Hacker News Reader

Comment by cantrevealname | Hacker News Reader

Just wait till they:

- start encrypting all the data they collect (with real encryption, not base64 encoding)

- saving up the data for hours or days at time and sending it in bursts (so there is no immediate connection to a remote server)

- sending the data to plausible U.S.-registered domains (rather than to Singapore and Russia)

- monitoring at the kernel or firmware level so that it doesn't matter what browser or apps you use

- turning off data collection when it suspects a security researcher (due to signs of debuggers, development tools, network monitoring, usual network settings like to proxies or DNS, etc)

We won't be able to prove anything. So disheartening.

View on HN

Why would they go to all that trouble? Just 1. keep sending any and all data without any obfuscation 2. blanket denial of any wrong doing, regardless of how obvious 3. decent hardware for zero down on a contract

profit!!!

your way is so much more work...

Parents option would likely get around privacy regulations in some countries. So they can do the “much more work” you mentioned and also sell decent hardware for zero down on a contract, getting a bigger total market and more surveillance info.

Well the EU and Canada seem to be terrified of putting a foot wrong with the CPC, so my guess is that Chinese companies will violate people's privacy until it becomes so blatant that they get a polite request to tone it down (and obfuscate the collection).

The EU is not terrified, it (or rather, the local politicians) is corrupt; the politicians are willing to go as far as kissing the Chinese flag but that does not say anything about us, the citizens.

This brand of sharp minded and well sourced political analysis is what I appreciate about HN. The good thing is, I keep seeing more and more of it.

You expect a URL for every word written? The stories showing how everyone in the West bends in order not to anger CPC are out there and well known. You can't have a recap of human history in every comment.

HN comments aren't scientific papers. While (good) references will strengthen any argument and are welcome, I find opinions here valuable even when sources are not immediately available. You can always do your own research and paste links confirming/rejecting any statement if you so desire.

Americans are not?

Look at how they bent the knee with Huawei and ZTE. Also can’t figure out how to produce hardware in their home soil, as much as they’d like to.

oh we can most definitely manufacture a phone, but since we don’t have slave labor and questionable human rights it costs us more to do so.

Automation seems like the answer. Surprised it hasn't come to that already.

Hand-labor today is used as an interim solution, when the scale doesn't justify bespoke automated assembly line. When factories are 'brought back' to the West, its because they scaled up and automation is now affordable.

I think that comes down to cost of work vs. fines at that point and which would cost more. If the fines are cheaper they may just opt for them.

Agree. Sadly this business mentality is global one (not only limited to China). "Doing wrong is ok, ideally it's more profitable". The cost of doing ethical business appears to be higher and that cost has to be passed on to the consumer it seems consumers as a whole tend to care more about low price than ethics or privacy. Because there is little or no value attributed to ethics / privacy.

Plausible deniability. They can turn around and say it's racism. It's their (and the Russian) MO. As long as there's no absolutely clear, unmistakable evidence, they can spin spin spin and too many people will buy their bullshit. It also provides a cover for politicians to not do anything. I see it here and elsewhere. People jumping to China's defense at every opportunity even though they deserve zero trust.

With some fleshing out, this is an excellent rendition of the { DRM, malware, spyware } evolutionary path, pretty close to what was described to me by RealNetworks back in the dotcom era.

Need to add anti-reverse-engineering techniques - obfuscation, self-modifying code, custom and hard to reason about embedded VMs, etc. other than anti-debugger and test harness detection. I think earlier on.

I thought it went: DRM, spyware, then co-opted for malware by others.

Unfortunately I tend to think RM Stallman is right - smartphones are a prison with tracking enabled. We're all foolish to yield that much power to vendors.

Most software on the smartphones aren't under our control, we aren't able to stop them, disable them, inspect them, or see the source code.

I think we should undo everything done in the smartphone since 2008 and come up with a true open source smartphone.

The vast majority of people do not understand why this might be needed and even many of those who understand do not really believe or see it as a problem (or even see it as a benefit if they are profiting from it). Some even consider it as a good thing because it is presented as "security" and for many anything that could be secure in theory is enough to make them shut down their brains and try to see the negative sides.

To make what you mention work, that smartphone will not only need to be open source, but also be much better in both UX and features and cheaper than anything similar.

Purism is working on it. I think they're selling them now.

No idea if it is good just that it's happening.

Purism phones aren’t as polished as other phones, but it’s amazing that they exist. We need to support them until they get to version 2-3 and have everything slick and polished

You can still open the firmware update file in ghidra, cutter or ida pro.

But yeah the trend is troubling. I also believe that it's only a matter of time once the "smart" devices (fridges, TVs, etc) start shipping with 5G modules enabled that send data to the mothership whether you set up WiFi for them or not. Because while you can't buy non-smart TVs, many users don't enable smart features by not connecting them to the network. The 5G module will probably only exist for tracking purposes and maybe firmware updates, but not for the netflix/youtube app.

Until the chip prevents copying out the firmware…

Perhaps a counter trend will emerge from spyware appliances will emerge, where people will pay a premium for "dumb" TVs or fridges from privacy respecting manufacturers. I've read about people already trying to purchase display model/commercial versions of TVs, which doesn't have any unnecessary smart features. The attraction is avoiding unneeded bloat, presumably longevity, and of course, privacy.

There was an interesting discussion on HN recently regarding appliances that can handle open source firmware[1]. Several advantages I've found with open firmware include stability, security, avoiding unnecessary e-waste, you're not locked into a manufacturer that might discontinue support for the device, and privacy. If such appliances existed, I would certainly consider them when purchasing an appliance.

[1] https://news.ycombinator.com/item?id=23001017

> due to signs of debuggers, development tools, network monitoring, usual network settings like to proxies or DNS, etc

Then that's your counter measure... run a debugger 24/7.

I know I am being naive, but what I can do? A normal used that is wants privacy?

I expected some Volkswagen like defeat device to in phones to evade security audit.

But what can "I" do, considering that the bodies & Govt that are suppose to do something are busy stuffing their own pockets and busy with petty politics.

Open-source hardware progress is very slow and low RAM. How safe will I be if I just run LineageOS on a Xiaomi device?

As a normal user who wants privacy, you'll be just fine with LineageOS on Xiaomi. Assuming you don't install spyware later. You don't even have to install Google apps (see f-droid and Aurora store).

I wonder how many devices already do this.

> I wonder how many devices already do this.

All Android phones. But they send the data to google and facebook so they must be good.

Source needed. The amount in the article is staggering compared to what Google claims to collect which is in line with the (admittedly not definitive) DNS query logs I monitor every now and then. Also, much of it (e.g. location) can be disabled and there are Android phones that are entirely free of Google and Facebook.

I do know for a fact that Android contacts querries Google severs to pull data from Google services, like YouTube, to fill in extra contact details on the phone.

Knowing what Google's business is, I doubt they don't merge that data for a more complete profile.

You can try this yourself: Create a YouTube account, upload a picture for the account, don't add details like a phone number.

Now create a contact on Android, add a phone number (as most people do with contacts on their phone) and add the email address you registered the YouTube account, the Android contacts app will pull the profile picture from the YouTube account, and put it on the phone as the picture for the contact.

Gave me quite a little scare when I discovered this by seeing my YouTube profile picture as the contact picture on a (rather privacy and tech-illiterate) friend's Android phone, even tho I never added any phone number to any of my Google accounts, all he did was add my email address to the contact.

Unfortunately I can't easily test this as my phone doesn't have the Google Contacts app and I sync my contacts with a CardDAV server, not my Google account.

As I said elsewhere on this page, Google Play gets an update from your phone every 2 minutes 24/7 with a lot of privacy settings enabled. Turn on a firewall, I think it was disconnect that showed me this

The content of these updates is what is potentially concerning. Considering how much Play Services now handles, regular updates aren't that surprising, and like I said Android ≠ Google so this doesn't apply to all Android phones. The mechanism described in the article sent every visited URL in the browser and opened app or settings menu on the phone to Xiaomi.

I ran a firewall on my Android once. It blocked a request to google play services every 2 minutes, 24/7. I use an iPhone now and really want a librem

Yeah, it would be indistinguishable from what Google does. Oh, wait...

OTOH Xiaomi also sent out dev devices to custom rom developers. Well technically it's Poco the Xiaomi subsidiary[1]

Is there any word on whether that is true for european region phones as well? From what I remember they disabled certain functionality like Face Unlock in the EU. Not sure if it was due to privacy or patents, but given the GDPR I wouldn't be surprised if it was due to privacy.

[1]: https://www.xda-developers.com/poco-x2-custom-rom-kernel-dev...

Oh! That explains why my F1 has such good ROM support, it was a major reason for buying it (another one is cheap replacement parts).

They still disrespect ROM users: You have to go through a convoluted process involving Windows software and a Xiaomi account AND wait 3 days to unlock the phone - but that's way down from the 6 weeks I've read about on other Xiaomis, so you can be sure I'm not going to buy one of those.

the delay appears to be random. my first one was 3 days, my second was more than a week until just a day before the person that i wanted to give the phone to was leaving.

The worse part is requiring a SIM card on the phone the whole time, hoovering your IMEI and phone number in the process.

When a new guy on the team refers to base64 encoding as encryption. /me - oh you must be new here?

Serious note - welcome to the future. Nothing is private anymore.

Excuse my naïveté, but who would actually work on such things? How can someone have such low moral standards to, day after day, build systems that secretly remove privacy from otherwise innocent people?

Money lowers moral standards.

lawyers?

“Money makes a man act funny” -Eminem.

I have had friends suddenly get very selfish when the chance to get even $10 is available. I had a regular at a retail job once who came in every day... he asked to borrow $1 once to help pay for something. To avoid paying it back, he never returned, likely walking an extra several km to the next nearest store of the type every day. For $1

Most people are just following orders at their job, where they've got bills to pay. Morals are not so important on the hierarchy of needs. It might not even be something that crosses those worker's minds because of a much different upbringing/education than yours.

Reply on news.ycombinator.com