Hacker News Reader

Comment by linker3000 | Hacker News Reader

My new washer-dryer (not as much fun as the telephone) has bluetooth ,and I can monitor and control it with an app ('Homewhiz')..

...that connects to a cloud server 'somewhere'.

...for which the app suppliers want: my location and access to my microphone, camera and contacts - and the app won't install or run if you start denying access.

Nope, not happening.

I wish I was more of a hacker/programmer because I'd like to do some protocol sniffing and create a connector for Node-Red so that I could link the appliance to my home automation system without becoming a personal data asset for the manufacturer.

View on HN

Are you aware you're commenting on a nostalgic bluetooth kids phone which pairs to your mobile phone in the same way a headset does?

Yep. My comment was more along the lines of 'connectivity can be fun/useful, but sometimes there's a privacy trade-off'.

I'd consider myself 'aware' rather than 'paranoid', but if we extrapolate for a minute....Some function or app on the phone (or distant cloud service) can recognise the MAC address of the Fisher price phone's bluetooth PHY and, coupled with GPS info, we have a location where there's possibly a young child (or an older one in their home office!). Maybe, worse case, your targeted ads contain more children's toys.

Some function or app on the phone (or distant cloud service) can recognise the MAC address of the Fisher price phone's bluetooth PHY

That’s not how MAC addresses work. Once a packet crosses a router, the packet appears to come from the MAC address of the router.

So for example a web site you connect to has no idea what your MAC address is.

> So for example a web site you connect to has no idea what your MAC address is.

...unless you (or the app you're running) tells it.

Exactly.

Well, I'd disagree with the first statement having worked with IPX/SPX ;-)

But, yeah, you're not wrong for IP networking - however, an app on the phone could forward the MAC address of the bluetooth connected device.

Regular apps can't typically access the MAC address of the connected device. Additionally, with BLE (& Bluetooth 5?) the MAC address is required to rotate regularly as part of the spec (IIRC even while connected but certainly the broadcast address).

BLE has a privacy feature that enables MAC address rotation, but it isn't a requirement. Apple products and Android phones use the privacy feature, but other than that most products don't. The possibility of tracking someone via the MAC address of their Bluetooth devices is very real.

But you are correct that regular apps can't address the MAC address of connected Bluetooth devices, so the tracking vulnerability that OP is suggesting isn't really possible.

Bluetooth uses MAC addresses too, so this still applies.

And no one farther than 30 feet from you will see your Bluetooth hardware address.

Yeah, but someone in your home might have a rogue phone app installed (or not even that, I bet companies like Xiaomi already so this with their smart home stuff) that scans bluetooth devices and sends the addresses so that they can be data mined.

So can you dial out on the toy? Or can you only dial out on the mobile device that the toy phone connects to?

The description seems to say that you can dial out on the toy, but it connects via Bluetooth to the mobile device to do so:

"Connects to your mobile device with Bluetooth® wireless technology to make and receive calls through your existing phone plan—no additional line required (Compatible with IOS and Android™ devices)"

Other than it making horrible noises, is there anything you’d want less on a kids toy?

Calling random people doesn’t seem like something that’s a good idea.

It isn’t for kids. It says so right on the page.

I’ve just re-read it and can’t see that it does. Reading it with that in mind however makes it obviously correct.

The closest I could find to it saying that was the customer questions, one of which was answered with, “This one is intended for adult collectors.”

Phones should have fake permissions for this kind of thing. Suuure you can read my SMS. Oh, I never get any SMS? Well that's how it is. Mine my contact info? Oh, look at that, I have no friends.

What's stopping them from just complaining when you have no SMS or contacts? They would just show a new dialog saying "Give us the real permissions".

Yeah but that’s a legitimate GFY situation where you would infuriately delete the application.

Assuming it's a built-in iOS/Android feature, hopefully app review would catch apps trying to circumvent the fake permissions, and the risk of blocking real users would probably discourage them (I almost never use SMS unless it's for a verification code, and I have no reason to keep those messages).

Then you get an app that can generate fakes. Seems very fun to make

iOS has this with the photo album permission at least. You can select to only reveal a select subset of your photos to an app. I assume Android has something similar.

Someone had that in the early days of Android. If you denied an app access to your contact list, the app saw a list of fake contacts.

I would hope this is just using bluetooth headset profile, and doesn't require anything like that. It really doesn't need anything else with the feature set as described.

From the product page: "a phone smart enough not to come with any apps". Sure looks like it's a plain BT headset.

Can I use it as my office phone?

Just have it on your desk paired with your cell. Would work fine I think :)

My Cisco 8851 has Bluetooth and supports headsets. I'll be using this with it.

> I wish I was more of a hacker/programmer because I'd like to do some protocol sniffing and create a connector for Node-Red so that I could link the appliance to my home automation system without becoming a personal data asset for the manufacturer.

You may find this post (https://ptx2.net/posts/unbricking-a-bike-with-a-raspberry-pi...) inspirational.

Without knowing the App, but the location permission could be required for Bluetooth 4.X LE to work. That still doesn't justify why a dryer needs your phonebook.

Yes you need Allow Location Permissions for your App to use Bluetooth on both iOS and Android :$

> for which the app suppliers want: my location and access to my microphone, camera and contacts - and the app won't install or run if you start denying access

Could these things be virtualized? And provide a fixed location, silent sound, and an empty contact list to whatever applications you don't trust?

Yes, if you run an android version with root there are frameworks for doing this. That said, some apps detect when things are too static and won't necessarily work even with these workarounds.

This should be built into the operating system. Didn't Android (or maybe it was iOS) add a feature recently where you can set your camera to be a black screen unless you explicitly give permission to the app even if you gave permission to the app earlier?

> This should be built into the operating system

I agree, but I doubt it will happen. It was already a battle to get the permissions in android as fine-grained as they are. Even though they are fine-grained now, the permissions don't mean anything when every app demands that you give it everything it asks for (even though it clearly does not need them to work).

Oh, fake data generators it is, then.

You are not the first person with this problem - fortunately smart people figured a way to fake all these data but it requires additional effort.

Any pointers where to start?

https://github.com/M66B/XPrivacyLua

I haven't kept up with it, it needs a rooted phone and Xposed Framework, and some apps don't like that and stop working.

But in an older version of this app, you can set it to prompt you for any activity the app wants to do, e.g. read clipboard or phone status, where you can say "Allow/deny always, allow/deny for 10 minutes" etc.

If you are on Android, there are ways to give phones fake access to microphone, camera, contacts etc.

How?

Sorry, I forget the exact mechanism. If it helps: I last saw that possibility, when I was playing around with rooting and alternate Android images.

I might have used something like XPrivacy. https://github.com/M66B/XPrivacy

Why did you buy that washer and dryer? Surely there were non-"appified" versions available? You appear to hate the idea, but you just told that manufacturer that that's what you wanted.

> Surely there were non-"appified" versions available?

Ironically, those are probably more expensive. Privacy has become a commodity.

You've hit the nail on the head. Americans will do anything to save $1, and this is the future we deserve.

Can you use the machines without an app?

I'm perfectly happy using appliances like it's the pre-smartphone era but the moment using an app becomes _required_ is when I'll flip my shit

Reply on news.ycombinator.com