Hacker News Reader

Comment by schoolornot | Hacker News Reader

I recently wiped my factory-unlocked Samsung S20, enabled debug mode, and ran "pm list packages" over ADB. The results were beyond startling. There were close to 100 packages running under com.samsung and other various namespaces with tons of sensitive permissions. Most of these processes I could not identify what they existed for. And I still can't figure out why a freshly wiped unlocked phone w/ a Sprint SIM is running a Verizon provisioning process.

I do not trust any of these Android manufacturers to do right by people. Even the Pixel phones have a "Support" application that has camera permissions -- which last I checked, couldn't be changed regardless of whether you need support or not. What's going to happen when some obscure team within Google pushes an update to this app to do something without user approval?

View on HN

> And I still can't figure out why a freshly wiped unlocked phone w/ a Sprint SIM is running a Verizon provisioning process.

Samsung has a rather "interesting" (to say the least) firmware development process (if you can call it a process). It seems that most handsets certainly used to ship with if-gated Verizon specific hacks all over the firmwares, regardless of market the device was for. I believe this was just for simplicity's sake. It sounds like nothing has changed there.

As much as Samsung loves to advertise enterprise security like Knox, it only takes a few minutes of digging through the history of Knox to see some blunders from the early days, like storing the plaintext Knox PIN, to really wonder how on earth they can secure it.

Call me old fashioned, but I just don't have any confidence in the development practices of any phone vendor these days - even plain pure AOSP Android has so many external library dependencies, each of which is receiving CVEs and patches regularly (hopefully), and needs to be kept updated by AOSP maintainers.

I used to track the ancient kernel CVEs that were being rediscovered in Android due to poor or non existent source code control in OEM kernels. I gave up as it was pretty much a flood of 2 or 3 year old bugs being rediscovered as unlatched on Android or Qualcomm kernels.

I get a very uneasy feeling using Samsung's products because their privacy record is atrocious, they cram ads everywhere on flagship devices and the quality of their software is just mediocre.

Unfortunately, Android has emerged as the tracking and advertising platform. Look at every single Android TV on the market, they're privacy-invading garbage and such practices are explicitly enabled and encouraged by Google.

This is why I root my device and only allow apps I trust internet access.

Doesn't that permanently disable some features on Samsung? I read they use a goddamn eFuse for it

I am using a Google Pixel device. I have no idea whether Magisk works on Samsung phones.

Yup, IIRC that disables Knox features and secure folder permanently (trips an e-fuse so there's no turning back). I don't remember if Samsung also intentionally degraded camera quality like some other vendors (Sony at least used to once you unlocked your bootloader).

Root and then get flagged by Google's SafetyNet, preventing you from Netflix, banking apps etc? That's a brave but big sacrifice

Systemless root + root hiding is a thing.

I run a custom rom and pass safety check and have access to all my apps including banking.

This is why people need to start rejecting closed ecosystems. If you own the hardware you can control everything that happens on it including companies trying to force their will upon you

more people would reject them if there were alternatives, but the only things on the horizon are pinephone and purism (neither which are really shipping/working)

Any information on this. I thought rooting was essentially dead

I have an S5 with Magisk. It passes the safetynet checks, and I can choose to specifically hide root status from apps, which has worked well so far.

Google can turn Safetynet validation up or down w/o updating your Droid. Currently it is possible to bypass SafetyNet, but they did turn it up a notch lately, and if they require strong "Key Attention" then neither Magisk nor custom "rootless root" will work (and it will also mean that custom roms Will fail SafetyNet).

https://developer.android.com/training/articles/security-key...

Not with Magisk.

>Netflix

Hah. If properly paying for films requires you to install quasi-rootkits that spy 24/7 on your personal life, and pirating gives you a high-quality .mkv you can play anywhere you want, I damn fucking well know which one I'll choose. "Brave but big sacrifice"? That's just devaluing those words.

You forgot to add that your choice is damaging the innocent content creators.

Maybe those innocent content creators will think twice at contract renewal time, then.

Or just ... buy the DVD / other content type legally available?

And then you still need to “root” the DVD-player so you get to skip the commercials and legal threats...

Which is what I did for a long time, but now I don't even own a disc player...

The piracy is really incidental. No one who chose privacy over Netflix would suddenly reverse that choice if they couldn't pirate content. Especially given that we are talking about phones, does anyone find watching Netflix on their phone actually ideal?

Can SafetyNet calls be proxied to another unrooted phone?

I wonder if it is illegal under GDPR to include spying apps on phones without telling the user.

It most certainly is.

It is, there is no doubt about that.

The question of the GDPR is not whether it's illegal but whether anything is done to crack down on offenders. Facebook, Google and thousands of marketing/analytics/advertising companies are still around and are stalking users with total disregard of the GDPR, so that's a clear negative.

Would someone who is downvoting this be willing to explain why? Because I have the same impression (that many GDPR rules are simply being ignored because enforcement is lacking).

The typical response I get to such comments is that Google did get fined 50M once in France. The problem is that not only is it pocket money to them but Google continues to violate people's privacy (Google Analytics still tries to stalk me everywhere without asking for consent first).

When it comes to Facebook I am not aware of any investigation or enforcement action being taken despite them being even worse than Google when it comes to privacy and having proven their malicious intent and complete disregard for the privacy multiple times.

Well you can get rid of Google analytics, you just have to install their Opt-out Google Analytics browser extension and fill in some data. I really wish the EU actually did something worthwhile with the GDPR.

The point of the GDPR is that you don’t have to opt-out, you have to opt-in if you are happy with tracking.

It seems there has been more activity since then, see here https://www.enforcementtracker.com/

Sort by amount fined.

There was a joke that the fastest reader in the world is a Romanian who read 54 pages of terms and conditions in 2 seconds. So... yeah, most likely the user has "agreed".

I work in GDPR-compliance related area in a multibillion UE corporation and I can say that right now, it's all a big joke. We have multiple huge violations and we don't do anything about it (partially because the law is so demanding that implementing it would be a massive effort). And yet, we don't get fined - partially probably because no one blew the whistle yet. I'm pretty sure the situation is very similar in all of our competitors. It seems to me that the lawyers who wrote GDPR might have been out of touch with realities of large and old companies and now the preference on regulators side might not to just not enforce the more bonkers parts of the bill? Interesting how it will play out over the next 5-10 years.

> I wonder if it is illegal under GDPR to include spying apps on phones without telling the user.

It is illegal but it is not enforced.

Reply on news.ycombinator.com