Hacker News Reader

Comment by pibaker | Hacker News Reader

Shits like this is what makes me wary about Chinese made video games proliferating in the west. You never know if your kid's genshing impact or black myth wukong is listening to you and siphoning all data on your local network to China.

A competent Western administration would have banned it all years ago. But instead of securing the future of Western civilization, they want detente and cheap plastic goods instead. Shrug.

View on HN

Epic Games partially owned by Tencent and already was caught of including spyware [0][1] in their launcher, but “Tim Sweeney is the anti-corporate robinhood who will dismantle hegemony of Valve and Apple” is very popular narrative on every western tech site

[0] https://news.ycombinator.com/item?id=19394399

[1] https://www.reddit.com/r/PhoenixPoint/comments/b0rxdq/epic_g...

>Epic Games partially owned by Tencent and already was caught of including spyware [0][1] in their launcher,

Your sources for that claim is a bit underwhelming, given that epic apparently (?) doesn't upload any information without explicit user consent.

It's even worse now with cheating creating the world of Kernel Level Anticheat (KLAC) who knows what they are doing! A dream for someone who wants to move laterally through a network, probe, etc.

The new Delta Force is made in China nowadays and apparently scans your whole hdd (for anti cheat).

Isn't that somewhat common in AC software?

Yes, it's a common feature of malware.

For security, yo.

It's the least convincing excuse used to circle around GDPR and similar laws. "I swear, it's for security! (please ignore the part in our ToS that says we can resell your HW configuration profile and installed software stats to our commercial partners)".

>please ignore the part in our ToS that says we can resell your HW configuration profile and installed software stats to our commercial partners

source?

I'm sick of corporations and bootlickers who claim you cannot do games without anticheats. Even if I am not personally running that software, all the users are still normalizing spying on our devices and networks.

If your business model relies on violating the privacy of others, your business deserves to die.

> You never know if your kid's genshing impact or black myth wukong is listening to you and siphoning all data on your local network to China.

Don't be ridiculous, all that garbage is VLAN'd off, and my router has strict firewall logging for any suspicious outbound traffic.

I'm sure I can trust my Chinese made router to handle this safely for me.

> is listening to you and siphoning all data on your local network to China.

How is it any different from western apps listening to you and siphoning all data on your local network to 3 letter agencies?

There's a massive difference between having a country spying on it's own citizen versus having an adversarial country doing it. The three-letter agencies would likely not be trying to sabotage or destroy their own country's economy and global standing for one.

As someone from the EU, could I not use the argument to argue that for me it's both an adversarial country?

It's concerning that someone from the EU is still asking this question. How is there any doubt left in you? Yes, of course both are adversarial countries, and shouldn't be treated all too differently. In the short-term, the US is the bigger threat, as they've shown they're much more willing to use the power they have to cut off access than China.

As someone from the US I would suggest viewing both as adversarial. I don't really trust my own government, but if I was born abroad I would trust them even less.

You absolutely can. We see a huge uproar in European enterprises against US software/vendors/etc. Many companies are halting their cloud migration because they are now worried that the current US government could decide to just pull the plug or something otherwise inane.

And to be fair only US is openly hostile to EU.

Both the US and China are openly hostile to domestic populations.

I see no harm if China use my data. But US companies are actually using my data against me.

It's still distasteful, but they aren't in a position to do me much direct harm, so there's that.

As someone from the EU, please do!

I don't know why you're being downvoted, the US has been way more belligerent towards the EU recently than China.

I beg you pardon.

We've got a live situation where three letter agencies are taking down their OWN country and citizens in its wake. Oh, and the alliances as well.

Sure, materially different.

Wouldn't having an adversarial country to be spying on you be the better option for you personally? At least privacy wise, not using your machine as some infiltration point, as the country you reside in has many more opportunities to abuse the data

ICE? DOJ? Hello?

Yet we have the current example of the United States.

> There's a massive difference between having a country spying on it's own citizen

Like CIA, NSA, FBI ? Of course there is a difference.

> The three-letter agencies would likely not be trying to sabotage or destroy their own country's economy and global standing for one.

I swear I'm not trying to be dense on purpose, but come on.

Unless _woosh_, in which case well played.

You're lucky if you truly live in a "Western" country where the throne isn't held by the enemy.

Like US saying EU is its adversary and spying on it? Trump had been pretty clear that he sees EU as a threat while China and Russia is not.

And don’t forget that ICE sees both non-citizens and citizens as the enemy if they don’t agree with Trump.

Yes, in the headlines the agencies playing adversaries to the common folk are definitely mainly chinese... /s

I hear this theory being claimed so much, but I don't see any real evidence for it; we have routers that you can monitor traffic on, we have microphone use indicators on mobile, and I would imagine it would be pretty clear if an app was uploading audio with even very basic monitoring tools. Correct me if I'm wrong, however.

I'm not denying that a lot of data is likely surreptitiously collected, but I'm talking microphone/camera in particular.

we have routers that you can monitor traffic on

Most traffic is encrypted with HTTPS unless you can root every single device you own

we have microphone use indicators on mobile, and I would imagine it would be pretty clear if an app was uploading audio with even very basic monitoring tools.

Complicated smartphone OS, firmware, drivers might have bugs allow overrides of visual indicators.

Companies have also been known to secretly eavesdrop and not tell users before (Apple + Siri https://www.courthousenews.com/judge-approves-95-million-app...)

>Most traffic is encrypted with HTTPS unless you can root every single device you own

>Complicated smartphone OS, firmware, drivers might have bugs allow overrides of visual indicators.

This line of thinking gets dangerously close to unfalsifiable territory.

If apps are eavesdropping on us, where's the network data? It's encrypted.

But you can disable https pinning by jailbreaking/rooting? The spying logic automatically disables if it detects it's jailbroken/rooted.

Where's the jailbreak/root detection logic? It's buried in 9 layers of obfuscation so you can't find it.

What about microphone indicator? They found a 0day in both Android and iOS, or the two are complicit as well.

But we don't see any backdoors in AOSP? It's built into the hardware/baseband itself.

>Companies have also been known to secretly eavesdrop and not tell users before (Apple + Siri https://www.courthousenews.com/judge-approves-95-million-app...)

"secretly eavesdrop" implies they were intentionally doing it, when even the plaintiffs admit it wasn't intentional.

That is fair. I do not think anyone could feasibly could detect/extract the exact data sent, because of HTTPS.

However I was more thinking of simple things, such as disabling anything that SHOULD be communicating with the Internet and seeing if any constant traffic persists.

Now of course, some very small (e.g plaintext) traffic might be almost undetectable, however that would suggest that most of the data would not be able to be transmitted due to size.

How confident or certain are you of what CSME or PSP or some code in TrustZone is doing? How certain are you that not a single piece of software on your machine, be it in the kernel, userland, drivers, is performing some type of surreptitious communication with CSME or PSP or program running in TrustZone?

Do you know for sure whether PSP or CSME has ever done DMA, or fingerprinted stack/heap allocation patterns and timing, or inspected the contents of your disk (after FDE was done being decrypted, of course), to evaluate whether common packet capture software is installed, or even whether it's currently running?

Detecting spyware is one thing. Detecting surreptitious nation-state spyware that behaves differently when it's being observed is a different challenge entirely.

In my case, I don't currently have any capture software on my main computer at all.

Our routers are Asus, and so I'm able to install tcpdump and log traffic directly without the source device itself knowing anything. This makes it really easy to monitor the traffic of any device, albeit not knowing exactly what it is being sent.

But it is true that I really can't know much more than what tcpdump shows.

Now, how confident are you of all of the above, but instead of for your computer, for your router?

I recall there were quite a few experiments where people use certain keywords heavily just to get closely related ads later on. I can totally relate my experience with it as well. Of course it is inconclusive - but if there is an incentive, management of big companies will venture into it. And chinese management is no different from western ones to that matter.

They don't pick the keywords uniformly randomly from a list of all keywords though. They think they randomly picked something that popped up in their mind, but those keywords are either

- stuff they saw online recently — ads or otherwise, which put the keywords in their mind

- or stuff they were already interested in recently

Not hard to imagine targeting algorithms picking up on either of these

As I tell my friends

You dont see those "coincidental" ads because your phone is listening to you, you see them because your freind showed interest in the product and theirs enough information to infer they talked to you about it. The good news is, your phone isn't listening to you without your consent. The bad news is, because it doesnt need to.

Are those your assumptions or something that have been tested?

It's been a while since I browsed anything without an ad blocker.

Do you still get ads for the exact thing you just bought for a week after buying it? :)

More than one thing can be bad at once.

>How is it any different from western apps listening to you and siphoning all data on your local network to 3 letter agencies?

Examples?

Google's Android, Apple's iOS, Microsoft Windows

That's not a source, just unsubstantiated assertions.

The difference is that the Chinese intelligence agencies abide by Chinese law and don't really pose any kind of threat to American citizens, while the American intelligence agencies engage in unconstitutional schemes (as ruled by a federal judge) to illegally spy on Americans and lie about it to both congress and the American people, murder American citizens, and can, at any moment they want, fabricate evidence to procure no-knock search warrants where a team of armed gunmen will throw flashbang grenades into the homes of journalists and political dissidents in the middle of the night before barging in with assault rifles.

And yet, for reasons that remain beyond me, many Americans remain more fearful of the former than that latter.

Perhaps because foreign governments with a known antagonistic stance would happily sell or hand over your data in order to cause large-scale economic instability via account attacks, political instability via fostering the prosecution of minority groups (as identified by said data)... get creative. Large-scale data on your enemy's citizenry is a new weapon in the modern arsenal, and we haven't seen anyone really try to use it yet, but I suspect the results when they do will be ugly.

Care to elaborate on "known antagonistic stance"? Is there any evidence that China has ever actually performed any of these types of attacks you're discussing?

"Get creative" might work well for fictional writing exercises, but is it such a sound strategy for assigning guilt? Surely you wouldn't like being prosecuted for crimes that someone "got creative" with in accusing you of, no?

No, because this particular attack is (as far as I know) a new concept, but in general, China being a major state sponsor of all sorts of large cyberattacks is very well-known (in security circles, at least) and has been extensively documented. The current likely scenario is that attacks would be performed against the US in the event that they tried to help defend Taiwan against Chinese invasion.

The consensus is usually "well the government only targets you when you probably deserve it" whereas china is spying on everyone regardless of your opinion of the actions of the current administration.

> The consensus is usually "well the government only targets you when you probably deserve it"

Not sure where you got that consensus from, it sounds made up to me or at least outdated as of Feb 2026, especially on HN.

To address your last paragraph - it’s not unlikely the latter use all powers to divert attention to the former as it conceals shenanigans of the latter

[citation needed]

Please stop with the hyperbole. Shit is bad enough; more fake news from any direction doesn’t help.

I am not sure where hyperbole is - if your believe it is "fake news", it's your choice.

Do chinese apps make use of all data they can access? Absolutely. Do western apps make use of all data they can access? Absolutely.

Both concepts are evil. Talking one is evil while dropping off the other is skew of discussion towards vilifying one side and omitting the subject.

China and Chinese companies flaunt every single law that at all hinders them, IP law being the typical example. The EU has the Privacy Shield agreement with the USA. Such an agreement with China would be effectively impossible, since even if it existed, they'd simply ignore it. People criticise Five Eyes, and for good reason, but it's existence at least means that intelligence agencies are willing to follow domestic law.

Not to mention the use of the word "Western", which is the kind of bullshit I could write a smaller book about.

> but it's existence at least means that intelligence agencies are willing to follow domestic law

Oh they break it alright whenever they please. And they have been caught handsomely.

This is why I don't mix work and play and have a dedicated machine for games, but this only solves half the problem. It really needs it's own VLAN or to use 'guest' wifi to keep it isolated, but that only solves half the remaining problem. Two easy steps to get to 75% solved, but still leaves a high-powered machine connected to the internet that could be abused, can still listen on bluetooth and enumerate wifi (precise geolocation), and so on. At least this way it's only online for a few hours a day at most. It's the most I can do without investing serious time trying to block state-level intrusion in a battle I can never win.

But non-chinese game listening and siphoning all your data is ok.

> A competent Western administration

...because they have done so well with X, Meta and etc doing exactly the same thing.

Reply on news.ycombinator.com