Live data from Hacker News

Smartphones with Qualcomm chip secretly send personal data to Qualcomm

nitrokey.com

121–130 of 346 posts

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#121
I wonder why they didn't actually post the data that's being sent over. Especially because it says:

> Investigating this further we can see that the packages are sent via the HTTP protocol and are not encrypted using HTTPS, SSL or TLS.

So why not just post the actual data, instead of:

> To clarify, here a list of the data Qualcomm !!may collect!! from your phone according to their privacy policy:

Also, how does Qualcomm's privacy policy affect me as a user directly? I didn't agree to that. Or do I "accept" it because it gets passed over by manufacturers?

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#122
post #113
post #96

Earlier quoted context omitted.

What a strange point. The ability to break into a car is rather different than having a constant data connection to the car.

I’m trying to discern your point. If it’s about cars having a data connection then my point makes no sense, obviously. But your comment was in response to someone complaining about “remote control” which is just “remote unlock” (that’s all Tesla does remotely in the context of GGP). So that’s how I interpreted your response.

Yes, sorry, I could have been more clear.

I see a huge difference between the ability to physically break into a car and having a datastream to a company that can be used to unlock the car. The latter is much more problematic -- especially if I can't choose who does or does not have that ability.

This is all a subset of the problem that modern cars are surveillance platforms.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#123
post #36

This seems like much bigger news than it's being received as. Sure, other chip makers do sketchy things, but is that really where we're at in 2023? We're so beaten down by proprietary user-disrespecting hardware/software that we just shrug it off? This makes me mad. I'm so sick of this type of thing. It's a horrible time too because the embedded 5G chips are about to be part of everything , sending telemetry back abo…

This article just has little to no information in it, at least not enough to get all up in arms about. Supposedly this nefarious information is sent in the clear but no analysis was done to see what it actually happening? They're just guessing? The whole article is "Qualcomm privacy policy says they can do xyz" and then extrapolating from there.

[dead]

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#124

This is all assumptions. Just because izatcloud.net is owned by Qualcomm = they must be exfiltrating personal data? c'mon! Then you go and peddle your own NitroPhone as a "Qualcomm free" alternative? You're just gaslighting your customers to buy. This is a very short-sighted article based on lax assumptions and NO WIRESHARK to back it up. Just because a firmware makes a call home doesn't mean it's sending your person…

> This is a very short-sighted article based on lax assumptions and NO WIRESHARK to back it up. Just because a firmware makes a call home doesn't mean it's sending your personal data.

Sorry, but you're the one who is missing the point. The very act of making a network request gives away your geolocation + time of use https://kieranhealy.org/blog/archives/2013/06/09/using-metad...

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#125

Earlier quoted context omitted.

> Tesla is able to remotely unlock a vehicle if they verify the owner. But with another car, I can choose who (if anyone) I'm willing to give that ability to. I certainly wouldn't want it to be Tesla.

I think every major car manufacturer has some kind of remote unlock capability these days - people want an app. You could design one of those apps to end-to-end encrypt all comms with the car, but I don't think most people would appreciate the usability hit.

> I think every major car manufacturer has some kind of remote unlock capability these days - people want an app.

Correct. And that (along with everything else related to it) is why I won't own a car that was made too recently.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#126

Earlier quoted context omitted.

> Imagine if you bought a car from somebody, and they secretly kept a spare key and periodically used your car to run their personal errand. This is happening already. Teslas can be controlled remotely, and it does not have to be the owner of said Tesla. Yes, somehow people are okay with that. The world we live in gets scarier and scarier every year.

Piss of Elon and in the morning your car could be parked some couple of miles away OR FSD buggs out on the highway OR someone reports you for something and they disable your car to aprehend you. Good bye high speed chases.

Disabling engines remotely by police has been a thing since at least 2010, in pretty much every modern car.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#127

This seems like much bigger news than it's being received as. Sure, other chip makers do sketchy things, but is that really where we're at in 2023? We're so beaten down by proprietary user-disrespecting hardware/software that we just shrug it off? This makes me mad. I'm so sick of this type of thing. It's a horrible time too because the embedded 5G chips are about to be part of everything , sending telemetry back abo…

It is upsetting, but I am not sure how it can be countered. I am genuinely asking what is the alternative here. We go back to the lack of trust. You basically have to assume everything is trying to communicate with mothership. You mention RISC-V, but was it ever really tested against the same proposition? I miss the dumb everything days, where the manufacturer simply could not spare compute power on additional featur…

The alternative is to drop the purposeful error in GPS positioning systems.

GPS has a built-in error for the civilian use, and a higher-accuracy system for military use. The concerns when it was deployed included unwanted parties using GPS as a guidance system component for missile / drone attacks, etc.

This led to the early GPS enabled phones needing an enhancement to their positioning system. The early releases (think car navigation systems) would be tuned to un-do the GPS offsets, but as that was rarely a 100% solution, they would "smart match" to the nearest viable alternative. This is why in many older car systems, you are sometimes registered as being on the feeder road (or a parallel road) until the system can no longer resolve your travel with your map position.

For smart phones, the error was deemed to great to have decent customer satisfaction, so enhancements to GPS came into being. The phones would listen for nearby markers (typically wifi stations) and report them back to a data warehouse, effectively building a dynamic map of all the wifi points. Then one could anchor that map based on non-moving items (like cell phone towers) and obtain fine-grained positioning information by running relative strength matches to the nearest 3 or 5 wifi access points.

The system updates eventually for broadcasters that change ids, are powered off, are relocated, etc. It has error checking built-in to reduce confusion around one or two new / missing / relocated markers.

All of this was driven by customer demand, and the data collection necessary was mentioned in the past. As the maps are unlikely to ever be placed inside of phone devices, and would require intensive storage to duplicate into each phone, as well as intensive bandwidth to update each phone, odds are that the calls to the manufacturers (which are selling "enhanced GPS" positioning systems) will continue for a very long time.

The solution? Pressure the government to release accurate GPS positioning, so industry will see the running of an independent positioning system as redundant and not-cost effective. Then, when you get a position with GPS, you get an accurate position, and you need not send a signal to correlate nearby signals with your true position.

Does it suck? Yes. Is the current system subject to abuse? Yes. Is the current system abused? (I'm a skeptic of human nature, so) Yes, but its abuse patterns seem to be nearly identical to its use patterns, with the difference being that the companies providing this service can use it to help people find their way to the grocery or to help other people find their way to a specific customer.

Qualcom and others have a very vested interest in not abusing the system, as they would lose their competitive edge should the government decide to take action against them. That said, many people worry about the government being the party abusing the system.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#128
post #3

This seems like a really shallow dive into what’s going on, and seems to exist largely to plug their own hardware? For example, how is the chipset getting “List of the software on the device” unless the chipset is aware of the operating system? They don’t actually do any packet data analysis to see what it includes as far as I can tell, so other than seeing some packets go through, the rest feels like idle speculatio…

Idle speculation, idle speculation that picks up just where the compliance handwaving stops: the legal team takes the better safe than sorry approach of listing everything they might perhaps infer from the particulars of aGPS refresh, and the blogger basically continues that line of thought: wow, that would be pretty wild.

The "no packet analysis" is an interesting angle, because it would take all the fun out of complaining about plain http: would we prefer open messages with a known low amount of things to hide, or hidden messages with an unknown amount of secrets?

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#129

This seems like much bigger news than it's being received as. Sure, other chip makers do sketchy things, but is that really where we're at in 2023? We're so beaten down by proprietary user-disrespecting hardware/software that we just shrug it off? This makes me mad. I'm so sick of this type of thing. It's a horrible time too because the embedded 5G chips are about to be part of everything , sending telemetry back abo…

>This seems like much bigger news than it's being received as.

Well, it's an ad for another phone. That doesn't take away from the truth, but it's marketing even if it's true.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#130

This seems like much bigger news than it's being received as. Sure, other chip makers do sketchy things, but is that really where we're at in 2023? We're so beaten down by proprietary user-disrespecting hardware/software that we just shrug it off? This makes me mad. I'm so sick of this type of thing. It's a horrible time too because the embedded 5G chips are about to be part of everything , sending telemetry back abo…

Is it big news?

It might be, but we haven't seen the packet captures yet. I'm not trusting this shallow analysis (from a source I don't have any particular reason to trust) without seeing more details or corroboration.

Post reply on HN