30 ms·
Don't send your Google phone in for warranty repair/replacement
- emuneee 5y agoAs a Pixel user who has sent their device in for repair, how does the repair tech get past the device authentication and into the device? (I'm assuming the user had a device password/passcode set). If possible, this seems like a glaring security issue for Pixel users.
- trevyn 5y agoHas Google at any time ever asked a user for their password to do a repair? I remember a physical Apple Store (real, Apple Inc., in California) asking me for my password for a laptop hardware repair. They were OK with my declining to do so.
- pstrateman 5y agoThey don't have a password.
- drozycki 5y agoHer phone was protected with a passcode. Please do not spread misinformation https://twitter.com/avantgame/status/1467222753799393281 https://twitter.com/avantgame/status/1467222753799393281
- deleted 5y ago[deleted]
- bagacrap 5y ago"somehow" they turned off the lock screen requirement. I'm thinking they guessed the lockscreen gesture, perhaps it was weak or there were finger marks on the screen.
- disgruntledphd2 5y agoWhen I sent my pixel in for repair, I was required to remove my PIN.
- levi_n 5y agoGiven I don't have much experience with the Google ecosystem, how does one know which photos were accessed? (Not calling her account into question, just curious)
- systemvoltage 5y agoBuried in the thread if it was Google Inc.: > yes it was the official Pixel warehouse, arranged directly by Google support.
- lvs 5y agoUnless someone wants to leak internal information, there is no such thing in either case, as far as we know. These services are almost certainly contracted to third parties.
- Gigachad 5y agoThat’s still offical google as far as I’m concerned. It’s under the control of google. The customer went through google. I would think different if they took it to some mall phone repair stall.
- dkersten 5y agoSo? If google arranged that on their behalf, its google's responsibility. Doesn't matter who they subcontract or delegate to.
- hulitu 5y agoWell, this should be common knowlwdge: don' t keep personal data on devices.
- deleted 5y ago[deleted]
- infotogivenm 5y agololl yea we’ll all get right on that
- gao8a 5y agoYou don’t use email on your phone?
- nr2x 5y agoI too remember using a rotary telephone.
- mosselman 5y agoNot having personal data to begin with should be common knowledge.
- stjohnswarts 5y agoYeah, be completely generic, an everyman (person?)
- mosselman 5y agoYeah, a blob if you will.
- stjohnswarts 5y agoare you serious? What do you think a phone is for, just phone calls?
- NullPrefix 5y ago
- otterley 5y agoAlthough I have no love for Google, claims like this that lack proof or evidence ought to be viewed with great skepticism.
- quitit 5y agoGenerally clever people don't lie about this kind of stuff: they have too much to lose and do not want the notoriety and libel case that would follow. All claims deserve to be followed up - and should this be false then the person will get what's coming to them. This problem with repairs appears to happen frequently enough to not be discounted off the cuff.
- lotsofpulp 5y ago> and should this be false then the person will get what's coming to them. How?
- quitit 5y agoIf it’s a lie, it’s defamation (libel).
- lotsofpulp 5y agoI cannot remember the last time someone got prosecuted or sued for libel for falsely accusing a business of something. It happens numerous times every day. I would be willing to bet nothing happens to this person if their claim turns out to be false.
- quitit 5y agoYou can't remember, therefore it doesn't happen. Magical thinking there.
- lotsofpulp 5y agoI know that the US has a very high bar for defamation claims. It is common knowledge that you can make things up in yelp reviews or twitter or wherever with no big consequences. https://en.wikipedia.org/wiki/United_States_defamation_law https://en.wikipedia.org/wiki/United_States_defamation_law
- spaghetti-guy 5y agoAccording to the Google support site, all Pixels are encrypted by default. So, this shouldn't even be possible...unless perhaps there was no lock code on the device?
- pxeboot 5y agoIf a tech tries a random 4 digit passphrase on every device they work on, they are bound to get it right occasionally.
- lvs 5y agoPattern unlock. Incredibly insecure.
- null_deref 5y agoWhy?
- gruez 5y agoprobably because there are a few "popular" patterns that many people use.
- quitit 5y ago1. Easy to view & remember. 2. The oil smear is visible in reflected light, and that pattern is not quickly overwritten by using the device. 3. Typical gesture patterns mean gestures start from similar positions (high) and are frequently unoriginal. 4. Gestures are simpler than the equivalent code (e.g. the passcodes 1397 and 1235987 are gesturally identical) 5. In practice the reality of finger sizes mean that join-the-dots encourages users to draw a gesture using only adjacent dots (e.g. connecting dot 1 to 2, 4 or 5, rather than 1 to 6 or 8.)
- staindk 5y agoI think out in the real world they are insecure because it's easy to shoulder-surf and get a peek at the pattern being input. Overall they are probably similar to pin codes... some people just have 0000 as their pins, or draw an L for a pattern. Sending a phone in for repair negates the shoulder-surf issue but yeah. Perhaps Google just has a backdoor.
- awinter-py 5y agothis is the second one of these that hit HN this week? other was a post deleted from reddit. seems like possible explanations here are: - standard 'loveint' at support depts (many companies with personal data have stories about abusing system access to look at personal info of SO / randos) - illicit group operating within or adjacent to goog doing some kind of espionage or ransom model - google-haters inventing or amplifying a pattern of behavior? (but with what motivation) - not obvious if the phones are passwordless, or if insiders are using a 'universal unlock' feature to decrypt pixel devices -- if the latter, is that a bigger story than the stalking? if this is only happening to passwordless phones, still an abuse of trust, but I'm okay with 'don't send passwordless phone to support' as a consumer best practice.
- theturtletalks 5y agoShe said her phone would not turn on or she would've reset the phone before sending it in.
- zibzab 5y agoPSA: You can de-authorize your phone from Google security settings on their website. (Not that it should be needed. I hope they lock up the guy and his manager for this)
- namelessoracle 5y agoShe stated she tried the remote steps later in the thread.
- pizza234 5y agoSome relevant information (https://twitter.com/avantgame/status/1467236223550779392 https://twitter.com/avantgame/status/1467236223550779392): > someone else reported the same thing happened to them on Reddit recently, using the same RMA for a similar phone at the same Texas facility. Taking the story as true, it'd seem to be case 1. Taking the story as not true (case 3.), she's in a professional position where publicity wouldn't hurt. Her report looks questonable (not necessarily false): > They deleted Google security notifications in my backup email accounts. If the accounts were backup, and she's a security-conscious person as she claims in the same post, how did they do that? They were backup, so they couldn't use the main account to reset them. I can think of the accounts being opened in different browsers, but it doesn't seem a very plausible scenario.
- turbinerneiter 5y agoThey tell you to factory reset the phone before you send it in.
- adewinter 5y agoShe explains this very clearly: https://mobile.twitter.com/avantgame/status/1467242719273631745 https://mobile.twitter.com/avantgame/status/1467242719273631...
- e40 5y agoShe replied to someone saying this that the device wouldn't turn on. If that's true, how did they use her phone to break into her gmail?
- CryptoBanker 5y agoShe sent the phone in to be fixed. Obviously they fixed the phone?
- NavinF 5y agoRight but after a reboot, all the data is encrypted until you enter your password
- jfrunyon 5y agoSure, and then they made sure it couldn't connect so that it didn't wipe itself, but somehow it still connected to send security alerts to her and manipulate her Gmail account. Stop making excuses for her. Take a moment to think critically. It's a heaping steaming pile of obvious bullshit.
- Terry_Roll 5y agoI dont have a phone because I have enough trouble keeping my life private from the govt, let alone anyone else in society. Its bad enough science stole my privacy! I find phones amusing because of all the trouble and strife they bring. There are pro's and cons for phones, I get it, but should I be that accessible to anyone who can dial the right number combination or use a war dialler?
- stjohnswarts 5y agoPhones can be quite secure if you take the time to secure them.
- Terry_Roll 5y agoI've had NSO like activity on my phone, I've had hacking on my phone since the 90's. So what I have learnt with the law is, firstly it generally needs evidence although there are some rare situations where accusations are enough. Even when you have evidence, this can still generally be removed or the police prevented from seeing it. Another problem with phones is you cant control when they drop from 3G or 4G back to 2G which then makes it easy to capture the conversation from the air and do a replay attack. https://www.eff.org/deeplinks/2020/06/your-phone-vulnerable-because-2g-it-doesnt-have-be https://www.eff.org/deeplinks/2020/06/your-phone-vulnerable-... External influences, control when your phone drops down to 2G and I have not seen any phone manufacturer put in an option to terminate calls and prevent calls being made on 2G. Things like the PinePhone and Librem are missing a trick. The other problem with technology is the sheer number of options or inability to access and modify in order to make secure. Whether we like it or not, our lives are in the hands of others. I gave up a long time ago when I realised how many legal ways there are to kill people. Its quite clever really but some institutions have had hundreds of years to perfect their dark arts.
- wffurr 5y agoThis comment fits in just as well with a phone from the 1870s as a phone from the 2020s. I can just imagine someone saying this about the neighbors' party line.
- 5y ago
- gpm 5y agoMore useful takeaway is to have a secure password on your phone. Repair techs aren't able to do anything that a pickpocket couldn't...
- jfrunyon 5y agoHmm. I wonder how this person got notifications even though their phone was offline to avoid being wiped. I also wonder why this person got notifications. Most services don't send you notifications just because you used a device which is already logged in. Complete and total duplicate of https://news.ycombinator.com/item?id=29404954 https://news.ycombinator.com/item?id=29404954 and again with absolutely no evidence even though there are apparently tons of evidence left by this person doing this with absolutely no cuation (security notifications left in trash etc).
- monkpit 5y agoOff topic: is it just me or is Twitter becoming much more hostile to users who aren’t logged in? I can’t click anything (mobile safari) without being nagged by a modal to sign up/log in.
- city41 5y agoWhen the modal pops up, refreshing the browser lets you see the page.
- snovv_crash 5y ago... for now.
- schleck8 5y agoYes, it is. So is Reddit. I'm using alternative frontends now like Teddit, Nitter, Fritter, Invidious etc.
- lobocinza 5y agoUse Old Reddit.
- deleted 5y ago[deleted]
- kartayyar 5y agoHow do you get a notification for what picture was viewed? I don't see any Google account setting for that. That kind of makes me doubt this report, at the very least part of it.
- notreallyserio 5y agoIIRC you get a notification the first time someone views a photo (or maybe for any specific photo?) in a shared album. Maybe the Googler or Googlercontractor was dumb enough to share the album with himself for later perusal?
- Thorrez 5y agoDid she say she got a notification for what picture she viewed? She said "activity logs", which I'm not sure exactly what she means, but it might mean [1] which shows files that have been recently viewed. Full disclosure, I work at Google but not on anything related to this. [1] https://drive.google.com/drive/recent https://drive.google.com/drive/recent
- hnarn 5y agoIt sounds to me like the real story here is how someone was able to access a Pixel that was turned off.
- zibzab 5y ago> The hacker changed my gmail settings to mark all security messages from Google as spam The fact that this is possible is a weakness in itself. Google security messages should be signed and treated differently by the client & server
- vexxed-concave 5y agoThis feels way too coincident with her recent book release. Given her already public figure persona and proceeds from prior works, why EVER take the risk to ship such personal hardware to a 3rd party?!! Just get a new phone and sync a back-up…unless it just might be beneficial PR to, apparently, do the “risky” thing and carp about it. So far, I see ZERO corroborating evidence—even something as simple as a suitably redacted screenshot of an email to Google support. Trust, but verify & extraordinary claims require extraordinary evidence.
- MattRix 5y agoReally? Your first reaction is that she must be making it up? This is hardly a far fetched scenario. I’m guessing she didn’t bother posting screenshots because most people wouldn’t automatically assume she is lying.
- vexxed-concave 5y agoYes. Given the timing of things (why even make this public?), the low likelihood of the event, and crucially the lack of any evidence, I see the preponderance of the probabilities weighing against her claims.
- MattRix 5y agoWhy not make it public? That’s often what leads to action being taken. I don’t see any reason to believe there’s a low likelyhood of the event occuring. And she’s not making a legal case, it’s just a tweet. The lack of evidence in her tweets does not mean there’s an actual lack of evidence.
- vexxed-concave 5y agoPlease review the stated history of events—-it IS extremely unlikely. She is making a case in the court of public opinion. Granted she has more clout than the “average joe” (and the very fact that this is even being discussed is evidence for it) but ANY case without corroborating evidence is just hearsay. She should “put up or shut-up” and the levels of “put” required are so minimal that her PR credibility before the “court” on this matter has a very short half-life.
- oyebenny 5y agoI lost my Google account because of this and no one at Google wants to take accountability for it. Even as a Google One client. I'm afraid of what's going to happen to it because it has my social security attached to it's payment profile (business Profile too)
- derekpankaew 5y agoYou lost your Google account by sending your phone in for repairs?
- Paianni 5y agoDoesn't Google allow devices to be de-authorised from an account via a web client? https://myaccount.google.com/device-activity https://myaccount.google.com/device-activity