4 ms·

What do we do about it? The obvious answer is just stop buying this junk, but how would anyone know? I'm curious, have you (or anyone else) seen novel solutio

What do we do about it? The obvious answer is just stop buying this junk, but how would anyone know? I'm curious, have you (or anyone else) seen novel solutions to this problem? Is this even solvable? Ideas everyone!

hedora 3y ago
Establish financial liability for products that engage in opt-out data collection. The liability should be shared by the manufacturers and by any resellers (especially including Amazon in the US). Make sure the financial liability is at least the maximum of 100x the value of the data and 10x the revenue the suite of bundled products generate.
- genocidicbunny 3y ago
  Also, criminal liability for everyone involved. Put every single employee and exec of these companies in jail for 10-20 years, with the first one to tattle on the employer getting a pardon.
  - Syonyk 3y ago
    And suddenly, a new style of ad: "Work from home! Be your own CEO! For a mere $5000, we set up your company, brand our products, and you get all the credit! No technical skills needed, just a bank account to receive your monthly income!"
    - genocidicbunny 3y ago
      We can go ahead and extend the criminal liability up and down the ownership chain too.
- blibble 3y ago
  this is more or less the main idea of the GDPR it attempted to turn people's personal data from a balance sheet asset into a liability with varying success
hsbauauvhabzb 3y ago
Regulation is the only way to solve this issue, and regulation requires the people in power to care, where currently almost none in non European countries do.
Syonyk 3y ago
> The obvious answer is just stop buying this junk, but how would anyone know? You don't have to know. You can safely guess. Assume anything "connected" is shouting as much as it possibly can, upstream, at all points in time. It's a cell phone app? You have location services turned on? It's streaming your position. Also, whatever else it can grab. Basically, if you've granted a permission to an app, assume it's streaming that attribute upstream, and keep things limited. And, at all costs, prefer offline only devices. It took me a while to find some air quality sensors for my home that weren't online and App-based - but they're literally standalone displays that sniff the air and report out PM2.5/PM10/CO2/etc. I can't access them with an app, I have to walk past and look. So be it. For voltage of batteries, ffs, just use a voltmeter, or, if you care about always seeing it, install a little bulkhead voltmeter. I do this on all sorts of projects (most recently a "power toolbox" I use for stuff - battery, inverter, solar charger, USB ports, and a little voltmeter that shows pack voltage when it's powered on). And then leave your little pocket snoops behind on a regular basis. I've gone back to carrying a regular watch on my wrist, or, when I'm feeling spicy, a pocket watch. And no cell phone, or a turned off cell phone in my backpack or something. > Is this even solvable? No. Because (a) most people don't care, in terms of actions they're willing to take. This app in question has had hundreds of thousands of downloads, so clearly the devices are popular enough. Saying "I care about my privacy!" is one thing, but actually living without 30,000 apps installed on your phone (shoulder surf when people are scrolling their screens in public places - I've watched people on an airplane with a iPad Pro Max or whatever have literally 20-30 screens full of icons) is pretty uncommon. and slightly inconvenient. And, (b), politicians are largely in the pay of tech companies, or at least believe the lies about how they're bringing people together and will self regulate and... whatever. The solutions are simply to opt out, or start using more aggressively hostile-to-profile things. Waves from Qubes-OS in a disposable VM I don't have any other good ideas. The tech ecosystem has rotted, and I don't see any redemption for it. I work in tech, and I've been engineering my life to require less and less computer use, and I genuinely look forward to putting down a computer for the last time.
RajT88 3y ago
Clone their products so cheaply that you can undercut them on price and still make money. Of course that requires said person to also resist the temptation of data harvesting. Which few seem to be able to.
- lolinder 3y ago
  You can't clone them cheaply without the subsidy the data provides. These products are usually cheaper than they should be because the manufacturer knows they can get value out of the data sale.
  - briHass 3y ago
    Not this one, though. It's actually surprisingly expensive for what it is. One could build this with an ESP32 and a couple of jellybean parts to regulate the voltage to what the chip needs and create a voltage divider. Even with a case, it's less than $15 BOM. You'd have to write the phone app, but that would be as complex as you wanted.
javajosh 3y ago
This looks like fraud by Amap and negligence by Google (and Apple). The 100k users have cause for a class action. However the upfront cost of such a thing is prohibitive. There is also the possibility that this is a national security issue. Exfiltrating location data to China for 100k Americans, probably including government and military employees, violates the law. But again, it's all about the cost. Also ambivalence (as others have pointed out).
- XorNot 3y ago
  The issue is that once again the permissions model as implemented on phones is complete garbage. Showing a list of permissions with "accept" as the only option is brain dead. Google easily has the money and engineering resources to provide a complete fix to this issue (multiple spoofing options, deny options etc.) but of course they don't want to - because Google's business is advertising and advertisers want your location data. And your frequently visited locations. And wifi networks. And probably brand names of whatever is on your network. We desperately, desperately need to get open-source considered as a national security agenda item. We need hardware vendors forced to publish full interface specifications. We probably need to require firmware blobs to be open source and tell Nvidia and AMD to stop breaking the law (i.e. they both suspect they'd be done for copyright/patent law if they had to publish their source code so they don't).
megablast 3y ago
Wait for Europe to do something. That’s all we can do. Us government will do nothing.
deleted 3y ago
[deleted]

hedora 3y ago

Establish financial liability for products that engage in opt-out data collection. The liability should be shared by the manufacturers and by any resellers (especially including Amazon in the US). Make sure the financial liability is at least the maximum of 100x the value of the data and 10x the revenue the suite of bundled products generate.

genocidicbunny 3y ago
Also, criminal liability for everyone involved. Put every single employee and exec of these companies in jail for 10-20 years, with the first one to tattle on the employer getting a pardon.
- Syonyk 3y ago
  And suddenly, a new style of ad: "Work from home! Be your own CEO! For a mere $5000, we set up your company, brand our products, and you get all the credit! No technical skills needed, just a bank account to receive your monthly income!"
  - genocidicbunny 3y ago
    We can go ahead and extend the criminal liability up and down the ownership chain too.
blibble 3y ago
this is more or less the main idea of the GDPR it attempted to turn people's personal data from a balance sheet asset into a liability with varying success

hsbauauvhabzb 3y ago

Regulation is the only way to solve this issue, and regulation requires the people in power to care, where currently almost none in non European countries do.

Syonyk 3y ago

> The obvious answer is just stop buying this junk, but how would anyone know? You don't have to know. You can safely guess. Assume anything "connected" is shouting as much as it possibly can, upstream, at all points in time. It's a cell phone app? You have location services turned on? It's streaming your position. Also, whatever else it can grab. Basically, if you've granted a permission to an app, assume it's streaming that attribute upstream, and keep things limited. And, at all costs, prefer offline only devices. It took me a while to find some air quality sensors for my home that weren't online and App-based - but they're literally standalone displays that sniff the air and report out PM2.5/PM10/CO2/etc. I can't access them with an app, I have to walk past and look. So be it. For voltage of batteries, ffs, just use a voltmeter, or, if you care about always seeing it, install a little bulkhead voltmeter. I do this on all sorts of projects (most recently a "power toolbox" I use for stuff - battery, inverter, solar charger, USB ports, and a little voltmeter that shows pack voltage when it's powered on). And then leave your little pocket snoops behind on a regular basis. I've gone back to carrying a regular watch on my wrist, or, when I'm feeling spicy, a pocket watch. And no cell phone, or a turned off cell phone in my backpack or something. > Is this even solvable? No. Because (a) most people don't care, in terms of actions they're willing to take. This app in question has had hundreds of thousands of downloads, so clearly the devices are popular enough. Saying "I care about my privacy!" is one thing, but actually living without 30,000 apps installed on your phone (shoulder surf when people are scrolling their screens in public places - I've watched people on an airplane with a iPad Pro Max or whatever have literally 20-30 screens full of icons) is pretty uncommon. and slightly inconvenient. And, (b), politicians are largely in the pay of tech companies, or at least believe the lies about how they're bringing people together and will self regulate and... whatever. The solutions are simply to opt out, or start using more aggressively hostile-to-profile things. Waves from Qubes-OS in a disposable VM I don't have any other good ideas. The tech ecosystem has rotted, and I don't see any redemption for it. I work in tech, and I've been engineering my life to require less and less computer use, and I genuinely look forward to putting down a computer for the last time.

RajT88 3y ago

Clone their products so cheaply that you can undercut them on price and still make money. Of course that requires said person to also resist the temptation of data harvesting. Which few seem to be able to.

lolinder 3y ago
You can't clone them cheaply without the subsidy the data provides. These products are usually cheaper than they should be because the manufacturer knows they can get value out of the data sale.
- briHass 3y ago
  Not this one, though. It's actually surprisingly expensive for what it is. One could build this with an ESP32 and a couple of jellybean parts to regulate the voltage to what the chip needs and create a voltage divider. Even with a case, it's less than $15 BOM. You'd have to write the phone app, but that would be as complex as you wanted.

javajosh 3y ago

This looks like fraud by Amap and negligence by Google (and Apple). The 100k users have cause for a class action. However the upfront cost of such a thing is prohibitive. There is also the possibility that this is a national security issue. Exfiltrating location data to China for 100k Americans, probably including government and military employees, violates the law. But again, it's all about the cost. Also ambivalence (as others have pointed out).

XorNot 3y ago
The issue is that once again the permissions model as implemented on phones is complete garbage. Showing a list of permissions with "accept" as the only option is brain dead. Google easily has the money and engineering resources to provide a complete fix to this issue (multiple spoofing options, deny options etc.) but of course they don't want to - because Google's business is advertising and advertisers want your location data. And your frequently visited locations. And wifi networks. And probably brand names of whatever is on your network. We desperately, desperately need to get open-source considered as a national security agenda item. We need hardware vendors forced to publish full interface specifications. We probably need to require firmware blobs to be open source and tell Nvidia and AMD to stop breaking the law (i.e. they both suspect they'd be done for copyright/patent law if they had to publish their source code so they don't).

megablast 3y ago

Wait for Europe to do something. That’s all we can do. Us government will do nothing.

deleted 3y ago

[deleted]