Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xiaomi Recording ‘Private’ Web and Phone Use

forbes.com

Post reply on HN
Print view View original

41–50 of 254 posts

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#41

Post by maximente »

cambalache wrote: post #21
qppo wrote: post #10

The fucking huevos on Forbes to publish this article alongside the most godawful CCPA opt-out flow I've seen yet... Clicking the "do not sell my info" link takes you to a page where it asks you for your personal information to request to opt out... with the fine print telling you that you can actually opt out by going back to the previous dialog, selecting more info, then selecting one of the three cookie sections (w…

If you are a native English speaker kudos for writing "huevos" and not "Cahones" or other of its similar cringy misspellings. But 90% chance you are from the south cone so carry on.

my brain's classifier would predict upon hearing just huevos => mexican spanish. i'd imagine southern cone speakers would say pelotas, but might be way off here.

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#42

Post by bentpins »

jotm wrote: post #39
monksy wrote: post #26

Earlier quoted context omitted.

You should be using a custom rom.

Do they allow it? I was surprised the Huawei Mate 20 Pro, at the time a flagship phone on par with the Note 9 and others, actually had a locked bootloader. It would've been a good opportunity to allow people to install whatever they want, to show that they're different than Samsung and other competitors, but no, they went and locked that down because of "safety". Mhmmm.

It's a little bit of an ordeal - you have to request a bootloader unlock and then wait two weeks. But doable.

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#43

Post by cantrevealname »

Just wait till they:

- start encrypting all the data they collect (with real encryption, not base64 encoding)

- saving up the data for hours or days at time and sending it in bursts (so there is no immediate connection to a remote server)

- sending the data to plausible U.S.-registered domains (rather than to Singapore and Russia)

- monitoring at the kernel or firmware level so that it doesn't matter what browser or apps you use

- turning off data collection when it suspects a security researcher (due to signs of debuggers, development tools, network monitoring, usual network settings like to proxies or DNS, etc)

We won't be able to prove anything. So disheartening.

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#44

Post by [deleted] »

xiii1408 wrote: post #20
mbdesign wrote: post #18

On a Xiaomi device myself. Recently I've setup Nextdns.io to resolve all the DNS requests through it. Very frequent callbacks to Xiaomi servers for tracking. Blocked a bunch of them now, but it's half a solution.

Other than the tracking, would you recommend it? Is LineageOS available? I've been curious about trying a Chinese phone for a while, but would only do it if Lineage is available, since I'm annoyed by anything more busy than stock Android.

[deleted]

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#45

Post by yorwba »

xiii1408 wrote: post #20
mbdesign wrote: post #18

On a Xiaomi device myself. Recently I've setup Nextdns.io to resolve all the DNS requests through it. Very frequent callbacks to Xiaomi servers for tracking. Blocked a bunch of them now, but it's half a solution.

Other than the tracking, would you recommend it? Is LineageOS available? I've been curious about trying a Chinese phone for a while, but would only do it if Lineage is available, since I'm annoyed by anything more busy than stock Android.

LineageOS supports a lot of different Xiaomi devices: https://wiki.lineageos.org/devices/#xiaomi

I have a tissot with LineageOS 16.0, not sure yet whether it will get 17 ported to it as well. The hardware is great for the price (bought it a year after launch, heavily discounted). I bought it specifically to run LineageOS on it, so I have no idea what the stock experience is like.

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#46

Post by amoshi »

curiousgal wrote: post #5
schoolornot wrote: post #3

I recently wiped my factory-unlocked Samsung S20, enabled debug mode, and ran "pm list packages" over ADB. The results were beyond startling. There were close to 100 packages running under com.samsung and other various namespaces with tons of sensitive permissions. Most of these processes I could not identify what they existed for. And I still can't figure out why a freshly wiped unlocked phone w/ a Sprint SIM is run…

This is why I root my device and only allow apps I trust internet access.

Root and then get flagged by Google's SafetyNet, preventing you from Netflix, banking apps etc? That's a brave but big sacrifice

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#47

Post by searchableguy »

xiii1408 wrote: post #20
mbdesign wrote: post #18

On a Xiaomi device myself. Recently I've setup Nextdns.io to resolve all the DNS requests through it. Very frequent callbacks to Xiaomi servers for tracking. Blocked a bunch of them now, but it's half a solution.

Other than the tracking, would you recommend it? Is LineageOS available? I've been curious about trying a Chinese phone for a while, but would only do it if Lineage is available, since I'm annoyed by anything more busy than stock Android.

Yeah. I am using cdroid android v10(based on lineage). Last update was this month.

Running it for 2 years now.

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#48

Post by fastball »

amiga-workbench wrote: post #28

Stuff like this is why without fail, every phone I own gets LineageOS installed immediately. Xiaomi phones have a bootloader unlock timer to try and mitigate sites reselling their phones with modified software, so I had to leave my Mix 2s alone for a few days before I could make it safe to use.

This is why, without fail, I buy iPhones.

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#49

Post by ballenf »

qppo wrote: post #10

The fucking huevos on Forbes to publish this article alongside the most godawful CCPA opt-out flow I've seen yet... Clicking the "do not sell my info" link takes you to a page where it asks you for your personal information to request to opt out... with the fine print telling you that you can actually opt out by going back to the previous dialog, selecting more info, then selecting one of the three cookie sections (w…

So what do you suggest? That no journalist can cover these issues if their employer doesn't meet some minimum level of privacy respecting behavior? You could say it's hypocrisy, but on whose part I'm not sure. Surely not the author. Is it on Forbes' part for not blocking publication?

Just not sure the point in alleging that the publication (or investigation?) somehow took a lot of guts or whatever.

Forbes isn't installing tracking software on every site you visit. They're monetizing to the nth degree visitors to the own site. And if we want to do what-about-isms I just don't know how we have a conversation without starting at FB and Google.

Maybe I'm paranoid, but your comment strikes me as exactly the kind of thing I'd write if I was Xiaomi. Also I just don't think it helps the cause of privacy to discourage these kinds of investigations by any publication, regardless of their own track record.

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#50

Post by nicbou »

0xy wrote: post #6
mikestew wrote: post #2

There's too much to quote, but scroll down to Xiamoi's responses. Man, that is the quintessential example of gaslighting. "No we didn't, that's not true at all. Well, we kinda did, but it's 'anonymized', so it's okay." "But we have video of your device sending data to..." "...but, but, anonymized!" "I thought you said you weren't sending data at all, now it's just anonymized browser data, but we see your devices send…

There's no such thing as anonymized when it comes to data tracking. "Anonymized" tracking itself is gaslighting.

It's anonymized in the sense that you don't know who it will be sold to and what they will do with it.

In all seriousness, this is a point GDPR struggles with. It's really hard to properly define what constitutes personal data.

Post reply on HN