11 ms·
No Privacy in the Electronics Repair Industry
- deleted 4y ago[deleted]
- solomatov 4y agoThat's horrible. The most surprising results are in section 5, especially claims that technicians copied files from the repaired devices.
- ketralnis 4y agoDuring the so-called "Fappening" one of the rumours about the source of the photos was a group of Geek Squad type tech support employees that were trading the photos that they pulled off of devices in their care. According to that theory the ages of the photos were mixed because that group had mostly kept them to themelves until the large leak of the whole corpus.
- Buge 4y agoIn reality it was from phishing attacks. https://en.wikipedia.org/wiki/2014_celebrity_nude_photo_leak#Investigation https://en.wikipedia.org/wiki/2014_celebrity_nude_photo_leak...
- clnq 4y agoI used to think that people wouldn't do these things, but some do them regularly and unapologetically. I once caught a car technician from a reputable dealership's service taking my car out for personal chores, as the guy did not even unplug my dashcam. I had a rude awakening when I realized these things aren't just urban myths but that they do happen. Some people have no qualms about taking advantage of our unattended things. Of course, this is an anecdote with a sample size of 1, and I can't speak about how often these things happen. But I'm honestly not that surprised to read section 5 in this paper. Not even surprised to see that there was no attempt to cover tracks on most laptops.
- ClumsyPilot 4y agotaking a car for a rode makes sence conceptually. Came across the same behaviour myswlf recently. But what does a technician get out of copying my porn collection?
- Gigachad 4y agoThere are documented cases of repair people copying off the users nudes.
- skorpeon87 4y agoA mechanic taking a car for a ride is at least plausibly productive; the mechanic tests the car out to make sure it's running well, no weird noises/etc. Of course if you just brought the car in for an oil change and not asking them to investigate a weird intermittent noise, I can see why you'd be upset.
- clnq 4y agoYes, it could be justifiable for some reasons.
- solomatov 4y agoYep, I thought the same way. I.e. most of people won't ever do it.
- userbinator 4y agoI can't help but feel a little suspicious of the motives behind this. Beware the anti-right-to-repair activists.
- deleted 4y ago[deleted]
- madars 4y agoIt'll be a nice study to cite when trying to convince friends that (a) they must use full disk encryption/have a good backup strategy; (b) it is a good idea to do a factory reset before sending in a device for repair (if applicable); and (c) it can make sense to discard device rather give up its PIN/etc.
- heavyset_go 4y agoAn addendum to (b) is that a factory reset sometimes isn't enough, considering it's still possible to image a drive after file deletion or formatting to recover "deleted" data.
- madars 4y agoOh, absolutely! We should always combine (a) and (b) so that factory reset is implemented as wiping of the keyslots.
- ketralnis 4y agoFunny, I feel the opposite way about it. If I can't repair my own stuff and I have to send my phone to Google, who knows what Google's doing with it
- heavyset_go 4y agoThese arguments rely on the person making them to act incredulous if you suggest that a company like Apple would do anything unsavory. There's an entire school of rhetoric dedicated to conflating "companies securing their trillion dollar bottom lines" with "end-user security", when the two are almost always orthogonal.
- dontbenebby 4y agoI remember remarking I felt unethical investing in anything but index funds after doing a volunteer help desk freshman and sophomore year of college. People disclose a lot by accident and you can not repeat what you see but it’s hard to forget what you’ve learned. (It’s partly why I didn’t want to be a systems admin or forensics tech and focused on censorship circumvention.)
- hn_go_brrrrr 4y agoYou did a stint on the helpdesk at your college? I can't quite tell what you learned -- did people disclose material non-public information to you and you were afraid the SEC might come after you for acting on it?
- dontbenebby 4y agoMaybe I’m phrasing poorly. More like you learn someone’s deepest hopes and dreams, the psychic “initialization vectors” that allow you to predict how they’ll act. (And then by extension how large groups of people with similar backgrounds will act.)
- jacobsenscott 4y agoIndex funds are pretty much the only thing worth investing in, so in a weird way by trying to avoid "good" investments you probably saved yourself a lot of money. Also what school was it? I can't imagine a university is a hot bed of insider trading information. Certainly mine wasn't :) Or were you working off campus somewhere?
- dontbenebby 4y ago>Index funds are pretty much the only thing worth investing in, so in a weird way by trying to avoid "good" investments you probably saved yourself a lot of money. On the other hand, I also used to joke “someone’s gotta adjust the Vanguard” back before I knew “Vanguard” was also the name of a neo-nazi group[1]. Someone has to at least pick high level things like the ratio of stocks to bonds, national to international, that sort of thing… and I’d remarked to many people in many contexts that one downside to index funds is that folks selling off shares might have a disproportionate effect on the market. Especially if the person selling explicitly mentions they’re purposely selling over 10k’s worth to trigger a report to the feds, because they feel they’re facing persistent issues with irrational actors, so it’s time to get cash into your checking account in preparation for emigration, since the state refuses to honor its promises unless you make them think the alternative is… well go look at the returns for VASIX[2]since about October 2021 and use your imagination :-) [1]https://en.wikipedia.org/wiki/Vanguard_America https://en.wikipedia.org/wiki/Vanguard_America [2]https://fundresearch.fidelity.com/mutual-funds/summary/921909206# https://fundresearch.fidelity.com/mutual-funds/summary/92190...
- mozman 4y agoAny time I turn in a macbook for repair they demand my admin password. Fuck off. Erase it, I’ll restore, but I’ll never give you access. They are trained to make you feel like you have something to hide.
- contingencies 4y ago
- boosteri 4y agoDon't understand the downvotes.. you gotta vote with your wallet. Anyone asking for a password immediately loses all credibility in my eyes. And besides, Apple churns out a lot of hype around their good privacy policies; it is good to know that not everything is gold dust when it comes to them.
- Godel_unicode 4y agoBecause the solution is pretty clearly “say no”. It’s a weird policy that they’re allowed to ask, but that’s about it.
- HKH2 4y agoIf you know that that is an option. How is that not a dark pattern?
- deleted 4y ago[deleted]
- stephen_g 4y agoIn my experience, They’ve always asked, but I’ve always refused and they say OK actually we can boot a test image another way (like their diagnostics thing that they boot from the network to run tests while you’re there).
- danielodievich 4y agoWhen I had to replace my old Thinkpad's screen, I really liked that the repair shop explicitly said that they didn't need the credentials to my bitlockered drive and in fact offered to take the drive out physically and give it to me. They could boot off USB into a portable Linux install and do whatever and in fact they did.
- someweirdperson 4y agoLenovo offers a "keep your drive" warranty option. I thought this upgrade option was needed to keep the drive when something (drive or other) fails, but maybe it is only relevant in case a drive fails and is replaced under warranty?
- skorpeon87 4y agoThat's an upgrade option now? It used to be standard, I think even suggested that you remove your drive before sending in your thinkpad. Granted, the last time I had to do that was 2009 or so.
- bombcar 4y agoIt sometimes is included in the warranty depending on how you buy it I know when we were RMAing drives as a company there was an $8 option to not return the drive. As it was free shipping to return it we’d just send it back - no sensitive data. If you really need to be secure you encrypt AND shred. But you have to encrypt before it fails of course.
- LinuxBender 4y ago"keep your drive" option is for people that need to physically shred their drives when they fail. Many financial organizations utilize this policy and document it in their SOC1/SOC2 controls and sometimes in their customer contracts. I was in a cloud provider that did this with over 50k servers.
- spoonjim 4y ago
- autoexec 4y agoThere have always been stories about geek squad and other places saving customer's files for their personal use, reporting customers to the police for content found on their drives, or handing customer's data over to the state. I doubt the government or the repair shops have any interest in putting a stop to it. Any time I've had to take my PCs in for something I pull out the hard drives before driving them over. As long as the machine can POST, I can take care of the rest. It gets a lot trickier with other devices though. I can't imagine trying to pull the storage out of laptops, tablets, cell phones, or game consoles.
- sidewndr46 4y agoFor all those old devices, just shred them. Problem solved.
- 14 4y agoAnybody interested in watching electronics repair videos I highly recommend the YouTuber northridgefix https://m.youtube.com/@NorthridgeFix https://m.youtube.com/@NorthridgeFix I can not recommend his videos enough. So fun to watch and see we don’t need to throw every device that breaks into the garbage. If I was to need something repaired he is the guy I would send my stuff to.
- _w0cm 4y agoNorthridgeFix is known by other repair professionals as a hack who makes his money selling rebranded Chinese tools. You can read recent poor experiences people have had with his business here: https://old.reddit.com/r/all/search/?q=northridgefix&sort=new https://old.reddit.com/r/all/search/?q=northridgefix&sort=ne...
- daniel_reetz 4y agoYou know, I've actually taken devices to his shop personally. These were one-of-a-kind devices with pretty serious soldering challenges, and he fixed them same day. So he's at _least_ as competent as he presents on video, not a "hack". Rebrands Chinese tools? That's most of the electronics repair industry. It's a side business for him.
- _w0cm 4y agoI have over a decade of experience manufacturing medical, aerospace, and military electronics and I will say authoritatively that he is a hack. His main income stream is from selling Chinese tools (which are garbage), followed by YouTube ads, followed by repairing devices. Just because he fixed something you believe to be difficult the same day does not make him competent.
- 14 4y agoThat is kind of disappointing to see. I’ve been watching him for maybe a couple of months now and really enjoyed watching him repair things. I wonder if there are any similar creators with electronic repair content.
- janosdebugs 4y agoThis paper seems like it could really benefit from the peer review. The sample size seems to be very small and seems to ignore that people are more likely to respond to such a survey if they had a bad experience. (Arxiv is a preprint server, the materials uploaded here have not been peer reviewed.)
- rt4mn 4y agoI skipped the survey section. Did it add anything interesting to the paper? The findings showing that five of the six repair shops they went to violated their users trust and snooped on devices was bad enough for me.
- xenadu02 4y agoI was shocked by section 5. It's not just a survey, they imaged laptops with fake personal data that matched the persona (male or female). For the female persona look at how many times the local shops went digging for private data. Sure the sample size is small but it is still a random sample so the data is worrying. Even more worrying is the shops that claimed the systems had viruses and they installed antivirus software - conveniently the paper authors weren't able to find any activity log data on those machines. That suggests that some repair techs are actively cleaning up their tracks.
- csnover 4y ago> Even more worrying is the shops that claimed the systems had viruses and they installed antivirus software - conveniently the paper authors weren't able to find any activity log data on those machines. That suggests that some repair techs are actively cleaning up their tracks. This is the conclusion that the researchers imply, but keep in mind that these computers did have malware on them: the spyware the researchers planted there! As a former repair tech, if I’d seen some thing writing screenshots and activity logs to disk (we would use, among other things, sysinternals tools like procmon to look for malware) I would definitely be deleting that. Regardless, the fact of the matter is that a negative finding in this study is meaningless, since the laptops could have had the disks removed and imaged separately, or the techs could have booted a live USB to copy off files. The researchers’ spyware would have not noticed in these cases. It is concerning to me (in terms of the quality of the overall research) that this is not mentioned in the limitations section of the paper given how obvious it is.
- _jal 4y agoA Bunch of young, mostly male, underpaid, low-authority folks abuse their customers? Shocker. I mean, sure, we should expect better, but being surprised by this is naive. To the extent that you could once trust your sysadmin, those days are over, that culture is long gone. And even when that was a thing, there were still a bunch of creeps with root around. This is why I fix my own machines, and replace phones when they break.
- haswell 4y ago> being surprised by this is naive I don't think surprise is the primary reaction here. If anything, this study is just confirming what has always seemed likely, but difficult to prove.
- pelasaco 4y ago> A Bunch of young, mostly male, underpaid, low-authority folks abuse their customers Are you assuming their gender or saying if we had more females doing the work, there wouldn't have customer abuse?
- BrianHenryIE 4y agoNathan Fielder (who graduated from one of Canada's top business schools with really good grades) tried to address this in an episode of Nathan For You (s04e07). The plan? Put customers at ease by offering the world's first asexual computer repair. https://www.youtube.com/watch?v=jf9I04Oa-hU https://www.youtube.com/watch?v=jf9I04Oa-hU
- barbariangrunge 4y ago> we drop rigged devices for repair at 16 service providers and collect data on widespread privacy violations by technicians, including snooping on personal data, copying data off the device, and removing tracks of snooping activities Wow... that makes me so uncomfortable More details in 5.2.1 in the pdf: https://arxiv.org/pdf/2211.05824.pdf https://arxiv.org/pdf/2211.05824.pdf
- ShredKazoo 4y agoBut who will snoop on the snooping snoopers? That's my question.
- Stratoscope 4y agoJust in case you're referring to this proof that the Halting Problem is undecidable, it always bears repeating: http://www.lel.ed.ac.uk/~gpullum/loopsnoop.html http://www.lel.ed.ac.uk/~gpullum/loopsnoop.html
- ArnoVW 4y agoThe phrase 'who watches..' predates that paper by quite a bit. https://en.m.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%3F https://en.m.wikipedia.org/wiki/Quis_custodiet_ipsos_custode...
- Kon-Peki 4y agoEveryone out west in Hawtch-Hawtch. Just as soon as they are done with their bee watching.
- throwawaysleep 4y agoI am curious. Could one sue over this?
- alsetmusic 4y ago> I am curious. Could one sue over this? I believe you'd have to be able to show that you'd been harmed. This came up at the top of a search for "sue law standing": > To file a lawsuit in court, you have to be someone directly affected by the legal dispute you are suing about. In legal terms, this is called having “standing” to file the lawsuit. I think that'd be difficult to prove / show unless you had some pretty direct evidence. I don't think you'd have that unless you setup logging / monitoring software in advance, as in the article. Regular consumers wouldn't have that.
- deleted 4y ago[deleted]
- netfortius 4y agoI wonder if there is any data referencing equivalent services in the EU.
- deleted 4y ago[deleted]
- buildsjets 4y agoI swing by the local Goodwill clearance outlet occasionally looking for vintage electronics. The other day I grabbed a Commodore 1541 floppy drive from a bin. At the checkout, the young employee balked and said “sorry, that shouldn’t have made it out there, it’s against our policy to sell call computer drives because they might have personal info on them”. I asked him to please double check with the oldest, greyest employee in the store. I walked away with it for 3 bucks.
- jimt1234 4y ago3 bucks! Nice! Congrats on the find!
- 13of40 4y agoThere was a sweet spot in the mid to late 90s where you could find awesome ancient hardware at Goodwill. Around that time I lived in a town of about 150K people, so it had several Goodwill locations, but there was one where all of the computer equipment got sent. My last good score there was a PDP-11/7-something that was in perfect working order with a hard drive for something insane like $20, and the hard drive came complete with about 100 people's personal details *and* mental health records on it. And that's why they have that (very good) policy.
- Gordonjcp 4y agoI know someone who scored a couple of very large VAXen from the prison service, and discovered they contained a lot - really a lot - of records of prisoner details that should absolutely not have made it out of the door. Cue a couple of police and prison service cars rolling up outside his house and disgorging a lot of very beardy old sysadmins, who copied everything off onto modern media and wiped the drivers. They then offered the guy a contract to maintain the VAXen they still had, and help in the project to transfer stuff onto more modern databases. Things became interesting when the guy got jailed for a few months for a minor incident that escalated a bit, but still needed to be given access to the prison service computers...
- 4y ago
- fnordpiglet 4y agoYet another way apple protects our privacy - making their products impossible to repair!
- GuB-42 4y agoAnd they are not shy of using that argument! It is a go to answer when a company is asked why their product is not user serviceable, along with safety and security.
- User23 4y agoOne time I didn’t have the time to fix my PC myself so I took it to Fry’s. The tech was bemused when my answer to if I had backed it up was that I had pulled the drives. They did fix it though.
- jacobsenscott 4y agoIf you work at some retail electronics hellscape long enough I'm sure even Mother Teresa would eventually give in to the temptation to supplement her income by selling customer data, or at least alleviate boredom by browsing pics. I guess I trust apple's file vault enough that I'll allow them to repair a laptop without a password. I've had two apple laptops fixed and to their credit they didn't even ask for the password. I would never give a repair place a password though. It is better to just buy a new device.
- gjsman-1000 4y agoSad as it is - there is a lot of corruption in the repair industry, with this only being one facet of the issue. It’s why companies like Apple look on R2R activists like Louis Rossmann with pity internally but won’t budge.
- UweSchmidt 4y agoHow does R2R relate to privacy violations during repair? Apple repair techs can snoop on user data more (i.e. pressure users to hand over admin pw, as reported in this thread) as long as we can't easily swap a MacBook hard disc ourselves.
- alpaca128 4y agoOne of their favorite methods to fight and denounce independent repair shops is to suggest that those repair shops could snoop through user data, or more generally that independent repair means no control and oversight. Basic FUD. The US car lobby went even farther by producing an ad that implied independent car repair makes you an easier target for stalkers and sexual predators[0]. Of course all those efforts are kind of hampered when authorized repair shops mess up. Like that time when an Apple repair tech uploaded a customer's selfies and sex tape on Facebook[1]. [0]: https://www.vice.com/en/article/qj4ayw/auto-industry-tv-ads-claim-right-to-repair-benefits-sexual-predators https://www.vice.com/en/article/qj4ayw/auto-industry-tv-ads-... [1]: https://nypost.com/2021/06/07/apple-settled-after-repair-techs-posted-womans-explicit-pics/ https://nypost.com/2021/06/07/apple-settled-after-repair-tec...
- jimt1234 4y agoI worked at a computer rental shop in the mid-90s (renting computers was a thing back then). Customers used to leave files on the returned computers all the time. My colleagues and I used to look at them sometimes. It was almost always boring stuff. Until once a customer returned a computer with CSAM jpeg images. Hundreds of them. Very bad stuff. We called the local police. They were basically useless. They just didn't know what we were talking about. Remember, this was almost 30 years ago, before the web. We asked if they had any contacts at the FBI, and if so, to forward the info to them. The next day a couple of FBI suits showed up and took the computer. They knew exactly what we were talking about. The suits were very technical. I was totally impressed. The FBI suits came back about a week later and took statements from everyone. We tried to get info from them about the case, but they wouldn't give us anything. However, one suit said the computer wouldn't help much for a conviction or even making an arrest because too many hands had touched it. Depressing. However, he did say that the customer is on their radar, and an active investigation had begun. He hinted that it was only a matter of time before the dude was caught in the investigation. I felt a tiny bit better after that. But still, the only experience made me feel like shit. It still does.
- veqq 4y agoA bit tangential, but what can you share about the computer rental industry? When did it die out? What sort of customers were there? How long until computers would leave the rental circuit? Would they just be sold?
- buran77 4y agoRenting fits occasional usage better, housing being a notable exception. But people need a computer (PC, laptop, tablet, or phone) all the time these days and almost always have a lot tied into a particular device. It's far more convenient to buy one outright especially since they're affordable. Now the rental moved towards more expensive and less convenient stuff to have at home full time like servers and hosting.
- sneak 4y agoThe same reason that they could not use this for evidence (too many hands, too much opportunity for tampering) seems like the reason this is exploitable for using the FBI as a weapon for targeted harassment against an arbitrarily chosen victim. Getting someone put on the FBI's radar is a great way to ruin a life. If you can target anyone you wish this way, that is a lot of destructive power to wield, akin to swatting.
- Lucent 4y agoSamsung added a maintenance mode enforced by their Knox hypervisor you can enable before handing a device off for service. https://news.samsung.com/global/samsung-releases-maintenance-mode-a-new-feature-to-hide-your-personal-information-from-prying-eyes https://news.samsung.com/global/samsung-releases-maintenance...
- jaclaz 4y agoYes, but like most of these "provisions" it assumes that the device is working to be able to set/enter that "maintenance mode", so it is really a "maintenance mode" as opposed to a "repair mode". If you have a broken (black) screen or touch not working or if the device doesn't boot properly it is useless.
- asdff 4y agoIt seems like its not a bad move to replace your hard drive with an empty one before you turn it over for repair. Too bad these new "privacy focused" macs don't let you do that anymore. Maybe you can use an external ssd as your main boot disk and storage volume and not keep anything on the internal ssd.
- eloisant 4y agoI recently sent my Steam Deck for RMA, and interestingly in the packing instruction to send it, Valve tells to do a factory reset. Which I did. First I thought it was to simplify their tests when they get it, but now I'm thinking it could be to make sure technicians don't have access to my personal data.
- qwerty456127 4y agoIdeally every device should store all the user-related data on an easily removable storage module (i.e. SSD/SD) separate from the OS files.
- pelasaco 4y ago"Researchers are proposing a logging program that cannot be disabled by the repair technician. It would be clear if the logs were deleted by the technicians." Nice, now we just need EU getting together and creating a new law forcing that all hardware should have such capability /s