Google admits changing phone settings remotely
bbc.com
bbc.com
I'm almost wondering if we could do some sort of crowd auditing of play services changes, automatically grab changes pushed via play store, pass through appropriate decompilers and disassemblers and highlight modified sections, similar to what tools like bindiff do... I know, I know, install MicroG/switch to an iPhone/burn your phone with fire, but many people run these devices and would be interested in any impacts like this being had on user security and privacy I'm sure.
Google is fucking creepy and it probably shouldn't be legal for them to bully me into using Play Services.
I think the issue is a lack of informed consent. Some of the commenters seem to think this isn't a "big deal", since the changes were relatively minor and made to benefit the user.
Let's draw from the real world: even if you have zero STDs, and use a condom, it is a serious crime to have sex with someone while they're asleep - because they couldn't give consent.
It deeply troubles me that I keep seeing this mentality that there must be "harm" for something like this to be a problem.
I saw similar logic used in the article on Google using "anonymized" credit card data - that people's feelings about the matter are invalid, since there's no harm if the data is anonymized.
Frankly, the word that comes to mind when I read these articles is not arrogance - it's entitlement. Google feels entitled to do as it pleases, because it feeds it knows better than you.
Who the hell at Google tought that playing with phone settings remotely was a good idea?
In some countries it could be leveraged to put government-sponsored spyware on everyone's phones.
And by "some" I mean "all."
(Album art is communicated through notifications so you can still revoke access on a per-app basis, but the new setting is not explicit, not global, coarse, and overrode my preferences during an "upgrade". Ugh.)
You don't have to change a setting if it never works.
points at temple
https://bgr.com/2018/08/20/lawsuit-google-violates-privacy-t...
If you request they delete your data they probably won't, either.
Tech companies (especially Google) are giant black boxes with vast control over our lives. "The Circle" wasn't a good movie in my eyes, but it might give people a feeling of what such a company is capable of.
It should simply be impossible for Google to do anything pernicious to a newly-purchased Android phone: it should not be able to write settings, nor should it be able to read any data.
These are folks who are constantly 'empowering' themselves at the cost of others so getting root on your own phone is now thought of some sort of great security hole and some apps will detect it and refuse to work. This is the future of software freedom courtesy ex freedom and liberty poseurs and now greedy out of control tinpots.
That being said, rooting is a security hole - the PIN lock on most rooted phones can be trivially bypassed, and an application running as root can persistently and invisibly compromise the system (and bypass safeguards on things like Android Pay).
The only non-Google Android fork which does not trivially compromise device security was Copperhead OS (now defunct) - they would ship devices with a locked bootloader and sign their updates, achieving a similar level of security (assuming a secure build system).
1. Google have this capability.
2. They have exercised it.
3. Whatever internal controls exist to check this don't exist, failed, or explicitly permitted this action. None of the three options, for a single locus of control to something on the order of 3-4 billion user devices or accounts (net of Android + Gmail accounts) is particularly heartening.
4. The primary channel of communication is ... a Reddit account?
Someone is terrifyingly asleep at the wheel.
Competency? Trust? Goodwill? This is how you lose it.
This is how organisational decline starts. It tends to proceed slowly, at first, then all at once. Shades of Hemmingway.
A lot of the responses here are overreactions. This appears to be a defect, not something nefarious. Part of software development is altering default settings. Another part of software development is periodic updates. Mistakes like this will happen. Get over it.
I worry that users imagine software to be static, complete, and never in need of change... and the world just doesn't work that way. Software is in a constant state of "works just well enough to maybe deploy". Experimentation and refinement are always necessary.
I don't see outrage when Microsoft updates Windows and it starts deleting malware from your system. What's the difference?
For users who have stable, working software, it should. If I voluntarily update my device that's a different scenario. Quietly pushing changes like this that impact user settings, not so much.
> I don't see outrage when Microsoft updates Windows and it starts deleting malware from your system.
Googling "Disable malicious software removal tool" certainly reveals otherwise.
The problem, is that they didn't seem to ask for consent or have been upfront that they had implemented this kind of remote control capability. The user's phone is the user's phone, not Google's; so the user needs to have ultimate control (and Google needs to respect that).
People seem mad that it was a configuration change and not a change in the image that is installed on the device, but I don't see the difference.
Think of it this way: you need a backdoor to push remote config changes the way Google did.
Sure, Apple, Google, Microsoft, etc. have the ability to run arbitrary code on your machine through updates, but they'd be abusing the trust placed in them to even install a backdoor, let alone use it.
I see an update server as one that says to your phone "copy these bytes into flash and reboot" and a configuration server as "copy these bytes into flash and restart service X".
Your phone is constantly communicating with servers that attempt to change the running software; a configuration change is just faster than upgrading the entire image.
Though I think there are also issues with silently using a software update to change settings that some user may have set differently in the past to a different value (assuming the value the user used wasn't removed or had its meaning changed). If the developer really things the user would be better off changing the setting, the should prompt the user to explain the reasoning and ask for consent.