Lithuanian government warns about secret censorship features in Xiaomi phones | Hacker News Reader

Lithuanian government warns about secret censorship features in Xiaomi phones

therecord.media

The context here is that Lithuania is in a protracted diplomatic crisis with China over the establishment of diplomatic offices in Taiwan

https://foreignpolicy.com/2021/09/07/lithuania-taiwan-china-...

Half the world is facing China's shenanigans. Lithuania is just less opportunistic. They still remember what happens when a powerful nation eyes your territory.

Yes, working for an Eastern European government it was nice to see strong push back in the region but especially from the Lithuanians who take strong stances against authoritarianism (e.g. they have also been strong supporters of Sviatlana Tsikhanouskaya against the Lukashenko regime). It is partially because they depend so heavily on American defense and know that they need to be totally behind the US' stance on everything and can't risk getting too close to China - the benefits are far outweighed by the risks.

You turn this as if it were and bad things and Lithuanian were searching for excuse to blame China. China is bullying not only Taiwan on a daily basis but also any other nations for any pretext. It's time for an international alliance to make China stop annoying the whole world.

not defending anyone, i m just explaining "why now"

>It's time for an international alliance to make China stop annoying the whole world

Wasn't TPP a trade agreement to reduce China's power in the Pacific? And the new administration in 2017 withdrew US from it on day one.

Every large country have some diplomatic issues with pretty much every other country. There are just too many things going on.

At which level is this happening? Is one safe if they install a Custom ROM and expunge Xiaomi's OS?

Per sibling comment https://news.ycombinator.com/item?id=28614443, just the OS level.

Censored phrases include:

1) Free Tibet 2) Long Live Taiwan Independence 3) Democratic Movement

and 446 others.

I wonder what are the others, though. For some reason they have been redacted out.

another one is "Al-Quaeda", all in Chinese though

Would be a wonderfully candid abstract of the Beijing regime’s priorities, wouldn’t it? Wonder if Ai Weiwei made the list?

Or it would be something unrelated at all, going against the document's agenda.

tldr;

- sends various analytics to google and xiaomi

- downloads "blacklist", which contain china-sensitive phrases. Actual filtering is fortunately disabled in EU. (I personally am not sure what filtering actually does. Decompiled code and the blacklist use "Ad" in naming a lot. So if to believe the naming, filtering is for advertisements)

- sends sms to xiaomi for number registration when using cloud. There is some EULA type text, which user must accept for this to happen. Text does mention sms sending there. After sending sms is deleted (user can not check what was sent), its content encrypted, saved in db and sent to xiaomi server.

edit: forgot the fact that blacklist filtering can be turned on by xiaomi at any moment.

> Decompiled code and the blacklist use "Ad" in naming a lot

It's a common tactic for spyware to use the term "Ad" and other terms that sounds innocuous at first glace. AdUps is a great example [1]

[1] https://www.slashgear.com/adups-chinese-spyware-still-on-and...

The “AD” name isn’t that far off. Chop the presentation off an advertisement framework… isn’t the tracking and C&C code already spyware?

The AdUps spyware constantly uploads all private messages, GPS locations and more from the Android device to a cloud server in China controlled by an unknown entity.

The unknown entity is not the operating system vendor and there is no opt-out.

It should be stated clearly and unequivocally that Xiaomi phones cannot be trusted. They have been known to track your usage of their devices and send it back to their servers, including what you see in incognito tabs of their bundled browser. To see your local files or downloads on your phone you need to accept a ToS and a Privacy Policy, because of course they're sending that information back to the mothership too. Do not fall for Xiaomi's low prices - you are paying with your data instead.

https://www.forbes.com/sites/thomasbrewster/2020/04/30/exclu...

like i 've said before, if it becomes a dillema, i prefer to be tracked by china than the US, because china has no leverage on my daily life, can't affect my finances, and i have no strong desire to live there

(i m not in the US , which matters a lot)

Really? But at least with the U.S. there is due process and some accountability. Who knows what China will own in the future and how much power they'll have. What if they buy your favorite airline and now don't want to let you use it because they have your data? What if they build up the 5G infrastructure across the world? I mean, today they might not have that much global reach (although I think just earlier this week they went after some random person who tweeted something negative about the CCP while living abroad) but what about in 20 or 30 years?

> Really? But at least with the U.S. there is due process and some accountability

For non-citizens ? Since when and what is it?

The most extreme example I can think of is extending the right of habeas corpus to challenge illegal detentions even of non-citizens on foreign territory (RE Bush/Guantanomo).

https://www.forbes.com/sites/danielfisher/2017/01/30/does-th...

"Foreign territory" to an extent and within very specific cases ( a US ran illegal detention center and US customs).

As a non-US citizen living in France, i have no rights under the US constitution because it has no jurisdiction over me. That doesn't stop the NSA though.

I wrote above to a similar example of extra-territorial government activities the US does but at least there can be domestic repercussions to such things (e.g. investigations, congressional hearings, etc.). I sincerely doubt such things happen in China. But as far as things like spying and the NSA in foreign countries... I think you're out of luck as is the rest of the world. Everyone is spying on everyone. I mean the Germans have been lambasting the US for doing so and then it broke recently they also bought from NSO Group! I would be shocked if the French weren't doing the exact same.

https://www.dw.com/en/german-police-secretly-bought-nso-pega...

>> But at least with the U.S. there is due process and some accountability

https://www.google.com/search?q=us+drone+strikes+2021

Yeah, I don't really want to argue this side because I think the drone strikes are reprehensible but in the U.S. there will likely be at a minimum internal investigations, quite possibly congressional hearings, etc. I doubt the same could be said if China did something similar.

It's not even a debate. Where are the triumvirate of Bush/Cheney/Rumsfeld after falsely starting a war and destabilising an entire region? It doesn't matter what the country stands for, it's what it does that counts.

Due process only applies to American citizens depending on how wealthy you are. The rest of us are sh* out of luck. Which was GP's point.

Biden murders a bunch of civilians then has the media cover it up to try and look tough after his Afganistan withdraw clusterfuck gets thirteen American soliders killed and you feel the need to go back over a decade to look for an example of evil US government.

Democrats live in a perpetual state of denial.

Agreed but `crateless` diverted the issue.

The experience of using Google to search in China is vastly different than the rest of the world, unless you rely on a VPN service. IIRC, VPN usage is illegal and is reserved for the more state-sponsored "privileged users".

> china has no leverage on my daily life

No leverage other than, you know, letting you have tons of products that it can update on a whim and monitor what you do, where you go, etc. The funds you gave them end up in Chinese taxes, or more, and that ends up as an absolute nightmare against your own country's best interests. How can you even try saying that's not leverage?

Don't seem too different from the other side. And which one should I prefer the one which just ended 20 year occupation in abysmal way. Or one that is currently and in close future focusing on areas near itself...

That data can be sold to anyone else around the world, or used to remotely mess with your life. You don’t have to physically be in the country where your data is compromised to experience bad effects. Data brokers don’t care where their customers are physically located as long as they have the cash.

This issue of our data being bought and sold is a big issue, but nation states and some of the big tech companies don't do it. They simply have other objectives.

It's the huge number of smaller companies (and your ISP probably) who we pay little attention to that are buying and selling your data, to the best of my knowledge.

I don't think we should be giving these smaller companies a pass, and I don't think we should accuse those aren't (currently) doing it of doing it - that makes it lose its' meaning.

Many governments most certainly do buy data and (not many but some) sell it too. Big tech buys a lot of data, but they primarily exploit it for their own profits rather than sell it, unless it's their primary business.

The mention of "China" above was in regards to data collected by a tech company in China anyway: Xiaomi.

You are right: I should have said sold, not 'bought and sold'. Thanks.

Alternatively, since the hardware is excellent, burn LineageOS on them (most of them are supported and stable).

To unlock the bootloader you still need a xiaomi account and to wait a week. Otherwise you can contact someone on reddit or telegram with EDL keys.

You can actually deny the permission popup every time and still use the application. As far as I've found, no actual data exchange happens if you do that. However, that does mean clicking the deny button every damn time you open one of the system apps.

Thay being said, I haven't found that many things that Xiaomi is sending to the cloud that Google isn't sending already. The calculator uses exchange rates, the file explorer had a whole bunch of cloud features as a core selling point and there's various antivirus and other such tooling built into most applications. With Google there's a single checkbox that says "I agree, upload everything", with Xiaomi there's popups for each app.

I don't trust Xiaomi but I haven't found any concrete evidence of the supposed data leaks as long as you turn off ALL the cloud stuff.

I don't use the built-in web browser because built-in web browsers have always been proven to be crap to me so I can't comment on that.

My pihole history is mostly filled with American trackers. The occasional MIUI URL gets filtered out, but I'm honestly not as worried about the data it's trying to submit.

I bought my phone when it was relatively new hoping that I'd receive official LineageOS support. That didn't work out, but so far I haven't had any trouble with MIUI to be honest. The data collection seems to be on par with the average American or Korean ROM, although that could be because it was sold in the EU area.

> As far as I've found, no actual data exchange happens if you do that.

What research have you done on the matter?

> I haven't found that many things that Xiaomi is sending to the cloud that Google isn't sending already.

Two people find you and take your wallet. One says your wallet was empty and the other says you can have it back if you just keep walking.

Both are just as evil.

> I don't trust Xiaomi but I haven't found any concrete evidence of the supposed data leaks as long as you turn off ALL the cloud stuff.

Oh yeah sure. That's great. Nothing stops Xiaomi from pushing an "update" to reset the settings. Or, like Apple, from pushing "new features" that are automatically turned on "for your convenience"

> What research have you done on the matter?

I've put a TLS intercepting proxy between my phone and the internet. Most traffic flows towards Google (either sync or analytics). I do it every now and then to see if any of the apps I recently installed contain any funny trackers.

> Both are just as evil.

But one of them is completely vilified by mainstream media while the other is vilified by tech nerds and politicians disliking search results that call out their racism.

Of course all of the stalking is bad, but there's no reason to call out any specific company here.

> Oh yeah sure. That's great. Nothing stops Xiaomi from pushing an "update" to reset the settings. Or, like Apple, from pushing "new features" that are automatically turned on "for your convenience"

I'll be pissed when that happens, but the annoyance with having to turn that shit off is worth the €400 I saved by going with a cheap Chinese phone. I don't make Silicon Valley money, that stuff counts.

Unfortunately Xiamo is producing on only smartphones, but a whole plethora of connected devices, from vacuum cleaners to security cameras. They literally own a surveillance army.

They've been quietly trying to enter the featurephone market as well with candybar styled phones with their own custom Android firmware: Qin 1s, F21 Pro, etc.

Although they're not specifically tailored for the American market, folks whom are looking to enter or are following the digital minimalism lifestyle have been snatching them off Aliexpress and making review content for them.

This is the only reasonable comment made in the top 30 I see here. The rest arguing pedantically about politics, why? China is censoring, don't trust and use their phones. It's this simple. Why must most of you build up political facades just to comment on bad phones? Start from only truth.

Reply on news.ycombinator.com