4 ms·

This paper seems like it could really benefit from the peer review. The sample size seems to be very small and seems to ignore that people are more likely to re

This paper seems like it could really benefit from the peer review. The sample size seems to be very small and seems to ignore that people are more likely to respond to such a survey if they had a bad experience. (Arxiv is a preprint server, the materials uploaded here have not been peer reviewed.)

rt4mn 4y ago
I skipped the survey section. Did it add anything interesting to the paper? The findings showing that five of the six repair shops they went to violated their users trust and snooped on devices was bad enough for me.
xenadu02 4y ago
I was shocked by section 5. It's not just a survey, they imaged laptops with fake personal data that matched the persona (male or female). For the female persona look at how many times the local shops went digging for private data. Sure the sample size is small but it is still a random sample so the data is worrying. Even more worrying is the shops that claimed the systems had viruses and they installed antivirus software - conveniently the paper authors weren't able to find any activity log data on those machines. That suggests that some repair techs are actively cleaning up their tracks.
- csnover 4y ago
  > Even more worrying is the shops that claimed the systems had viruses and they installed antivirus software - conveniently the paper authors weren't able to find any activity log data on those machines. That suggests that some repair techs are actively cleaning up their tracks. This is the conclusion that the researchers imply, but keep in mind that these computers did have malware on them: the spyware the researchers planted there! As a former repair tech, if I’d seen some thing writing screenshots and activity logs to disk (we would use, among other things, sysinternals tools like procmon to look for malware) I would definitely be deleting that. Regardless, the fact of the matter is that a negative finding in this study is meaningless, since the laptops could have had the disks removed and imaged separately, or the techs could have booted a live USB to copy off files. The researchers’ spyware would have not noticed in these cases. It is concerning to me (in terms of the quality of the overall research) that this is not mentioned in the limitations section of the paper given how obvious it is.
  - witrak 4y ago
    >[...] keep in mind that these computers did have malware on them: the spyware the researchers planted there! As a former repair tech, if I’d seen some thing writing screenshots and activity logs to disk (we would use, among other things, sysinternals tools like procmon to look for malware) I would definitely be deleting that. I don't think that you as repair tech are entitled to manipulate any software installed by the owner. Even if your order covers malware removal and you see such activity and you suspect that it isn't installed by the customer you should contact them first, simply because such software isn't malware by definition (only in case it is installed against owner's/user's will).
- janosdebugs 4y ago
  It may very well be that these things happened, but making sweeping statements about an entire industry based on such a low sample size is problematic to say the least. In light of the lacking sample size, one might possibly argue that it's just as likely to happen with vendor repair, as illustrated in this case: https://www.telegraph.co.uk/business/2021/06/06/apple-pays-millions-woman-explicit-photos-posted-online/ https://www.telegraph.co.uk/business/2021/06/06/apple-pays-m...
deleted 4y ago
[deleted]

rt4mn 4y ago

I skipped the survey section. Did it add anything interesting to the paper? The findings showing that five of the six repair shops they went to violated their users trust and snooped on devices was bad enough for me.

xenadu02 4y ago

I was shocked by section 5. It's not just a survey, they imaged laptops with fake personal data that matched the persona (male or female). For the female persona look at how many times the local shops went digging for private data. Sure the sample size is small but it is still a random sample so the data is worrying. Even more worrying is the shops that claimed the systems had viruses and they installed antivirus software - conveniently the paper authors weren't able to find any activity log data on those machines. That suggests that some repair techs are actively cleaning up their tracks.

csnover 4y ago
> Even more worrying is the shops that claimed the systems had viruses and they installed antivirus software - conveniently the paper authors weren't able to find any activity log data on those machines. That suggests that some repair techs are actively cleaning up their tracks. This is the conclusion that the researchers imply, but keep in mind that these computers did have malware on them: the spyware the researchers planted there! As a former repair tech, if I’d seen some thing writing screenshots and activity logs to disk (we would use, among other things, sysinternals tools like procmon to look for malware) I would definitely be deleting that. Regardless, the fact of the matter is that a negative finding in this study is meaningless, since the laptops could have had the disks removed and imaged separately, or the techs could have booted a live USB to copy off files. The researchers’ spyware would have not noticed in these cases. It is concerning to me (in terms of the quality of the overall research) that this is not mentioned in the limitations section of the paper given how obvious it is.
- witrak 4y ago
  >[...] keep in mind that these computers did have malware on them: the spyware the researchers planted there! As a former repair tech, if I’d seen some thing writing screenshots and activity logs to disk (we would use, among other things, sysinternals tools like procmon to look for malware) I would definitely be deleting that. I don't think that you as repair tech are entitled to manipulate any software installed by the owner. Even if your order covers malware removal and you see such activity and you suspect that it isn't installed by the customer you should contact them first, simply because such software isn't malware by definition (only in case it is installed against owner's/user's will).
janosdebugs 4y ago
It may very well be that these things happened, but making sweeping statements about an entire industry based on such a low sample size is problematic to say the least. In light of the lacking sample size, one might possibly argue that it's just as likely to happen with vendor repair, as illustrated in this case: https://www.telegraph.co.uk/business/2021/06/06/apple-pays-millions-woman-explicit-photos-posted-online/ https://www.telegraph.co.uk/business/2021/06/06/apple-pays-m...

deleted 4y ago

[deleted]