8 ms·

I don't trust DJI. I was looking to replace my GoPro with the DJI Action, but their app was not on the Play-store. It can only be side-loaded on Android, becau

I don't trust DJI. I was looking to replace my GoPro with the DJI Action, but their app was not on the Play-store. It can only be side-loaded on Android, because their app breaks a number of policies on privacy and data gathering. I believe I saw a site that decompiled their app and found a number of worrisome things.

dji4321234 2y ago
> It can only be side-loaded on Android, because their app breaks a number of policies on privacy and data gathering. I don't think this is the reason, I think it's more that they're just too lazy to jump through the approval and maintenance hoops that come with an app store, especially because their home market (China) doesn't even use the Play Store. The iOS version of their app is Apple-approved and present in the App Store. I do research in this space. Their consumer apps are loaded to the gills with product-manager telemetry (tap/action tracing, etc., think Firebase/Flurry/whatever), and until recently they had a "sync flight logs" feature that would do what it said: give your detailed flight logs to DJI. It was opt-in, but it was easy to do by accident and many years ago there were bugs in the opt-in toggle. They just removed this feature from US apps this week (too little too late, and too attached to reality and not attached enough to political pandering). DJI also have a terrible track record with data security, with their entire AWS account getting ripped in 2017. I don't think they're explicitly a CCP data-collection front, but sufficient product telemetry is indistinguishable from surveillance malware (this applies to US-based companies and US intelligence, too, of course). However, their apps run on their own controllers are generally alright, and their enterprise apps run on their enterprise controllers in Local Data Mode are legitimately clean, barring a few versions with small bugs. I fly DJI drones all the time using DJI RCs with network credentials forgotten, and I wouldn't hesitate to use one of these for consumer use. For the truly paranoid, use a burner email and a VPN to activate the drone. I also wouldn't worry about using DJI Enterprise drones with the pro controllers in Local Data Mode for even moderately sensitive applications (infrastructure, law enforcement, etc.). Of course I wouldn't use one for US military applications, insofar as it would be foolish to use any non-allied electronic device in this way. ps - note that the analysis in the sibling comments are of older apps, DJI Go 4 and Pilot 1, not the newer flagship apps DJI Fly and DJI Pilot 2. The general theme (tons of dirty analytics platforms) remains the same, but the newer apps use more American platforms (Firebase, AWS-hosted proprietary stuff) rather than Chinese, and the "disable telemetry" and "disable data sync" options generally have fewer bugs now.
- mensetmanusman 2y ago
  Aw yes, a $15B company that is “lazy”
  - 0cf8612b2e1e 2y ago
    It is amazing how much leeway enormous companies can get by claiming ignorance or laziness.
- consumer451 2y ago
  > I don't think this is the reason, I think it's more that they're just too lazy to jump through the approval and maintenance hoops that come with an app store If that was the case, then why jump through all the hoops of extensive code obfuscation for the Android app? [0] > DJI also have a terrible track record with data security, with their entire AWS account getting ripped in 2017. Leaving the door propped open for everyone is also plausible deniability for doing bad things. [0] https://news.ycombinator.com/item?id=39438842 https://news.ycombinator.com/item?id=39438842
  - dji4321234 2y ago
    Anti-reversing. Obfuscation and packers are dominant in Chinese applications. If something isn't obfuscated, it's free reign for competitors. > Leaving the door propped open for everyone is also plausible deniability for doing bad things. We completely agree here, see "sufficient product telemetry is indistinguishable from surveillance malware." I personally don't think this justifies a blanket ban on a technology; if it did, the world would need to be a very different place.
- lazyeye 2y ago
  This is a naive take Im wondering if its intentional disinfo.
- hackernewds 2y ago
  > sufficient product telemetry is indistinguishable from surveillance malware Isn't this mandatory given the restrictions required of them to disallow flying in banned areas?
clutchdude 2y ago
For those looking for more info: https://blog.grimm-co.com/2020/07/dji-privacy-analysis-validation.html https://blog.grimm-co.com/2020/07/dji-privacy-analysis-valid... https://www.synacktiv.com/en/publications/dji-pilot-android-application-security-analysis-1 https://www.synacktiv.com/en/publications/dji-pilot-android-... https://www.nytimes.com/2020/07/23/us/politics/dji-drones-security-vulnerability.html https://www.nytimes.com/2020/07/23/us/politics/dji-drones-se...
- consumer451 2y ago
  And also: https://blog.quarkslab.com/dji-the-art-of-obfuscation.html https://blog.quarkslab.com/dji-the-art-of-obfuscation.html Discussed at length here: https://news.ycombinator.com/item?id=39438842 https://news.ycombinator.com/item?id=39438842
freedomben 2y ago
Do we know the official reasons they can't be on Play? All I can find are people speculating, but it would be really nice to know exactly what Google rejected them for. Edit: Thank you sibling comment posted at same time: https://news.ycombinator.com/item?id=40709374 https://news.ycombinator.com/item?id=40709374
forloni 2y ago
This whole thing is about the trade war with China. Attacking successful Chinese companies with pretenses.
- herbst 2y ago
  I don't know why even anyone on HN thinks its something else than exactly that
coldtea 2y ago
Well, their app is on the iOS app store, so unless you imply they do something special for their Android app...
dheera 2y ago
I don't think "being in the Play store" means something is trustable, it just means you trust Google Play Services and Google with all of your data, and by extension, the US government. Being located in the US, I am arguably far more concerned about the US government tracking me than the Chinese government. The US government has jurisdiction over me, the Chinese government does not.
- MaxHoppersGhost 2y ago
  This is an incredibly naive view.
  - theo0833 2y ago
    State your reason - I'm in the same boat as dheera and I'm curious.
- 2OEH8eoCRo0 2y ago
  > Being located in the US, I am arguably far more concerned about the US government tracking me than the Chinese government. I read this BS so often that it feels manufactured.
  - AnimalMuppet 2y ago
    Why BS? The US government can jail me; the Chinese government cannot. I therefore fear surveillance by the US government more than I fear surveillance by the Chinese government. Now, in an ideal world, I want neither China nor the US monitoring me, nor anyone else. But for me personally, the downside from the US monitoring me is larger. That line of reasoning seems sound to me. If you see a flaw in it, state what the flaw is, rather than just labeling it "BS".
    - 2OEH8eoCRo0 2y ago
      It skips important details such as courts, juries, and due process. It's a cynical view that the US legal system must work the same way as in authoritarian Communist China. It sounds like a view that someone living in such a system would have. That your system is equally bad but at least ours is across an ocean. Is it a false equivalence?
greenavocado 2y ago
> I believe I saw a site that decompiled their app and found a number of worrisome things. Every Android in America is sold with a rootkit called Google Play Services and it can do absolutely anything on your phone. There is no limit to what Google Play Services can do on your phone unattended or clandestinely.
m463 2y ago
Long ago I bought a DJI mavic. I generally don't use apps for any stuff. I couldn't fly it with the joystick controller that came with it. It said "see app" or something on the controller. It was really annoying but I sent it back. A cursory web search said it was sending all kinds of location/flight information/etc back to dji continuously. I thought there would be outrage, but not much. I think it is sort of annoying that they are going after DJI specifically. I think congress should be going after device/app privacy itself for all devices/apps in a more fundamental way.
deleted 2y ago
[deleted]

dji4321234 2y ago

> It can only be side-loaded on Android, because their app breaks a number of policies on privacy and data gathering. I don't think this is the reason, I think it's more that they're just too lazy to jump through the approval and maintenance hoops that come with an app store, especially because their home market (China) doesn't even use the Play Store. The iOS version of their app is Apple-approved and present in the App Store. I do research in this space. Their consumer apps are loaded to the gills with product-manager telemetry (tap/action tracing, etc., think Firebase/Flurry/whatever), and until recently they had a "sync flight logs" feature that would do what it said: give your detailed flight logs to DJI. It was opt-in, but it was easy to do by accident and many years ago there were bugs in the opt-in toggle. They just removed this feature from US apps this week (too little too late, and too attached to reality and not attached enough to political pandering). DJI also have a terrible track record with data security, with their entire AWS account getting ripped in 2017. I don't think they're explicitly a CCP data-collection front, but sufficient product telemetry is indistinguishable from surveillance malware (this applies to US-based companies and US intelligence, too, of course). However, their apps run on their own controllers are generally alright, and their enterprise apps run on their enterprise controllers in Local Data Mode are legitimately clean, barring a few versions with small bugs. I fly DJI drones all the time using DJI RCs with network credentials forgotten, and I wouldn't hesitate to use one of these for consumer use. For the truly paranoid, use a burner email and a VPN to activate the drone. I also wouldn't worry about using DJI Enterprise drones with the pro controllers in Local Data Mode for even moderately sensitive applications (infrastructure, law enforcement, etc.). Of course I wouldn't use one for US military applications, insofar as it would be foolish to use any non-allied electronic device in this way. ps - note that the analysis in the sibling comments are of older apps, DJI Go 4 and Pilot 1, not the newer flagship apps DJI Fly and DJI Pilot 2. The general theme (tons of dirty analytics platforms) remains the same, but the newer apps use more American platforms (Firebase, AWS-hosted proprietary stuff) rather than Chinese, and the "disable telemetry" and "disable data sync" options generally have fewer bugs now.

mensetmanusman 2y ago
Aw yes, a $15B company that is “lazy”
- 0cf8612b2e1e 2y ago
  It is amazing how much leeway enormous companies can get by claiming ignorance or laziness.
consumer451 2y ago
> I don't think this is the reason, I think it's more that they're just too lazy to jump through the approval and maintenance hoops that come with an app store If that was the case, then why jump through all the hoops of extensive code obfuscation for the Android app? [0] > DJI also have a terrible track record with data security, with their entire AWS account getting ripped in 2017. Leaving the door propped open for everyone is also plausible deniability for doing bad things. [0] https://news.ycombinator.com/item?id=39438842 https://news.ycombinator.com/item?id=39438842
- dji4321234 2y ago
  Anti-reversing. Obfuscation and packers are dominant in Chinese applications. If something isn't obfuscated, it's free reign for competitors. > Leaving the door propped open for everyone is also plausible deniability for doing bad things. We completely agree here, see "sufficient product telemetry is indistinguishable from surveillance malware." I personally don't think this justifies a blanket ban on a technology; if it did, the world would need to be a very different place.
lazyeye 2y ago
This is a naive take Im wondering if its intentional disinfo.
hackernewds 2y ago
> sufficient product telemetry is indistinguishable from surveillance malware Isn't this mandatory given the restrictions required of them to disallow flying in banned areas?

clutchdude 2y ago

For those looking for more info: https://blog.grimm-co.com/2020/07/dji-privacy-analysis-validation.html https://blog.grimm-co.com/2020/07/dji-privacy-analysis-valid... https://www.synacktiv.com/en/publications/dji-pilot-android-application-security-analysis-1 https://www.synacktiv.com/en/publications/dji-pilot-android-... https://www.nytimes.com/2020/07/23/us/politics/dji-drones-security-vulnerability.html https://www.nytimes.com/2020/07/23/us/politics/dji-drones-se...

consumer451 2y ago
And also: https://blog.quarkslab.com/dji-the-art-of-obfuscation.html https://blog.quarkslab.com/dji-the-art-of-obfuscation.html Discussed at length here: https://news.ycombinator.com/item?id=39438842 https://news.ycombinator.com/item?id=39438842

freedomben 2y ago

Do we know the official reasons they can't be on Play? All I can find are people speculating, but it would be really nice to know exactly what Google rejected them for. Edit: Thank you sibling comment posted at same time: https://news.ycombinator.com/item?id=40709374 https://news.ycombinator.com/item?id=40709374

forloni 2y ago

This whole thing is about the trade war with China. Attacking successful Chinese companies with pretenses.

herbst 2y ago
I don't know why even anyone on HN thinks its something else than exactly that

coldtea 2y ago

Well, their app is on the iOS app store, so unless you imply they do something special for their Android app...

dheera 2y ago

I don't think "being in the Play store" means something is trustable, it just means you trust Google Play Services and Google with all of your data, and by extension, the US government. Being located in the US, I am arguably far more concerned about the US government tracking me than the Chinese government. The US government has jurisdiction over me, the Chinese government does not.

MaxHoppersGhost 2y ago
This is an incredibly naive view.
- theo0833 2y ago
  State your reason - I'm in the same boat as dheera and I'm curious.
2OEH8eoCRo0 2y ago
> Being located in the US, I am arguably far more concerned about the US government tracking me than the Chinese government. I read this BS so often that it feels manufactured.
- AnimalMuppet 2y ago
  Why BS? The US government can jail me; the Chinese government cannot. I therefore fear surveillance by the US government more than I fear surveillance by the Chinese government. Now, in an ideal world, I want neither China nor the US monitoring me, nor anyone else. But for me personally, the downside from the US monitoring me is larger. That line of reasoning seems sound to me. If you see a flaw in it, state what the flaw is, rather than just labeling it "BS".
  - 2OEH8eoCRo0 2y ago
    It skips important details such as courts, juries, and due process. It's a cynical view that the US legal system must work the same way as in authoritarian Communist China. It sounds like a view that someone living in such a system would have. That your system is equally bad but at least ours is across an ocean. Is it a false equivalence?

greenavocado 2y ago

> I believe I saw a site that decompiled their app and found a number of worrisome things. Every Android in America is sold with a rootkit called Google Play Services and it can do absolutely anything on your phone. There is no limit to what Google Play Services can do on your phone unattended or clandestinely.

m463 2y ago

Long ago I bought a DJI mavic. I generally don't use apps for any stuff. I couldn't fly it with the joystick controller that came with it. It said "see app" or something on the controller. It was really annoying but I sent it back. A cursory web search said it was sending all kinds of location/flight information/etc back to dji continuously. I thought there would be outrage, but not much. I think it is sort of annoying that they are going after DJI specifically. I think congress should be going after device/app privacy itself for all devices/apps in a more fundamental way.

deleted 2y ago

[deleted]