Xiaomi Recording ‘Private’ Web and Phone Use | Hacker News Reader

Xiaomi Recording ‘Private’ Web and Phone Use

forbes.com

526 pointsrock_artist241 comments

Just wait till they:

- start encrypting all the data they collect (with real encryption, not base64 encoding)

- saving up the data for hours or days at time and sending it in bursts (so there is no immediate connection to a remote server)

- sending the data to plausible U.S.-registered domains (rather than to Singapore and Russia)

- monitoring at the kernel or firmware level so that it doesn't matter what browser or apps you use

- turning off data collection when it suspects a security researcher (due to signs of debuggers, development tools, network monitoring, usual network settings like to proxies or DNS, etc)

We won't be able to prove anything. So disheartening.

> due to signs of debuggers, development tools, network monitoring, usual network settings like to proxies or DNS, etc

Then that's your counter measure... run a debugger 24/7.

I wonder how many devices already do this.

> I wonder how many devices already do this.

All Android phones. But they send the data to google and facebook so they must be good.

Source needed. The amount in the article is staggering compared to what Google claims to collect which is in line with the (admittedly not definitive) DNS query logs I monitor every now and then. Also, much of it (e.g. location) can be disabled and there are Android phones that are entirely free of Google and Facebook.

I do know for a fact that Android contacts querries Google severs to pull data from Google services, like YouTube, to fill in extra contact details on the phone.

Knowing what Google's business is, I doubt they don't merge that data for a more complete profile.

You can try this yourself: Create a YouTube account, upload a picture for the account, don't add details like a phone number.

Now create a contact on Android, add a phone number (as most people do with contacts on their phone) and add the email address you registered the YouTube account, the Android contacts app will pull the profile picture from the YouTube account, and put it on the phone as the picture for the contact.

Gave me quite a little scare when I discovered this by seeing my YouTube profile picture as the contact picture on a (rather privacy and tech-illiterate) friend's Android phone, even tho I never added any phone number to any of my Google accounts, all he did was add my email address to the contact.

Unfortunately I can't easily test this as my phone doesn't have the Google Contacts app and I sync my contacts with a CardDAV server, not my Google account.

As I said elsewhere on this page, Google Play gets an update from your phone every 2 minutes 24/7 with a lot of privacy settings enabled. Turn on a firewall, I think it was disconnect that showed me this

The content of these updates is what is potentially concerning. Considering how much Play Services now handles, regular updates aren't that surprising, and like I said Android ≠ Google so this doesn't apply to all Android phones. The mechanism described in the article sent every visited URL in the browser and opened app or settings menu on the phone to Xiaomi.

I ran a firewall on my Android once. It blocked a request to google play services every 2 minutes, 24/7. I use an iPhone now and really want a librem

Why would they go to all that trouble? Just 1. keep sending any and all data without any obfuscation 2. blanket denial of any wrong doing, regardless of how obvious 3. decent hardware for zero down on a contract

profit!!!

your way is so much more work...

Parents option would likely get around privacy regulations in some countries. So they can do the “much more work” you mentioned and also sell decent hardware for zero down on a contract, getting a bigger total market and more surveillance info.

Well the EU and Canada seem to be terrified of putting a foot wrong with the CPC, so my guess is that Chinese companies will violate people's privacy until it becomes so blatant that they get a polite request to tone it down (and obfuscate the collection).

The EU is not terrified, it (or rather, the local politicians) is corrupt; the politicians are willing to go as far as kissing the Chinese flag but that does not say anything about us, the citizens.

This brand of sharp minded and well sourced political analysis is what I appreciate about HN. The good thing is, I keep seeing more and more of it.

You expect a URL for every word written? The stories showing how everyone in the West bends in order not to anger CPC are out there and well known. You can't have a recap of human history in every comment.

HN comments aren't scientific papers. While (good) references will strengthen any argument and are welcome, I find opinions here valuable even when sources are not immediately available. You can always do your own research and paste links confirming/rejecting any statement if you so desire.

Americans are not?

Look at how they bent the knee with Huawei and ZTE. Also can’t figure out how to produce hardware in their home soil, as much as they’d like to.

oh we can most definitely manufacture a phone, but since we don’t have slave labor and questionable human rights it costs us more to do so.

Automation seems like the answer. Surprised it hasn't come to that already.

Hand-labor today is used as an interim solution, when the scale doesn't justify bespoke automated assembly line. When factories are 'brought back' to the West, its because they scaled up and automation is now affordable.

I think that comes down to cost of work vs. fines at that point and which would cost more. If the fines are cheaper they may just opt for them.

Agree. Sadly this business mentality is global one (not only limited to China). "Doing wrong is ok, ideally it's more profitable". The cost of doing ethical business appears to be higher and that cost has to be passed on to the consumer it seems consumers as a whole tend to care more about low price than ethics or privacy. Because there is little or no value attributed to ethics / privacy.

Plausible deniability. They can turn around and say it's racism. It's their (and the Russian) MO. As long as there's no absolutely clear, unmistakable evidence, they can spin spin spin and too many people will buy their bullshit. It also provides a cover for politicians to not do anything. I see it here and elsewhere. People jumping to China's defense at every opportunity even though they deserve zero trust.

When a new guy on the team refers to base64 encoding as encryption. /me - oh you must be new here?

Serious note - welcome to the future. Nothing is private anymore.

With some fleshing out, this is an excellent rendition of the { DRM, malware, spyware } evolutionary path, pretty close to what was described to me by RealNetworks back in the dotcom era.

Need to add anti-reverse-engineering techniques - obfuscation, self-modifying code, custom and hard to reason about embedded VMs, etc. other than anti-debugger and test harness detection. I think earlier on.

I thought it went: DRM, spyware, then co-opted for malware by others.

Unfortunately I tend to think RM Stallman is right - smartphones are a prison with tracking enabled. We're all foolish to yield that much power to vendors.

Most software on the smartphones aren't under our control, we aren't able to stop them, disable them, inspect them, or see the source code.

I think we should undo everything done in the smartphone since 2008 and come up with a true open source smartphone.

The vast majority of people do not understand why this might be needed and even many of those who understand do not really believe or see it as a problem (or even see it as a benefit if they are profiting from it). Some even consider it as a good thing because it is presented as "security" and for many anything that could be secure in theory is enough to make them shut down their brains and try to see the negative sides.

To make what you mention work, that smartphone will not only need to be open source, but also be much better in both UX and features and cheaper than anything similar.

Purism is working on it. I think they're selling them now.

No idea if it is good just that it's happening.

Purism phones aren’t as polished as other phones, but it’s amazing that they exist. We need to support them until they get to version 2-3 and have everything slick and polished

You can still open the firmware update file in ghidra, cutter or ida pro.

But yeah the trend is troubling. I also believe that it's only a matter of time once the "smart" devices (fridges, TVs, etc) start shipping with 5G modules enabled that send data to the mothership whether you set up WiFi for them or not. Because while you can't buy non-smart TVs, many users don't enable smart features by not connecting them to the network. The 5G module will probably only exist for tracking purposes and maybe firmware updates, but not for the netflix/youtube app.

Until the chip prevents copying out the firmware…

Perhaps a counter trend will emerge from spyware appliances will emerge, where people will pay a premium for "dumb" TVs or fridges from privacy respecting manufacturers. I've read about people already trying to purchase display model/commercial versions of TVs, which doesn't have any unnecessary smart features. The attraction is avoiding unneeded bloat, presumably longevity, and of course, privacy.

There was an interesting discussion on HN recently regarding appliances that can handle open source firmware[1]. Several advantages I've found with open firmware include stability, security, avoiding unnecessary e-waste, you're not locked into a manufacturer that might discontinue support for the device, and privacy. If such appliances existed, I would certainly consider them when purchasing an appliance.

[1] https://news.ycombinator.com/item?id=23001017

OTOH Xiaomi also sent out dev devices to custom rom developers. Well technically it's Poco the Xiaomi subsidiary[1]

Is there any word on whether that is true for european region phones as well? From what I remember they disabled certain functionality like Face Unlock in the EU. Not sure if it was due to privacy or patents, but given the GDPR I wouldn't be surprised if it was due to privacy.

[1]: https://www.xda-developers.com/poco-x2-custom-rom-kernel-dev...

Oh! That explains why my F1 has such good ROM support, it was a major reason for buying it (another one is cheap replacement parts).

They still disrespect ROM users: You have to go through a convoluted process involving Windows software and a Xiaomi account AND wait 3 days to unlock the phone - but that's way down from the 6 weeks I've read about on other Xiaomis, so you can be sure I'm not going to buy one of those.

the delay appears to be random. my first one was 3 days, my second was more than a week until just a day before the person that i wanted to give the phone to was leaving.

The worse part is requiring a SIM card on the phone the whole time, hoovering your IMEI and phone number in the process.

Excuse my naïveté, but who would actually work on such things? How can someone have such low moral standards to, day after day, build systems that secretly remove privacy from otherwise innocent people?

Money lowers moral standards.

lawyers?

“Money makes a man act funny” -Eminem.

I have had friends suddenly get very selfish when the chance to get even $10 is available. I had a regular at a retail job once who came in every day... he asked to borrow $1 once to help pay for something. To avoid paying it back, he never returned, likely walking an extra several km to the next nearest store of the type every day. For $1

Most people are just following orders at their job, where they've got bills to pay. Morals are not so important on the hierarchy of needs. It might not even be something that crosses those worker's minds because of a much different upbringing/education than yours.

Yeah, it would be indistinguishable from what Google does. Oh, wait...

I know I am being naive, but what I can do? A normal used that is wants privacy?

I expected some Volkswagen like defeat device to in phones to evade security audit.

But what can "I" do, considering that the bodies & Govt that are suppose to do something are busy stuffing their own pockets and busy with petty politics.

Open-source hardware progress is very slow and low RAM. How safe will I be if I just run LineageOS on a Xiaomi device?

As a normal user who wants privacy, you'll be just fine with LineageOS on Xiaomi. Assuming you don't install spyware later. You don't even have to install Google apps (see f-droid and Aurora store).

I recently wiped my factory-unlocked Samsung S20, enabled debug mode, and ran "pm list packages" over ADB. The results were beyond startling. There were close to 100 packages running under com.samsung and other various namespaces with tons of sensitive permissions. Most of these processes I could not identify what they existed for. And I still can't figure out why a freshly wiped unlocked phone w/ a Sprint SIM is running a Verizon provisioning process.

I do not trust any of these Android manufacturers to do right by people. Even the Pixel phones have a "Support" application that has camera permissions -- which last I checked, couldn't be changed regardless of whether you need support or not. What's going to happen when some obscure team within Google pushes an update to this app to do something without user approval?

I wonder if it is illegal under GDPR to include spying apps on phones without telling the user.

It most certainly is.

It is, there is no doubt about that.

The question of the GDPR is not whether it's illegal but whether anything is done to crack down on offenders. Facebook, Google and thousands of marketing/analytics/advertising companies are still around and are stalking users with total disregard of the GDPR, so that's a clear negative.

Would someone who is downvoting this be willing to explain why? Because I have the same impression (that many GDPR rules are simply being ignored because enforcement is lacking).

The typical response I get to such comments is that Google did get fined 50M once in France. The problem is that not only is it pocket money to them but Google continues to violate people's privacy (Google Analytics still tries to stalk me everywhere without asking for consent first).

When it comes to Facebook I am not aware of any investigation or enforcement action being taken despite them being even worse than Google when it comes to privacy and having proven their malicious intent and complete disregard for the privacy multiple times.

Well you can get rid of Google analytics, you just have to install their Opt-out Google Analytics browser extension and fill in some data. I really wish the EU actually did something worthwhile with the GDPR.

The point of the GDPR is that you don’t have to opt-out, you have to opt-in if you are happy with tracking.

It seems there has been more activity since then, see here https://www.enforcementtracker.com/

Sort by amount fined.

There was a joke that the fastest reader in the world is a Romanian who read 54 pages of terms and conditions in 2 seconds. So... yeah, most likely the user has "agreed".

I work in GDPR-compliance related area in a multibillion UE corporation and I can say that right now, it's all a big joke. We have multiple huge violations and we don't do anything about it (partially because the law is so demanding that implementing it would be a massive effort). And yet, we don't get fined - partially probably because no one blew the whistle yet. I'm pretty sure the situation is very similar in all of our competitors. It seems to me that the lawyers who wrote GDPR might have been out of touch with realities of large and old companies and now the preference on regulators side might not to just not enforce the more bonkers parts of the bill? Interesting how it will play out over the next 5-10 years.

> I wonder if it is illegal under GDPR to include spying apps on phones without telling the user.

It is illegal but it is not enforced.

This is why I root my device and only allow apps I trust internet access.

Doesn't that permanently disable some features on Samsung? I read they use a goddamn eFuse for it

I am using a Google Pixel device. I have no idea whether Magisk works on Samsung phones.

Yup, IIRC that disables Knox features and secure folder permanently (trips an e-fuse so there's no turning back). I don't remember if Samsung also intentionally degraded camera quality like some other vendors (Sony at least used to once you unlocked your bootloader).

Root and then get flagged by Google's SafetyNet, preventing you from Netflix, banking apps etc? That's a brave but big sacrifice

Systemless root + root hiding is a thing.

I run a custom rom and pass safety check and have access to all my apps including banking.

This is why people need to start rejecting closed ecosystems. If you own the hardware you can control everything that happens on it including companies trying to force their will upon you

more people would reject them if there were alternatives, but the only things on the horizon are pinephone and purism (neither which are really shipping/working)

Any information on this. I thought rooting was essentially dead

I have an S5 with Magisk. It passes the safetynet checks, and I can choose to specifically hide root status from apps, which has worked well so far.

Google can turn Safetynet validation up or down w/o updating your Droid. Currently it is possible to bypass SafetyNet, but they did turn it up a notch lately, and if they require strong "Key Attention" then neither Magisk nor custom "rootless root" will work (and it will also mean that custom roms Will fail SafetyNet).

https://developer.android.com/training/articles/security-key...

Not with Magisk.

>Netflix

Hah. If properly paying for films requires you to install quasi-rootkits that spy 24/7 on your personal life, and pirating gives you a high-quality .mkv you can play anywhere you want, I damn fucking well know which one I'll choose. "Brave but big sacrifice"? That's just devaluing those words.

You forgot to add that your choice is damaging the innocent content creators.

Maybe those innocent content creators will think twice at contract renewal time, then.

Or just ... buy the DVD / other content type legally available?

And then you still need to “root” the DVD-player so you get to skip the commercials and legal threats...

Which is what I did for a long time, but now I don't even own a disc player...

The piracy is really incidental. No one who chose privacy over Netflix would suddenly reverse that choice if they couldn't pirate content. Especially given that we are talking about phones, does anyone find watching Netflix on their phone actually ideal?

Can SafetyNet calls be proxied to another unrooted phone?

I get a very uneasy feeling using Samsung's products because their privacy record is atrocious, they cram ads everywhere on flagship devices and the quality of their software is just mediocre.

Unfortunately, Android has emerged as the tracking and advertising platform. Look at every single Android TV on the market, they're privacy-invading garbage and such practices are explicitly enabled and encouraged by Google.

> And I still can't figure out why a freshly wiped unlocked phone w/ a Sprint SIM is running a Verizon provisioning process.

Samsung has a rather "interesting" (to say the least) firmware development process (if you can call it a process). It seems that most handsets certainly used to ship with if-gated Verizon specific hacks all over the firmwares, regardless of market the device was for. I believe this was just for simplicity's sake. It sounds like nothing has changed there.

As much as Samsung loves to advertise enterprise security like Knox, it only takes a few minutes of digging through the history of Knox to see some blunders from the early days, like storing the plaintext Knox PIN, to really wonder how on earth they can secure it.

Call me old fashioned, but I just don't have any confidence in the development practices of any phone vendor these days - even plain pure AOSP Android has so many external library dependencies, each of which is receiving CVEs and patches regularly (hopefully), and needs to be kept updated by AOSP maintainers.

I used to track the ancient kernel CVEs that were being rediscovered in Android due to poor or non existent source code control in OEM kernels. I gave up as it was pretty much a flood of 2 or 3 year old bugs being rediscovered as unlatched on Android or Qualcomm kernels.

There's too much to quote, but scroll down to Xiamoi's responses. Man, that is the quintessential example of gaslighting. "No we didn't, that's not true at all. Well, we kinda did, but it's 'anonymized', so it's okay."

"But we have video of your device sending data to..."

"...but, but, anonymized!"

"I thought you said you weren't sending data at all, now it's just anonymized browser data, but we see your devices sending device usage outside the brows..."

"ANONYMIZED!!!!11"

There's no such thing as anonymized when it comes to data tracking. "Anonymized" tracking itself is gaslighting.

It's anonymized in the sense that you don't know who it will be sold to and what they will do with it.

In all seriousness, this is a point GDPR struggles with. It's really hard to properly define what constitutes personal data.

Personally Identifiable information is data that can be used to identify a person with reasonable effort (getting a warrant is not reasonable for instance).

The same data can be both PII and not PII depending on the context.

Not sure what the struggle is?

Disclosure: I'm writing this with my DPO hat on.

The GDPR does specify what is personal data, but doesn't go out giving real-life interpretation examples. The categories given in the regulation are direct identifiers and indirect identifiers. The categories even include a good sampling of information types that belong in each.

Direct allows to identify an individual or a very small group from a single datapoint. Indirect allows to identify larger groups.

Or to put in terms most of us here understand.. Direct identifiers are personal information that would allow to send marketing junk to selected individuals. Indirect ones are those you would use to build marketing cohorts.

So if it's data your marketing department would like to grab, you can bet it's personal information under GDPR.

> It's anonymized in the sense that you don't know who it will be sold to and what they will do with it.

So "It's anonymized" but It's not anonymized.

> In all seriousness, this is a point GDPR struggles with. It's really hard to properly define what constitutes personal data.

GDPR is good. The problem is that GDPR is not enforced because it might upset Uncle Sam

Rome was not built in a day! They need time to aquire the sophistication of the US data brokers.

And yet the empire was brought down from within...

Wow, just... Wow.

> Xiaomi said, “The research claims are untrue,”

and

> When Forbes provided Xiaomi with a video made by Cirlig showing how his Google search for “porn” and a visit to the site PornHub were sent to remote servers, even when in incognito mode, the company spokesperson continued to deny that the information was being recorded. “This video shows the collection of anonymous browsing data, which is one of the most common solutions adopted by internet companies to improve the overall browser product experience through analyzing non-personally identifiable information,” they added.

"We're not doing that. And everyone does that, so it's OK that we do that".

I'm reminded of something Christopher Hitchens once wrote about this sort of 'defence in depth', which I'll try to recount as best I can:

One often hears from undemocratic regimes that they aren't torturing people in the manner accused, and that if they were it wouldn't be so bad, and that if it were bad it would still be well justified. On hearing these three in combination, little doubt should remain that the accusers have it right.

Xiaomi produces one of the best bang for your bucks hardware in the market. Their software is crap though. Ads in the system apps, ui customization that arguably looks worse than stock android, and now blanket tracking like this, though it was always pinging their tracking servers frequently. My pihole logs pretty much full with blocked xiaomi requests until I flashed the phone.

Best thing to do when you got an android phone, especially from a chinese manufacturer, is to flash LineageOS on it.

Problem is lately many banking app required you to use non-root phone, at least in my country. There used to be workaround, but it is not work anymore.

I have Redmi phone and I hates it as soon as I found that there is ads in their rom. It's so disappointing. I mean, other Chinese brand have their own crapware yes, but ads?

I then flash my phone to pure Pixel rom and never been happier, until the bank app incident happened. So I have to use their original rom for now until I get a new phone.

No matter how rave the Mi phone review be, or how it is great 'bang for the bucks' brand, I will never touch their phone again.

Wow, didn't realize android got that bad recently. Makes me not want to leave the iPhone ecosystem.

The only benefit Android had was the control. You take that away and make it a walled garden, its just an iPhone...but worse

I like overall quality of iOS but I still prefer Android though, you can do all sort of weird things iOS never allow. Just next time I'll choose whatever phones that gives me vanilla Android(as much as possible) Pure android is clean and work great, until vendor try to 'enhance' their phone with their apps and stuff.

You still have more control compared to iPhone where you cannot change your default SMS messaging app, or even your default browser. And you have no choice in browser engine either. And it's hardly a walled garden when I can sideload any app on any Android phone. Xiaomi even has their own store that's not Google Play.

The assumption is that bad guys have a much harder time swapping out the SMS app for a trojan.

The assumption is that the apps you choose on iOS just won’t be default. You can still have an SMS or mail app that invades your privacy by uploading everything to a remote server, it just wont be given the GUI conveniences of a default app — a big competitive edge.

But it will be difficult to clamp down on leaking user security and privacy when Apple itself has unencrypted backups, so they can’t pressure other companies to proactively protect user data at rest.

I’ve stopped using higher quality non Apple apps because even something like a calendar app or todo app warrants a special private cloud that slurps up your data with a legitimate argument for why they should have everything.

More control of apps, but less control over snooping

Yap, if i could use my banking apps with lineageos, i would install it in a heartbeat!

Actually, I installed LineageOS but skip installing root binary (it's an optional step when flashing LineageOS) as I don't need root anymore. Without root I can still use my banking app because Google safetynet is passing on my phone.

Interesting. I'll check out some more information about it.

I use LinageOS myself but I would never use a smartphone for anything related to personal finance.

Without an extensive research project there is no telling what's going on under the hood imho.

Most banking apps have extensive telemetry enabled themselves. Even keyboards are trying to phone home constantly

There are ways to get around safetynet, though it's a cat-and-mouse game of "detect the root".

Is that a recent thing? My Xiaomi Mi A1 ran Android One that gets official updates to this day, as far as I could tell it was pretty stock and the data collection in their "Mi Services" could be disabled in the settings UI, so not unlike pretty much any cheap manufacturer.

Mi A1 is probably an exception as it's part of Android One program. The rest of xiaomi lineups are using their miui rom which contains ads and tracking mentioned in the article.

LineageOS (and a few other Android distros) are the only mobile OSes I trust and use. Not any different with laptops and desktops BTW: I don't trust any preinstalled OS and not any distro for which I can't browse the source.

Ha! As a Chinese myself, when I buying a new phone, the first thing I do is to Google whether or not the phone can load custom ROM.

Buying a phone that allows custom ROM is really beneficial. Not just it gives you more fre<Censored>edom and choose, it can also expand the lifespan of the device and thus save you a bit of money.

A side note: Fairphone looked quite nice, but that €450 price tag pushed me out far far away :(

WRT “bang for the buck”: you have to take the whole picture into account, not just cpu speed/battery life plus price. Taken as a whole, it has a negative bang for the buck

Also curious: can you trust the hardware even if you do flash lineageOS? Honestly curious

That's depend your threat model, isn't it? All Android phones rely on black box baseband blobs from the hardware manufacturers. If there is an exploit hidden there, I believe they won't use it just for blanket data collection like this, but only use it for targeted attacks on high value targets (politicians, journalists, magacorp execs, etc). Hopefully they won't bother to use that kind of low level exploits on normal plebs like me. I'm not even sure if iPhones are safe enough when your threat model requires trusting the low level hardware. The only way to avoid it is by using a phone with fully trusted stacks like pine phone or librem 5.

Stuff like this is why without fail, every phone I own gets LineageOS installed immediately.

Xiaomi phones have a bootloader unlock timer to try and mitigate sites reselling their phones with modified software, so I had to leave my Mix 2s alone for a few days before I could make it safe to use.

This is why, without fail, I buy iPhones.

With the Bootloader exploit on iPhone X and older, its actually worth looking at them now.

Checkm8 is a tethered exploit, so probably not super useful if you want to sideload another OS and not have a bad time.

I remember back in the days of the iPhone 3G(s?) there was an attempt at a battery-powered dongle that could re-jailbreak a phone in the field in case of a reboot. The same technology could be built into a battery case or similar, not to mention recent technological advances mean it can be done in a small package the size of a Lightning connector or a Yubikey and you can carry it on your keyring.

Does this mean you'd have to walk around with an unlocked bootloader all the time?

Given the vulnerability we're talking about, the boot loader is already unlocked (because it's vulnerable) and can be exploited by any malicious USB device if the phone is placed in DFU mode.

The dongle idea I'm talking about would be to have a convenient way to exploit the vulnerability for the benefit of the user to boot the device into a jailbroken mode in case of an unexpected restart (battery runs out and you're away from your computer).

There's a similar product for Nintendo Switch jailbreaking: NS-Atmosphere or RCMLoader. Since it's a bigger device, some of them are soldered internally using a Trinket M0

https://twitter.com/SamGuichelaar/status/1177685513807024128...

If the jailbreak script can run on arm linux, you probably can get close enough by using a raspberry pi and a power bank. Configure the pi to automatically run the jailbreak as script on boot or when the phone connected via USB and you'll get a portable plug and play jailbreaking device.

And then you can't install anything Apple doesn't want you to install. I like being able to run gameboy emulators on my phone for games I already paid 20 years ago, change my launcher/dialer, browser, etc.

Luckily my interests and Apple's interests are aligned in that regard. I already waste enough time on my phone every day without having gameboy emulators and spending time (too much time, if my teenage years are any indication) customizing the OS.

Emulators running here, from NES all the way up to PSP, on a 6s that's not jailbroken.

You can sideload it yourself if you have a mac, or you can use something like buildstore that gives you a provisioning profile, but that's 7$ a year or something.

Happily paid that. The buildstore also offers things like ad-free youtube and twitch.tv app tweaks, torrent clients, you name it.

It is a pity iPhones are tied to Apple and iOS (mostly - see the recent news about Android on an iPhone 8) without the possibility of escape which many Android devices offer. For iPhone to be an alternative to Android in this respect it would need a few extra features:

- the possibility to install your own distribution, whether that be alternative versions of iOS or a totally different OS

- expandable storage, preferably with a boot option

- an official method to side-load software outside of the 'walled garden'

- either more extensive access to the innards of iOS or root, this to allow e.g. a true firewall (with ingress and egress blocking), a system-wide network blocker ('adblock' et al), etc.

- the possibility to run interpreters and compilers

- a real browser choice, not just a shell around Safari

In short, the possibility to have a less restrictive system.

Since I don't see Apple opening up in this way unless they're forced to by law or by declining sales I don't see myself buying any of their products in the near future.

Are there any resources describing what you lose and gain by installing LineageOS?

I'd like to know what will stop working before I try it out...

It has been a long time since I used stock Android, but depending on your phone you don't lose much. The base install doesn't have any google apps, but adding them is simple. The biggest loss is in manufacturer unique apps, which can also be seen as a gain considering how companies like Xiaomi use those apps.

Besides that, there can be some security gain if set up properly, I think some additional configuration tweaks, and LineageOS often a longer support cycle.

It really depends on your phone though, try searching your model +lineageos and you should find out the details.

Hah, getting rid of manufacturer specific apps is half the reason for me to install Lineageos in the first place.

That as well as much better battery life and more control over what apps are and aren't allowed to access.

Sometimes those apps are actual features, I believe some phones that advertise special cameras or audio quality need them. Most of the time it's a beneficial loss though.

The original Camera app is the only thing I really missed on my OnePlus 3, before I found somebody on XDA distributing the apk.

It probably depends on the device, but in the best case you are not losing anything. Especially as you can install google services, so Google Play and everything around it works.

The only apps that stopped working on my Poco F1 are apps that check for modified Android. For example my Australian digital drivers license app doesn't work as it detects the Android environment as non-standard. I believe you can do some root magic to work around it, but I could never be bothered to do so. Interestingly enough the three different banking apps I use all work fine.

Have a look at the installation instructions to see how you feel about it [0]. They are usually really good. The devil is in the detail though and you probably have to plan in an afternoon to use google to find workaround for bits that don't work. For example when I was upgrading to the latest Android version I had to install a different bootloader as the previous one wasn't compatible. It took a bit of looking around, but going from the error messages usually brings up the right solutions in various forums.

[0] https://wiki.lineageos.org/devices/beryllium/install

> but in the best case you are not losing anything.

This is starting to not be the case, I couldn't get the wide angle camera working on my newer Xiaomi Mi 10 Lite for example. I had to fall back to miui.eu based rom to get it to work.

That's not an officially supported device. The most recent supported model from that line is the Mi 8, afaik.

If your device is officially supported, chance that you won't lose anything. Unofficial builds (made by community members for devices without official support) vary by quality though, and may not support all the hardware available in the phone.

While we are on the topic of lineageos, I would appreciate if someone could recommend which device to get for it. When I tried to check earlier, it seemed every device was either Chinese (privacy concern) Google-made (privacy-concern), many years outdated, or only unofficially supported.

Is there even a single way to run lineageos without making significant tradeoffs?

You are replacing all of the manufacturer's software on the device except for the firmware, and there is basically no device that won't have the same privacy concern with the firmware. I don't view using LineageOS on a OnePlus phone as a tradeoff as I don't have reason to trust someone like Samsung's firmware either, but you may feel differently.

Push notifications are the only downside. However, push notifications are bad for being distracting, so it’s not really a downside. You still get normal notifications

On a Xiaomi device myself. Recently I've setup Nextdns.io to resolve all the DNS requests through it. Very frequent callbacks to Xiaomi servers for tracking. Blocked a bunch of them now, but it's half a solution.

Other than the tracking, would you recommend it? Is LineageOS available? I've been curious about trying a Chinese phone for a while, but would only do it if Lineage is available, since I'm annoyed by anything more busy than stock Android.

LineageOS supports a lot of different Xiaomi devices: https://wiki.lineageos.org/devices/#xiaomi

I have a tissot with LineageOS 16.0, not sure yet whether it will get 17 ported to it as well. The hardware is great for the price (bought it a year after launch, heavily discounted). I bought it specifically to run LineageOS on it, so I have no idea what the stock experience is like.

Official tissot support was dropped this month. No more security updates. https://forum.xda-developers.com/showpost.php?p=82234015&pos...

Thanks for the heads-up. I guess I'll have to flee to a different ROM, then.

Yeah. I am using cdroid android v10(based on lineage). Last update was this month.

Running it for 2 years now.

I have lineage on my xiaomi.

The bootloader is locked by default but if you ask for it to be unlocked they will do it. The process is intentionally manual to prevent hacking, but ultimately smooth.

Things might have changed since last year, but it hasn't been smooth at all for me.

Not only you need a Windows computer to unlock, but then it takes literally months to proceed and if you happen to do something that you're not told you should not do (like logging out or re-trying to unlock), the counter is reset and you have to wait even more. Plus the unlocking program on Windows randomly doesn't work and error messages are not helpful at all.

My Xiaomi is an impressive, nice and powerful phone that hasn't cost much. But it was so much pain to root that I won't probably ever buy a phone from them in the future.

On the Android One models, the unlock is just via settings + fastboot, like on Nexuses/Pixels

Yeah, my pihole would usually block something like 70% of what was a good number of requests from my Xiaomi overnight.

It's gross.

You should be using a custom rom.

Do they allow it? I was surprised the Huawei Mate 20 Pro, at the time a flagship phone on par with the Note 9 and others, actually had a locked bootloader.

It would've been a good opportunity to allow people to install whatever they want, to show that they're different than Samsung and other competitors, but no, they went and locked that down because of "safety". Mhmmm.

It's a little bit of an ordeal - you have to request a bootloader unlock and then wait two weeks. But doable.

I have a xiaomi rednote 8, how to block more privacy leaks?

I would never dream of using a Xiaomi phone without Lineage. Or Huawei. Or Samsung. Or any phone, actually.

I use this[1] hosts list that's designed to block almost all useless domains Xiaomi tries to contact. In addition to that list I manually blocked this domain[2] that Xiaomi only connects to on certain countries.

I'm using a Xiaomi with Android One and despite having opted out of analytics the phone still tries to connect to Xiaomi servers.

I've been considering installing LineageOS on it for some time but unlocking the bootloader unfortunately deletes everything I have installed or downloaded. I've never used the stock browser though, always Firefox.

[1] https://raw.githubusercontent.com/jerryn70/GoodbyeAds/master...

[2] app.chat.global.xiaomi.net

Google accusing apple of "Selling privacy as a luxury good", well, isn't it? Clearly, if you don't want to be spied on you're going to have to pay a premium.

The profit from your data offsets the cost of the hardware.

If they're not selling your data, then you get to pay full price for the phone. Not a crazy idea, really, but I wish that was made clearer.

Yet Apple ecosystem is an insane walled garden and you don't really own your hardware, because you can't even run applications not downloaded from the app store.

Just following the surveillance model pioneered by Google, Facebook etc. I'm glad tech surveillance is being covered and some awareness and opposition is visible here. Xiaomi aren't the only ones taking a mile of advantage from the inch of 'good telemetry' promoted by some companies.

Are there going to be legal consequences for this?

I would expect this to carry the heaviest penalties possible including massive penalties against China if they fail to enforce them, but I guess nothing is going to happen given the current state of society.

“It’s a lot worse than any of the mainstream browsers I have seen,”

It's a lot worse than Chrome ?

The Xiaomi browser tracks your browsing. The Google browser in combination with the most of the sites in the internet track your browsing, your location, and a lot of other things.

Choosing the lesser evil is quite popular now days, and it's obvious which one it is.

> it's obvious which one it is.

Indeed: it's Firefox.

Firefox does a lot of phone home stuff too. (Not like chrome's built-in tracking)

That argument only makes sense if they're mutually exclusive. Opting out of Chrome in favor of Xiaomi browser doesn't magically remove all the google tracking throughout the internet (unless it has integrated adblocker, which it doesn't seem to have). So really, the choices are Google vs Google + Xiaomi.

Chrome steers you into logging into your Google account for improved tracking. Android Chrome already has this info via OS integration.

I'd much rather be tracked by Google than CPC

> Choosing the lesser evil is quite popular now days, and it's obvious which one it is

Safari?

i didn't know for sure that such things would happen but expected it. one of the reasons i'm on an iphone for 2+ years. i've got zero trust in chinese manufacturers, in my mind they're just extensions of the CCP.

Same. I found this wiki page with a list of smartphone manufacturers by Country.

https://en.m.wikipedia.org/wiki/List_of_mobile_phone_brands_...

I’ve visited Taiwan for work quite a few times and met with some of the big tech manufacturers. Very professional teams of engineers and a beautiful country.

It would be super interesting if a Taiwanese manufacturer developed a smartphone + ecosystem whose selling point was no spyware and openness, at the price point of the Chinese manufacturers.

How much influence does China have over Taiwan? Can they completely decline any malicious orders?

> How much influence does China have over Taiwan?

Right now their only influence is financial, which Taiwan work pretty hard to resist where possible.

We need legislation that triggers automatic import bans when malfeasance of this magnitude is discovered. The only way to stop companies from doing this is financial disembowelment. Anything less just becomes the cost of doing business.

Anyone thought that they don't?! Cmon, they sell nice smartphones for 80-100$, why would they do that? They have built-in ads, so they probably study our behavior to send more relevant ads and make more proper contracts for advertisements.

Does this also happen with Android One phones?

I would love to know that too

So if you do not use preinstalled Xiaomi software, you are mostly OK? (until they start stealing Firefox browsing history)

Having a Xiaomi phone myself there's a trade-off between using the official ROM, that provides full device encryption and SE Linux enforcement, but tracks what you do in settings, and unofficial LineageOS (PHH GSI), that does not encrypt the device data and has SE Linux off on most Xiaomi phones, I ended up sticking with MIUI.

Why would you even consider using a Chinese phone? We wouldn't use a North Korean phone, so why do we treat China differently?

Why is it surprising that proprietary software, especially from China, would steal your data? The incentive is pretty clear.

Wait, people still use stock MIUI after they bought Xiaomi phone? It was nick named ADUI after all.

...by purchasing a license to use our phone, you (the user) consent to send all data about about your use of our phone while using our phone that you have been granted a license to use by us

Serious question: How is this different from what google is doing?

Ag no man ! Xiaomi is my fav android phone brand.

https://archive.md/rhr59

Much better to pay the Apple tax than to have to worry about this kind of stuff to save a couple bucks.

Yes, that extra margin is the reason Apple doesn't have to stoop to some of the practices of companies on much slimmer margins.

It was only a matter of time before forign companies followed Google and Microsoft's lead and started slurping user data. Expecting any other outcome would be nothing short of delusional.

Screw Xiaomi and screw Google and Microsoft.

This is old news. Just run Lumen on any Xiaomi device and see for yourself.

The fucking huevos on Forbes to publish this article alongside the most godawful CCPA opt-out flow I've seen yet...

Clicking the "do not sell my info" link takes you to a page where it asks you for your personal information to request to opt out... with the fine print telling you that you can actually opt out by going back to the previous dialog, selecting more info, then selecting one of the three cookie sections (which is not labeled "do not sell my info" or anything similar). There's then a timer where it takes about a minute to update the cookie preferences.

I know Forbes has turned into a glorified blogging site for "journalists" these days but come on. Talking about privacy and misleading information on the same site that makes you jump through hoops to remain anonymous while browsing? Pot calling the kettle black much.

If you are a native English speaker kudos for writing "huevos" and not "Cahones" or other of its similar cringy misspellings. But 90% chance you are from the south cone so carry on.

https://www.merriam-webster.com/dictionary/cojones ?

To be fair, they both appear on the wikipedia page for Spanish profanity[0].

[0] https://en.wikipedia.org/wiki/Spanish_profanity#References_t...

You misunderstood, it is not the word "cojones" I was mocking, just the hilarious misspeling some people use, I have seen "Cohones","Cahones", "Koojonehs" and so on

my brain's classifier would predict upon hearing just huevos => mexican spanish. i'd imagine southern cone speakers would say pelotas, but might be way off here.

That's pretty much spot on (more generally, I think it's a Central-American thing). Either "pelotas" or "bolas" are the common ones in South America (huevos is present, but rarely used in the same way—"huevón" is the classic insult used throughout).

Not at all. Huevos is the preferred term in Argentina/Uruguay.

Interesting. My dad is Uruguayan and I have not heard him use it (perhaps a biased sample?). I’m Venezuelan, for context, so it may explain this view :)

Venezolano y nunca ha oido un argentino decir "ponga huevo" "dejame de romper los huevos" ay chamo te van a quitar la cedula, Maduro, pero si tu viejo es yorugua capaz alla usan mas pelotas entonces.

I disagree.

Not necessarily Mexican: I'm from Spain, and we use huevos (as well as pelotas and cojones). In the context of this post, I would probably use huevos: "qué huevos tiene Forbes publicando este artículo cuando (...)" would be perfectly idiomatic Spanish from Spain.

So what do you suggest? That no journalist can cover these issues if their employer doesn't meet some minimum level of privacy respecting behavior? You could say it's hypocrisy, but on whose part I'm not sure. Surely not the author. Is it on Forbes' part for not blocking publication?

Just not sure the point in alleging that the publication (or investigation?) somehow took a lot of guts or whatever.

Forbes isn't installing tracking software on every site you visit. They're monetizing to the nth degree visitors to the own site. And if we want to do what-about-isms I just don't know how we have a conversation without starting at FB and Google.

Maybe I'm paranoid, but your comment strikes me as exactly the kind of thing I'd write if I was Xiaomi. Also I just don't think it helps the cause of privacy to discourage these kinds of investigations by any publication, regardless of their own track record.

I think you misunderstand qppo. Their main point is noting the privacy-exploiting dark patterns of the forbes website. This point is a relevant response to OP because it is about privacy.

https://archive.md/rhr59

> The fucking huevos on Forbes to publish this article alongside the most godawful CCPA opt-out flow I've seen yet...

At least they aren't peddling malware anymore.

https://www.engadget.com/2016-01-08-you-say-advertising-i-sa...

> Pot calling the kettle black much.

Do you expect any better from authoritarian/authoritative sources? Welcome to the wonderful world of hypocrisy.

Don't use Xiaomi, Huawei or other Chinese smart phone brands if you don't want to your information collected by those Chinese companies and the CCP.

That being said Google, Apple and other American companies collect your information too, maybe not as bad, just maybe.

We really need good free and open source OS options for smart phones. Like the GNU/Linux options available on desktops.

> That being said Google, Apple and other American companies collect your information too

Can you point to examples of Apple collecting your browsing behavior or other similar data?

My Pinephone UBPorts edition is on order: https://store.pine64.org/?product=pinephone-community-editio... . I expect it will be quite a bit unrefined initially but I hope to give it a fair try and contribute if possible.

Off-handedly casting Google and Apple in the same lot with CPC sponsored phone companies is absurd.

Maybe so, but you're not making much of an argument of it.

I will not be baited into distinguishing between the two. As noted, saying they are the same on its face. If you believe they are the same/similar, I encourage you to write an article about it and post it for a discussion here on HN. If you let me know, I’ll happily respond there. Otherwise, I will assume you agree with me.

For those more expert than I, is Apple any better in this regard?

If not, which mobile is ideal?

> is Apple any better in this regard

Yes

> For those more expert than I, is Apple any better in this regard?

Yes, and unequivocally so. Apple is not know to track browsing behavior, search terms, etc. Most of the data that your phone collects about you either remains in your phone (that’s why they’ve been shipping with NPUs for several years - they do A lot of machine learning in device rather than in-cloud) or is analyzed using differential privacy mechanisms.

The amount of data that Apple refuses to collect in Apple Maps for example is astounding. Start and end points of any journey are not used for example. Your trip is broken up into a bunch of segments, and only the middle ones are analyzed for traffic pattern, and even then only after being anonymized.

And most of the details behind all of this are published in a well written and frequently updated privacy whitepapers.

[1] https://www.apple.com/privacy/features/

You ignored iCloud though, which isn't E2E reencode and uploads personal photos, contacts, location and some other data to Apple. They can decrypt this data and regularly share it with the governments.

So your post is kinda misleading when you leave these details out - it creates a false sense of safety.

(And before someone complains: Yes, Apple is infinitely better at privacy than Xiaomi. We still shouldn't hide privacy risks though.)

However, there is an elephant in the room - any Xiaomi device can unlock its bootloader, and the flash an open firmware, like LOS. This instantly makes it much better than Apple phones or any phones on the market - you can even ignore google software. With Apple you cant even run apps that haven't gotten through Apple censors, and the closest you can get to owning your hardware is "jailbreaking" it.

a) iCloud doesn’t upload location data, b) it’s completely optional, and c) I was answering a question, not giving a dissertation on Apple’s privacy practices (which I fairly well actually qualified to do).

I think they call it backup.

This is surprising? I thought this was a feature.

>I thought this was a feature.

???

In what way does this benefit the user?

Improved user experience. /s

As opposed to ?

So... the browser on Xiaomi phones is doing what the other browsers have been doing for years?

The horror!

> One message was clear to the researcher: when you’re listening, Xiaomi is listening, too.

So does one or more of: Google, Facebook, Samsung, Apple, Amazon

Many comments here boil down to “if you want privacy, buy an iPhone.” While true, this is another exhibit of privacy now being only for people who can afford it.

>While true

Is it? I never understood the reasoning. What makes you think Apple is better than Xiaomi/Samsung/Google/whatever?

Maybe I should qualify that with, “outside of China.” If you’re using Apple phones in China, you should assume your data are available to the CCP.

Otherwise, I have yet to see any evidence or indication that Apple collects data in a manner similar to what’s described in this article.

So basically Apple only protects you when they think they won't loose too much? No thanks, I'll take LineageOS + microG every day.

As Apple & Samsung(an ally) falls in slow motion behind Huawei soon behind Xiaomi, Oppo, Vivo - Chinese intelligence gets a strong advantage against US Intelligence in backdooring. So I think beyond the occasional bashing of Lenovo, Huawei, now Xiaomi we shall see more fight going on and same should be happening in Chinese press too.

- https://www.gsmarena.com/counterpoint_smartphone_sales_in_q1...

The draconian smartphone (as a a backdoor & tracking device) beloved by the intelligence officers are now an area of a bitter fight.

This is a good point. Much of ~Google’s service~ the internet is “free” because you pay for it with personal information.

I'm sure they won't be able to deanonymize the data at the government's behest.

I know apple keeps on getting headlines for breaking privacy (and also making phones that supposedly get thrown away because they don't have right to repair)

My own sense is android phones are MUCH less private and secure AND have much shorter useful lives.

But maybe easier to load a custom rom?

> I know apple keeps on getting headlines for breaking privacy

Seems like they're mostly in the news for the exact opposite.

Google has been doing this for like a decade, and we've known 5-Eyes has been collecting this data from them for like a decade. So I guess the news is that China is late to the party.

How does Windows 10 compare? It also tracks and reports which websites you visit, but maybe it doesn't in private browsing mode?

Edit: People asking for sources, go to Settings -> Diagnostics & Feedback. See the part where it says "Send ... info about websites you browse"? You might also be interested in the setting below it; when you enable it "Microsoft will collect samples of the content you type"[1].

[1] https://support.microsoft.com/en-us/help/4468236/

Source?

Citation needed. The device telemetry does not include browsing history.

Citation needed. Microsoft's documentation says it includes "information about the websites you browse".

It also says that "data items collected in Windows diagnostics are subject to change to give Microsoft flexibility to collect the data needed", so even if they aren't collecting that data today, they reserve the right to take whatever they want whenever they feel like it.

Before you go shaming those bad, bad Chinese companies, imagine my surprise when I restored my Apple iPhone from iCloud only to find my (always set to private!) Safari back there with every tab I ever opened.

It's entirely possible to implement that behavior in a privacy preserving way. Just encrypt "sensitive" data with a key that's stored on the secure element. That way if you restore to the same device, you get everything back. Sadly, I don't feel like wiping my phone to test this out, so whether Apple actually does that is an open question at this point.

Your backup is encrypted https://support.apple.com/en-us/HT202303

That chart from Apple is quite misleading. Apple abandoned full strong encryption for iCloud data, apparently due to pressure from the US Government. https://9to5mac.com/2020/01/21/apple-reportedly-abandoned-en...

Only the things under "End-to-end encrypted data" are actually encrypted in a meaningful way - everything else just sits on servers that use disk encryption, but that fails to defend from 99% of realistic attack scenarios.

A lot of content - including photos (which I used to use to take pictures of sensitive personal data, like ID cards) - is not meaningfully encrypted.

Thankfully, Safari tab data is actually encrypted as of iOS 13.

While Apple has done a good job of protecting user privacy compared to the alternatives, they still have a lot of work to do before we can accurately say things like "iCloud backups are encrypted".

I sincerely doubt the veracity of your claim.

Apple keeps private browsing tabs open until you close them - I think.

Reply on news.ycombinator.com