Am I being overly paranoid? Or should I treat it as basically trustworthy as any other major brand of computer?
The system requires a special app to update drivers and so forth, but frankly this is not additional security exposure, since Huawei bits are all over the machine to begin with.
I'm sure y'all got opinions :-)
Not saying that you should trust Chinese companies, but the notion that they're any worst by speculation in the face of evidence for the alternative's being complicate in spying on their users is rather absurd. People can't shake off the good-guy-bad-guy narrative, can they?
https://www.theregister.co.uk/2015/06/29/wikileaks_docs_show...
Not sure how that happened.
Because I’m one of the people the 5E apparatus is trying to protect, and if my local spy agency got in touch with me to ask me for my data, I’d give it to them without a second thought.
https://www.abc.net.au/news/2019-05-10/canberra-afp-officer-...
I mean, sounds like the system is working then?
That's a pretty bold assumption you're making.
You might support actions such as the NSA spying on the porn habits of Islamic 'radicalizers' planning to release the information in efforts to discredit them. [3] But consider that who governments consider good and whom they consider bad is something very much subject to change. For instance are you aware of the now infamous letter the FBI sent to MLK in an effort to blackmail him and even drive him to suicide? [4]
These are the people that you'd so happily give your information to. The notions of a black and white, good and evil, world is something out of Hollywood. In reality there are good and 'evil' sides to every nation and organization. And when you submit yourself to any, you don't get to pick who your information is made available to or how it will be used.
Finally there is the matter of risk:reward. You stand an extremely low probability of being victimized at any given point in your life. And even if you are victimized it will be likely to be a petty local offense such as burglary, robbery, assault, etc. These are not the sort of actions that national intelligence agencies are tasked with preventing, which is more along the lines of terrorism and national security dangers. By being so happy to turn over all information about yourself you expose some risk that that information will end up being used against you. How does this increased risk compare against the decreased risk due to whatever value your personal information provides? This is not really possible to measure, so each individual must decide for himself. But I find it difficult to imagine that this is a beneficial exchange.
[1] - https://www.nytimes.com/2014/07/21/us/politics/edward-snowde...
[2] - https://www.cnet.com/news/nsa-offers-details-on-loveint-that...
[3] - https://www.huffpost.com/entry/nsa-porn-muslims_n_4346128 (unfortunate source, but it is a well written and sourced article)
[4] - https://www.nytimes.com/2014/11/16/magazine/what-an-uncensor...
I believe the best outcome, by far, of Snowden's revelations was to bring questions like this into the public sphere, and thus hopefully increase oversight. I think this is happening in all areas, private and public.
I would be pretty surprised (although not amazed) if a Facebook engineer could easily read my Messenger messages now and generally stalk me, although I suspect it was very very easy for them to do it a few years ago.
The built-in file browser shows ads related to random conversations I've had(not related to searches or my general interests) way to often for me to consider it a coincidence.
I'm seriously considering getting an iphone again, just because I trust Apple a bit more(and only a little).
But there would be no way in hell I would do sensitive work on Huawei or Xiaomi laptop.
Some of them are badly translated, updates to a simple calender app suddenly requires ridiculous permissions.
And worst of all, enabling USB debugging test apps through Android Studio requires a Mi Account. Maybe I'm paranoid but I can't think of a reason other than corporate espionage.
If you have substantial business interests in China, you’d prefer a non Chinese brand laptop.
If you are more worried about IRS going after your financial records, US based advertisers tracking your online activities or NSA monitoring your contacts with people in Arab countries, huawei may be a better choice, since it won’t work with IRS, Facebook or NSA.
a) It's not a simple relativism.
b) Brands are tied at different levels to their nations, and go after people from different kinds of reasons.
I suggest given the controversy, there's probably a lot of legit risk about using Huawei for any reason.
Unless you're doing something really dangerous, I would not be worried about Windows. There are zillions of tax evaders and otherwise criminals who 'use computers' and don't get caught for that reason in the US.
If you're going to do something really bad, well large American corporations may help out the Feds.
Carriers, web sites and other such places are probably more of a risk than your OS.
The security concern over Huawei is legit, even if there's economic war, and a hint of jingoism mixed in.
[0] http://www.zdnet.com/article/lenovo-accused-of-pushing-super...
[1] http://www.computerworld.com/article/2984889/windows-pcs/len...
[2] https://www.zdnet.com/article/lenovo-rootkit-ensured-its-sof...
For my children, I chose mail adresses in India (zoho.com) because I am french; not that I trust India more than France but because being spied by India will certainly be less harmful for French citizens than being spied by some European country. I will myself never use a French service or app.
I really laugh when I see my country releasing some new "trustful" services for French citizens: maybe it is true but I have very little to win (not being spied by a country that does not care about me anyway) and too much to lose (if a country is about to annoy you it will certainly be yours).
If I were a chinese citizen I would certainly not use Chinese products for the very same reason, but an American citizen should be more confident in using such services than in using american ones! Why do American people want to be spied by the very single country they really have to fear?
China is indeed mainly focused internally, but there's no limit to how far they'll go in support of those ends. China attacked Google, Yahoo, Adobe, many others, using a zero-day IE exploit.
Of course they'll use your laptop as part of a botnet, C&C proxy, ransomware vector, etc. There's no benefit of the doubt remaining.
Are you Google, Yahoo or Adobe though?
If you're a very high value target, everybody will attack you. NSA, 8400, Russian and Chinese teams, everybody. If you're just an individual working on their personal business, nobody is burning 0days on you.
Like battery, HDD/SDD, display, ethernet, wifi and bluetooth modules, keyboard, touchpad, webcam, SD card reader, BIOS/SMM, TPM, etc.
Some of those might be innocuous and unable to host anything malicious, some might seem so but have non-obvious ways to compromise the system. And some, like anything communication related... sky is the limit.
What's common with those is that they are very hard, nearing impossible to audit and analyze. When was the last time you checked whether your laptop's WiFi firmware isn't doing something nasty? Or your SSD FW?
I think we need to be worried about a lot more than just BIOS and OS.
I think the idea is to provide a feature for persistent spyware. For example if a company wanted to be able to track their laptops even if someone factory resets it.
I have yet to become allergic to Google snooping but understand that lack of trust to be very well founded. I think I understand their secure boot architecture, though. Whereas I simply cannot trust Windows Secure Boot based vendor firmware.
Apple iOS devices. Their macOS Intel computers are about as trustworthy as Chromebook Intel.
Not-so-recent ThinkPad laptops with OpenBoot BIOS are ok.
But.
All of these devices have radios with each their own, black-box operating systems. I don't know how to develop a basis for trust there.
So I am left with very few alternatives.
A Raptor Talos II Workstation, with a custom battery-based power supply, locked inside a Faraday cage. Turned off.