3 ms·

This is all assumptions. Just because izatcloud.net is owned by Qualcomm = they must be exfiltrating personal data? c'mon! Then you go and peddle your own Nitro

This is all assumptions. Just because izatcloud.net is owned by Qualcomm = they must be exfiltrating personal data? c'mon! Then you go and peddle your own NitroPhone as a "Qualcomm free" alternative? You're just gaslighting your customers to buy. This is a very short-sighted article based on lax assumptions and NO WIRESHARK to back it up. Just because a firmware makes a call home doesn't mean it's sending your personal data. Does it have access to all the hardware? It should, it's a MF'ing driver for a CPU. Name me another CPU that doesn't have access to the hardware via it's user-space blob? The consequences outlined in the article are true for EVERY mobile device, laptop, tablet, consumer electronics w/ wifi. Wireshark logs or you're just doomsday speculating. Show me the call to izatcloud.net with more than just http header identities every AdTech/MarTech company is already capturing from your web traffic and deanonymizing you.

oefnak 4y ago
I block the ads, how could I block this? Also, just because evil ad companies exist, why should we accept this?
- gabereiser 4y ago
  You can't. Every call you make to a server includes your browser's user-agent/client-hints as well as your IP. Those cookie consent screens are provided by 3rd party but integrated via 1st party. So the company's website you visit doesn't even have to know it's going on, all they have to do is setup the MarTech correctly with the vendor and create a DNS entry. This, while being used to track you, could be used for good - it's not. Some companies are trying to own some of this to prevent nefarious uses of the data but in the end it's been the wild west of data tracking for the last 10 years or so.
  - gabereiser 4y ago
    Challenge: Open up your favorite website (not HN :D) and watch the XHR's and network calls in your browser's devtools. How many of those are for the same origin? How many of those are ad calls being blocked by your extension (which also has access to your data)? How many of them are calls for a single pixel gif? Some javascript? favicon.ico? Do some spelunking on WHOIS for each of those domains. All it takes is one of them to proxy the headers. Proxy the headers and check if ad was served by looking at logs of both ad request and page request, if no ad request was found, require them to disable adblocker...
- ignoramous 4y ago
  Your Android would need to be connected to an external firewall at all times through which you can monitor and control traffic. pfsense / firewalla are some of the popular firewall devices. Don't forget to remove the SIM card (airplane mode isn't enough). May need a wifi / cellular jammer too, to be absolutely sure the device will always connect via home router / firewall. You could use an on-device firewall app, too; but OEMs / ODMs can always bypass it as they pretty much control not only the software but the hardware, as well.
smallpipe 4y ago
Did you read the article? Qualcomm legal team replied saying "yes we exfiltrate data, see this privacy policy". What else do you need ?
- Animats 4y ago
  So it's in Qualcomm's privacy policy. So what? Where did the consumer agree to that? If the phone never went through Google activation, no transaction ever happened which bound the consumer. Class action lawsuit time.
- deleted 4y ago
  [deleted]
- nomel 4y ago
  > What else do you need ? Evidence/details of the very specific claims that go beyond that.
  - fsflover 4y ago
    Even if there is no evidence today, they can start doing it at any moment. Are you fine with that? Are you checking your connections every day?
    - rcxdude 4y ago
      There isn't actually evidence of that. These connections are actually being done by the OS, which you can control if you are using an open-source ROM. Just because on OS doesn't currently change the defaults from the manufacturer doesn't mean others are the same (in fact, grapheneOS goes to some lengths to strip as much of the identifying information vanilla android sends as they can, proxies this through their own server, and gives you an option of disabling it altogether). The default behaviour of AGPS on android is concerning and a big privacy violation, but this article felt the need to add some extra BS to scare you into buying their hardware specifically.
- mk89 4y ago
  the payload!!! even a fake one… :) jokes aside, I also don’t understand the criticism. The author even took the effort to write Qualcomm, and they admitted to this!
moritonal 4y ago
This is a bad faith take. If Google's T&Cs said they could record you anytime they like, but they given you a PCAP showing they don't, you would be outraged at their claimed legal right to do so? This is the same. Quadcomm have the capability, and the claimed legal right. It essentially doesn't matter whether they do, or do not, actually execute on it today.
- JohnFen 4y ago
  > If Google's T&Cs said they could record you anytime they like, but they given you a PCAP showing they don't, you would be outraged at their claimed legal right to do so? I would, yes. There's some reason that they claimed the legal right to do so. That they aren't actually doing it at the moment I check means nothing, because they could start doing it at any time in the future.
Lammy 4y ago
> This is a very short-sighted article based on lax assumptions and NO WIRESHARK to back it up. Just because a firmware makes a call home doesn't mean it's sending your personal data. Sorry, but you're the one who is missing the point. The very act of making a network request gives away your geolocation + time of use https://kieranhealy.org/blog/archives/2013/06/09/using-metadata-to-find-paul-revere/ https://kieranhealy.org/blog/archives/2013/06/09/using-metad...
- gabereiser 4y ago
  Which every iPhone and Android phone do all the time. You agreed to it when you agreed to the terms of use and all that legal crap they hide behind. I'm not saying I'm ok with it. I'm saying I know it's been going on since 2009 and no one with the ability to change it, cares.
  - deleted 4y ago
    [deleted]
lovelearning 4y ago
I fail to see why, in the absence of rigorous technical evidence, my benefit of the doubt should be with QualComm by default.
- sizzle 4y ago
  This is the privacy lens I view these issue through as well
hasanas 4y ago
Now imagine it was anything but an American (or allying) company. Oooo, much scarier.
- gabereiser 4y ago
  This is the heart of the political struggle. Most commenters mention the privacy part, which is valid, but the real meat is the war of nations over data. RESTRICT act or whatever it’s called to ban TikTok because all the congressional members’ grandkids are hooked on it and could care less about their grandparents. Data tracking is already taking place. Your personal data is out there already. When you search for butt cream and then go browse Facebook, they know what you searched for. It’s not that they are reading your browser history, instead they are reading your web logs from some 3rd party tracker server.

oefnak 4y ago

I block the ads, how could I block this? Also, just because evil ad companies exist, why should we accept this?

gabereiser 4y ago
You can't. Every call you make to a server includes your browser's user-agent/client-hints as well as your IP. Those cookie consent screens are provided by 3rd party but integrated via 1st party. So the company's website you visit doesn't even have to know it's going on, all they have to do is setup the MarTech correctly with the vendor and create a DNS entry. This, while being used to track you, could be used for good - it's not. Some companies are trying to own some of this to prevent nefarious uses of the data but in the end it's been the wild west of data tracking for the last 10 years or so.
- gabereiser 4y ago
  Challenge: Open up your favorite website (not HN :D) and watch the XHR's and network calls in your browser's devtools. How many of those are for the same origin? How many of those are ad calls being blocked by your extension (which also has access to your data)? How many of them are calls for a single pixel gif? Some javascript? favicon.ico? Do some spelunking on WHOIS for each of those domains. All it takes is one of them to proxy the headers. Proxy the headers and check if ad was served by looking at logs of both ad request and page request, if no ad request was found, require them to disable adblocker...
ignoramous 4y ago
Your Android would need to be connected to an external firewall at all times through which you can monitor and control traffic. pfsense / firewalla are some of the popular firewall devices. Don't forget to remove the SIM card (airplane mode isn't enough). May need a wifi / cellular jammer too, to be absolutely sure the device will always connect via home router / firewall. You could use an on-device firewall app, too; but OEMs / ODMs can always bypass it as they pretty much control not only the software but the hardware, as well.

smallpipe 4y ago

Did you read the article? Qualcomm legal team replied saying "yes we exfiltrate data, see this privacy policy". What else do you need ?

Animats 4y ago
So it's in Qualcomm's privacy policy. So what? Where did the consumer agree to that? If the phone never went through Google activation, no transaction ever happened which bound the consumer. Class action lawsuit time.
deleted 4y ago
[deleted]
nomel 4y ago
> What else do you need ? Evidence/details of the very specific claims that go beyond that.
- fsflover 4y ago
  Even if there is no evidence today, they can start doing it at any moment. Are you fine with that? Are you checking your connections every day?
  - rcxdude 4y ago
    There isn't actually evidence of that. These connections are actually being done by the OS, which you can control if you are using an open-source ROM. Just because on OS doesn't currently change the defaults from the manufacturer doesn't mean others are the same (in fact, grapheneOS goes to some lengths to strip as much of the identifying information vanilla android sends as they can, proxies this through their own server, and gives you an option of disabling it altogether). The default behaviour of AGPS on android is concerning and a big privacy violation, but this article felt the need to add some extra BS to scare you into buying their hardware specifically.
mk89 4y ago
the payload!!! even a fake one… :) jokes aside, I also don’t understand the criticism. The author even took the effort to write Qualcomm, and they admitted to this!

moritonal 4y ago

This is a bad faith take. If Google's T&Cs said they could record you anytime they like, but they given you a PCAP showing they don't, you would be outraged at their claimed legal right to do so? This is the same. Quadcomm have the capability, and the claimed legal right. It essentially doesn't matter whether they do, or do not, actually execute on it today.

JohnFen 4y ago
> If Google's T&Cs said they could record you anytime they like, but they given you a PCAP showing they don't, you would be outraged at their claimed legal right to do so? I would, yes. There's some reason that they claimed the legal right to do so. That they aren't actually doing it at the moment I check means nothing, because they could start doing it at any time in the future.

Lammy 4y ago

> This is a very short-sighted article based on lax assumptions and NO WIRESHARK to back it up. Just because a firmware makes a call home doesn't mean it's sending your personal data. Sorry, but you're the one who is missing the point. The very act of making a network request gives away your geolocation + time of use https://kieranhealy.org/blog/archives/2013/06/09/using-metadata-to-find-paul-revere/ https://kieranhealy.org/blog/archives/2013/06/09/using-metad...

gabereiser 4y ago
Which every iPhone and Android phone do all the time. You agreed to it when you agreed to the terms of use and all that legal crap they hide behind. I'm not saying I'm ok with it. I'm saying I know it's been going on since 2009 and no one with the ability to change it, cares.
- deleted 4y ago
  [deleted]

lovelearning 4y ago

I fail to see why, in the absence of rigorous technical evidence, my benefit of the doubt should be with QualComm by default.

sizzle 4y ago
This is the privacy lens I view these issue through as well

hasanas 4y ago

Now imagine it was anything but an American (or allying) company. Oooo, much scarier.

gabereiser 4y ago
This is the heart of the political struggle. Most commenters mention the privacy part, which is valid, but the real meat is the war of nations over data. RESTRICT act or whatever it’s called to ban TikTok because all the congressional members’ grandkids are hooked on it and could care less about their grandparents. Data tracking is already taking place. Your personal data is out there already. When you search for butt cream and then go browse Facebook, they know what you searched for. It’s not that they are reading your browser history, instead they are reading your web logs from some 3rd party tracker server.