny 5y ago
I would suggest that this should also be part of the RMA process for the repair center. I'd assume it can be done on some device id basis, so 1) Check in phone 2) Initiate wipe 3) put in service tech queue
qwertox 5y ago
> About a month ago my wife broke her pixel phone. It couldn't be turned on so we couldn't wipe it. That says it all. You can't expect them to try 24/7 until they get a confirmation. In addition, I doubt that they would have included the SIM card in the RMA, which means that the device would not be online through mobile, and there's no reason for the repair shop to connect the device to the WiFi as the first step, so that any erase-request can come through. You either trust the RMA process or you burn your phone.
- 5y ago

BiteCode_dev 5y ago

I've lost a laptop in an airport shuttle with intimate pics on it once, and got worried sick. After that life lession, I always made sure to have a veracrypt partition for this stuff. But a separate, offline device is better of course.

sannee 5y ago
Modern Android actually does support disk encryption. And the Pixels even have TPMs that should (?) safeguard the key, preventing offline brute forcing the unlock pattern. I wonder what happened here that this did not work...
- Consultant32452 5y ago
  I wonder what kinds of tickets, if any, justify them asking you for your unlock pattern.
  - BiteCode_dev 5y ago
    This week I was in a chat with the REAL support of a crypto currency. Unable to help me with my problem at first (we eventually figured it out), they felt they hit a dead end and said: "ok, just send us your wallet.dat, we'll fix it". I know those guy were the real deal. I knew they would not try to steal the money I had on this wallet, because it was so little it was not even worth the time. Yet, the fact they asked that proves how much support can badly educate their users. Of course, I didn't send my wallet, and found another solution since I'm tech saavy. But still...
    - Consultant32452 5y ago
      I once got my screen replaced at one of the phone fix-it places. It's a decent sized chain, not just some rando. On the form you fill out during drop-off it asks you for your unlock code.
      - stjohnswarts 5y ago

jimbob45 5y ago

Bit of a shame that this will go viral and we’ll never know if Google would have properly handled this on their own. I’d like to think yes but it’s tough to believe the crook’s first attempt at this was also the first time they were caught. That said, I’m wondering if Google didn’t farm out their repair work to a 3rd party, leading to this situation.

ocdtrekkie 5y ago
> That said, I’m wondering if Google didn’t farm out their repair work to a 3rd party, leading to this situation. They almost certainly did, since a large portion of Google's offices are staffed by contractors as well. There is no way they're paying Google salaries and benefits to the guys handling RMA phones. And that's part of the problem. You send the phone to Google, a company you (very mistakenly) trust, and they immediately hand it over to a lowest bidder shady shop. These services should definitely be letting you know your phone is actually going to AAABob's Phone Repair Shop, and not some magical Google factory center.

kingcharles 5y ago

This sort of leaking is now a felony in most US jurisdictions, e.g. Illinois: https://www.criminaldefenselawyer.com/resources/revenge-porn-illinois.htm https://www.criminaldefenselawyer.com/resources/revenge-porn...

oxymoran 5y ago

This isn’t OP fault but it boggles my mind that people still use google products. How many times do companies like google and Facebook need to show that they don’t have your best interest at heart before you stop using their products? People won’t even buy genetically modified food but yet they have no problem shelling out thousands of dollars to authoritarian, surveillance centric parasites. Please stop.

djbusby 5y ago
Which phone tho? I don't have anything compatible with iOS so those are unusable. So, I get android. And nearly the only phones w/o crap-ware are Pixel or other Google Flagship. Advice?
- Bud 5y ago
  You absolutely do have things compatible with iOS. You probably just don't know it yet. So the advice, is, try iOS. Stop rewarding Google for stealing iOS, creating Android, and then loosing this kind of bullshit on the world.
  - sulam 5y ago
    Android was created in 2003. Google bought the company in 2005. The first iPhone was released in 2007.
    - Bud 5y ago
      Are you being misleading on purpose, or was it just an accident? The first phone to run on Android debuted from Google in 2008 and was universally recognized as a hilariously obvious copy of iOS and everything about the iPhone. The early internal versions of Android bore absolutely no resemblance to what was finally released in 2008. There wasn't even a touchscreen at all, and they had a physical QWERTY Blackberry-esque keyboard. They magically changed after the iPhone was released. This is all quite well-documented. https://slate.com/technology/2008/11/what-the-google-phone-stole-from-the-iphone.html https://slate.com/technology/2008/11/what-the-google-phone-s... https://en.wikipedia.org/wiki/Android_(operating_system) https://en.wikipedia.org/wiki/Android_(operating_system)

rootusrootus 5y ago

We need to educate people on how to secure the data on their phones so that even the manufacturer cannot reach it. And if that is not possible for a particular device, that should be clearly understood so people can make an informed choice about what smartphone they use. Can't just tell people 'do not put nudes on your phone' because while it's good advice, it misses the point. And, of course, whoever does something like this should be strung up by their toenails in the public square.

commandlinefan 5y ago
> how to secure the data on their phones so that even the manufacturer cannot reach it If that were possible, the FBI would shut it down.
- djbusby 5y ago
  Signal?
- rootusrootus 5y ago
  Haven't they fought Apple on that in the past? AFAIK they still have to rely on exploits to get past the pin code. If that's not true I'd like to know.
- jfrunyon 5y ago
  [citation needed]
Bud 5y ago
No. We don't need to "educate" people on how to magically dodge evil behavior. We need to punish the evil behavior. Like you said in your last sentence.
- JohnFen 5y ago
  We need both.
- jfrunyon 5y ago

marcodiego 5y ago

Wait! Text was deleted. How can we know this is legit?

ZekeSulastin 5y ago
Unddit is pretty good to read deleted or moderated posts as long as the deleted text was up long enough - https://www.unddit.com/r/legaladvice/comments/r632w5/sent_my_phone_to_google_for_replacement_they/ https://www.unddit.com/r/legaladvice/comments/r632w5/sent_my...
- froh 5y ago
  And how does this prove anything other than there was a Reddit post making a wild claim?
rootusrootus 5y ago
Even if the poster had not deleted the text (I saw it before they deleted it, and the text is posted in this thread, however), that would not do anything to make it legit. It is just someone making a claim on the Internet. It is good fodder for a security discussion, though. The merits will have to be decided in a court of law.

dudeinjapan 5y ago

Well I just hope you and your wife learned your lesson never to remove your clothes again.

Bud 5y ago

And people wonder why Apple wants to try to keep control of iPhone repair processes. This is one of the big reasons why.

izacus 5y ago
I'm sure it's this and not the extra profit on increase new device sales and significantly higher cost of "original" replacement parts.
tsrand0m 5y ago
Wasn’t there a similar case with apple repair. I vaguely remember seeing that on hacker news too. Apple repair nude will get you there
- MerelyMortal 5y ago
  That, and I remember years ago, someone claimed their cryptocurrency was stolen while their Apple laptop was in for repairs (wallet unencrypted on the laptop).

bayesian_horse 5y ago

One of the many reasons why I refuse to make or keep nudes of anyone...

f38zf5vdt 5y ago

These are the steps I take to repair my phone when it doesn't boot. 1. Remove phone case. 2. Desolder eMMC chip after looking it up which one it is online. 3. Put eMMC in old coffee grinder, grind away. 4. Buy new phone.

reginold 5y ago
"Phones are cheap, just buy another" WOW the privilege. From a thread about a similar incident on Twitter: https://mobile.twitter.com/mojonojo3/status/1467453133538611202 https://mobile.twitter.com/mojonojo3/status/1467453133538611...

WesolyKubeczek 5y ago

Last time I sent a phone into repair, I wiped and reset it, presumably so that techs could test it properly (broken screen and digitizer). I wish I didn’t have to; but when you’re logged into everything, your bank is there too, and your phone is the second factor in a lot of things, damn it’s too much of a risk. I wish phones could boot into some kind of field tech/diagnostics mode where all aspects of hardware could be tested as thoroughly as needed. Maybe there exists one and I’m just ignorant?

not2b 5y ago
From the original post: "About a month ago my wife broke her pixel phone. It couldn't be turned on so we couldn't wipe it."
- beamatronic 5y ago
  Into the shredder it goes
- WesolyKubeczek 5y ago
  I'm not trying to be smug here. Just saying that there were some circles of hell I wish I hadn't to go through. If the phone didn't even turn on enough to go into some DFU mode, I guess I'd be just as fucked. Just had an idea to get a burner phone, fill it with my own nudes and give it to repair. Let the perverts have nightmares for a while.

thatguy0900 5y ago

I used to work at a att store. This is common. One particular incident involved a ring of workers at multiple stores who had a shared Dropbox they would upload anything they found to. Any time you hand your phone over to underpaid 20 year old guys you should be erasing everything sensitive

flatiron 5y ago

It was deleted. Here is the OG Text: "Ok so this just happened. Buckle up. About a month ago my wife broke her pixel phone. It couldn't be turned on so we couldn't wipe it. We contact Google and used the device care to get an RMA. Today someone posted nude pictures of my wife and I to her social media accounts. They accessed her Google account and tried to lock us out. They used her PayPal to send someone $5 (a test probably). How could this happen? Well Facebook and Instagram show logins from Texas. The old phone still showed on our find my phone app and it was in Texas. Guess where we sent the phone for RMA? The last ping from the old phone (which was today) was the same as the place we shipped it. The exact location down to the very building. Clearly they fixed the old phone and since it wasn't wiped, was still logged into her Google account. I called Google and they basically said "woah that's fucked up we'll get back to you". We filed a police report but I don't expect they will do anything. What are my options here for sueing Google? I know that sounds insane but this breach of trust and privacy is egregious. Hundreds of people have now seen my penis including our friends kids. It's really fucked up. Any advice on what to do here?" my big question is whether this phone is password enabled. also this stinks because i know the first comment is "well do a factory reset" but if the phone doesn't turn on, etc. then i don't believe that is possible (short of possibly ADP which is out of the reach of 99% of people)

t0mas88 5y ago
Based on a previous case with Apple, this guy is going to be a millionaire. So at least he has that.
- nikolay 5y ago
  Maybe he already is - thus the deleted comment.
  - tpmx 5y ago
    That's more of a sign that he got legal advice, hopefully from an actual lawyer that he hired.
- oh_sigh 5y ago

obiwan14 5y ago

IS this title correct? The title on Reddit says: > Sent my phone to Google for replacement. They fixed the old one and used it to post nudes on my wife's social media and steal money It doesn't say they pulled wife's nudes from the phone and posted them online, but that they used the old phone to post nudes on the wife's social media... Or did I miss something?

paulgdp 5y ago

To be fair, when sending a Pixel for reparations, Google very clearly and explicitly asks to factory_reset the phone. I personally didn't reset it when I sent my Pixel 3 to fix the charging port because my Pixel was fully encrypted. All Pixels are encrypted by default as long as you have any kind of lock method enabled (PIN, password, shape...). I don't really understand how this person got his files in cleartext and accessible.

KZeillmann 5y ago
My impression from the (now deleted) text is that the phone wasn't booting or in a state where it could be factory reset, at least not without considerable effort.
Tagbert 5y ago
In this case, the phone would not turn on prior to repair and could not be wiped.
- 2OEH8eoCRo0 5y ago
  How did the person conducting repair power it on and unlock it then? Edit: I mean how did they bypass the lock screen?
  - Johnny555 5y ago
    Sometimes letting the battery drain completely will clear a hung phone (which is like the old "take the battery out for 5 minutes, then try it again" trick). Or the service center knew the magic buttons to press to get it to boot. Or the battery was bad. Or one of a million other reasons that a phone can fail in a way that makes it appear dead, but a service tech knows how to get it running.
  - weswpg 5y ago
    by repairing it
  - open1414 5y ago
    maybe no password?

dekhn 5y ago

Flagged because the original post and its details were deleted. There's just a pointless conversation about whether you should contact a lawyer, which is literally the only thing this person should have done.

echelon 5y ago
I understand your take, but I would rather see the HN community's take on it rather than Reddit's. There are Google and Apple insiders, actual lawyers, repair techs, and more here. Even tangential threads can be interesting.
blfr 5y ago
OP's contents are posted in this thread: https://news.ycombinator.com/item?id=29406217 https://news.ycombinator.com/item?id=29406217

jfrunyon 5y ago

[dubious - discuss] There's a few things that make this pretty unlikely. Google doesn't triage or repair the phones themselves, they contract it out just like everyone else. And the people they contract it out to almost certainly have procedures in place which are meant to ensure that neither the devices themselves nor the data on them get out. I'm not saying it's false, but I would definitely take it with a grain of salt. That said, before you send any devices in for repair, you should wipe them to the best of your ability. Also, you should set a secure password (PIN, pattern, etc) - even if you set your device to not lock, you can encrypt/require password on startup, which would prevent the repairperson from seeing the photos much less posting them.

jandrese 5y ago
> And the people they contract it out to almost certainly have procedures in place which are meant to ensure that neither the devices themselves nor the data on them get out. I think your impression of what phone repair places are like may not match reality. The industry is far more ad-hoc and margin chasing than the rows of immaculate benches staffed by well paid professionals in a brightly lit facility like they might show in a brochure.
- jfrunyon 5y ago
  I haven't personally worked in one of the big contract places but have close friends who did. I think your impression of these places as being simply "phone repair places" may not match reality, to be quite honest.
throwaway19937 5y ago
> There's a few things that make this pretty unlikely. Google doesn't triage or repair the phones themselves, they contract it out just like everyone else. And the people they contract it out to almost certainly have procedures in place which are meant to ensure that neither the devices themselves nor the data on them get out. Snowden and Manning smuggled out top secret information; it seems a bit much to assume that the low bidder on a phone repair contract has leak-proof security.
5y ago

KKKKkkkk1 5y ago

I read a history of the NSA recently [0], and what struck me is that every time the NSA's code-breaking techniques were invalidated, this was due to a US agent leaking secrets to adversaries. If the NSA cannot address every insider threat, why do we expect tech companies to be hermetically sealed? [0] Code Warriors, Stephen Budiansky (https://www.penguinrandomhouse.com/books/236807/code-warriors-by-stephen-budiansky/ https://www.penguinrandomhouse.com/books/236807/code-warrior...).

rootusrootus 5y ago
NSA agents have to know some secrets, or they can't do their job. Repair techs at Google/Apple/etc do not need to know any secrets in order to do their job.
- inetknght 5y ago
  > Repair techs at Google/Apple/etc do not need to know any secrets in order to do their job. Certainly not state secrets. But they do need to know trade secrets. For example: exact (official) replacement products, procedures, and documentation steps in order to ensure the device doesn't show up as "this is fraudulent or pirated or hacked or modified or whatever the fuck the copyright overlords demand can't be done".
  - yjftsjthsd-h 5y ago
    Yeah, but we care a lot a lot less about the company's secrets than customer secrets.

Causality1 5y ago

This should be a reminder to the rest of us that IT and technicians are humans with human vices, and a large fraction of them will look at anything they can find. For every nude that gets posted online a thousand are added to personal collections. Unless they have someone looking over their shoulder or are in a hurry, they will scroll your photos for anything juicy.

exabrial 5y ago

Even worse: Never lend your google phones to friends. If they hard reset the phone before handing it back to you, Google will refuse to reactivate them. I exhausted every option with their support and am left with a $800 brick.

TrueGeek 5y ago
Your friend factory reset the phone and put their own password on it? To be fair to Google, they should refuse - if they agreed to wipe someone else's account that would be a HUGE breach of protocol based just on your word. What would keep people from selling used phones and then calling Google to deactivate them? Or just calling Google and deactivating random phones? If your "friend" refuses to log out and re-reset it then the correct thing to do here is to report it to your homeowners insurance. Your friend basically stole your phone. Insurance should pay for it and then they can go after your friend to get their money back.
- clort 5y ago
  s/friend/ex-friend/g
jonathantf2 5y ago
Why would they hard reset them? You've confused me

xanaxagoras 5y ago

What would reddit be without heavy handed moderators deleting interesting and relevant comment replies? You can read a lot more of the discussion here: https://www.reveddit.com/v/legaladvice/comments/r632w5/sent_my_phone_to_google_for_replacement_they/?ps_after=1638337537 https://www.reveddit.com/v/legaladvice/comments/r632w5/sent_...

jpambrun 5y ago

Somewhat related, but not long ago my Macbook had a bulging battery issue and the Apple just flat refused to service it under warranty because I would give them the credentials to unlock the bios. The "genius" told me "but you leave your keys when you drop your car at the garage!". I had to send the computer across the country for corporate IT to wipe it before getting it serviced, for a battery replacement..

grupthink 5y ago

Mirror https://archive.md/iRAcz https://archive.md/iRAcz

ChrisArchitect 5y ago

Normal link https://www.reddit.com/r/legaladvice/comments/r632w5/sent_my_phone_to_google_for_replacement_they/ https://www.reddit.com/r/legaladvice/comments/r632w5/sent_my...

ksec 5y ago

May be I am cynical. I think we need to wait for more information because something about this seems slightly suspicious.

rambojazz 5y ago

Post has been deleted. Can somebody explain what happened exactly? I have a hard time believing Google posted nudes on social media and stole money from him.