Comment by api | Hacker News Reader

Comment by api | Hacker News Reader

While this kind of foistware sucks, I'm also a bit dismayed by the seeming domain-specificity of peoples' privacy concerns.

Do a simple tracker on a desktop, and people freak out. But all you have to do is change the form factor and UI metaphor to mobile and people are absolutely fine with constant location tracking, ambient sound being uploaded to the cloud (SIRI, etc.), a camera and a microphone that can be activated by all kinds of apps while the device is in your pocket, and a constant 24/7 Internet connection. You could never even approach that level of invasiveness on a desktop or laptop.

A desktop/laptop is a computer. A smartphone is a computer. Why the different reaction?

I wonder if it's a generation gap thing. Older people tend to use mobile devices less than younger people. Are the younger generation this oblivious?

Same phenomenon holds by the way with regard to jailed devices. Way back when Microsoft tried to introduce something called "trusted computing," which was basically just code signing. Everyone flipped the hell out and they shelved it. But mobile devices can't run software that isn't tethered to their app stores, and everyone is totally fine with that. Different form factor, different universe?

It also seems related to brand. When you sign into Chrome with your Google ID, Google tracks everything you do. But that's Google, not some random little foistware company, so that's okay I guess. Same goes for Safari and iCloud, etc.

I would agree with you if this were only about adware. The problem is that the adware opens a massive security hole that is exploitable by everybody.

The Lenovo adware wants to hijack SSL connections. To do so, it installs its own CA, and the private key for that CA can be (and has been) extracted. This means that if you own such a laptop and access your bank's SSL website from a random coffee shop, anybody could MitM you, since they can use the publically available "private" key of the rogue CA to impersonate your bank.

Smart phones enable turn-key surveillance-based dictatorships beyond anything we've ever seen in the west, but unlike this Lenovo thing, it is not an immediate threat. Hence people react differently to it.

> ambient sound being uploaded to the cloud (SIRI, etc.)

To the best of my understanding, Siri doesn't do this. Siri listens, locally and on-device, for the hot phrase. (I know that the Moto X does that for 'Okay, Google Now'.)

Anyway, to the other points: I get something for providing information to Google. My location isn't terribly important to me and the benefits outweigh the risk. Ditto an online internet connection. My phones, iPhone and Android alike, both run whatever software I want--Cydia was the first thing I installed on my iPhone and Android accepts applications without qualm. (And I don't use applications that can turn the camera or microphone on without my knowledge.)

This is spying on my e-mail and my bank. It has literally no positive attributes. There's just such a massive difference to me that I get confused at your core claim.

This is not about surveillance or privacy.

This is a massive, well-established company deliberately introducing a gigantic security hole into all secure internet services, including the ones you use for online payments, banking, and governmental services. It's a security hole that can be exploited by anyone with moderate technical knowledge, and it was all done for the sake of showing you ads.

A big part of this is convenience, I guess. People were flipping out about Microsoft's trusted computing because it was seen as a big company locking things down. Apple and Android managed to wrap it in a cool UX (and arguably good value proposition of curated content - which is still not as good as one would like given how much crap you can find on the app store) - and general population started using it before techies got around to shouting. It's too late now.

Another, maybe smaller part, is trust. I for one sign into Chrome with my Google ID and enable all location services, etc. on my Android phone because I still trust Google and the Don't Be Evil mantra. I haven't been convinced yet that they're a bad actor (OTOH I can't say that about Apple). I admit it's probably very subjective.

A desktop/laptop is a computer. A smartphone is a computer. Why the different reaction?

They're still two different classes. Smartphones (at least the mainstream Android, iOS and Windows platforms) aren't even self-hosting yet, so they're definitely in their infancy and unlikely to displace the microcomputers we have until said shift occurs, regardless of widespread commentary to the contrary.

By the way, "trusted computing" was backed by a ton of other companies besides Microsoft (I don't even think Microsoft were remotely the first), and it is most certainly not dead in the slightest.

Reply on news.ycombinator.com