Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OnePlus OxygenOS built-in analytics

chrisdcmoore.co.uk

Post reply on HN
Print view View original

151–160 of 188 posts

Re: OnePlus OxygenOS built-in analytics

#151

Post by sprayk »

zeveb wrote: post #91

This is part of why Google's move to forbid users from installing SSL certificates is so anti-security and anti-privacy: it disables the ability to MITM one's own device in order to observe traffic. I'd support regulation forcing Google to permit users to install our own root CA certs.

You can definitely install your own CA certs on Android. https://support.google.com/nexus/answer/2844832?hl=en

Only problem is that you have to explicitly enable the use of custom CA certs in your app, so it won't work with Google apps as you say.

Is there no other way to get at this traffic? Possibly something at the application level, like throwing a debugger at the calls that are originating the telemetry traffic?

Re: OnePlus OxygenOS built-in analytics

#152

Post by zeveb »

sprayk wrote: post #151
zeveb wrote: post #91

This is part of why Google's move to forbid users from installing SSL certificates is so anti-security and anti-privacy: it disables the ability to MITM one's own device in order to observe traffic. I'd support regulation forcing Google to permit users to install our own root CA certs.

You can definitely install your own CA certs on Android. https://support.google.com/nexus/answer/2844832?hl=en Only problem is that you have to explicitly enable the use of custom CA certs in your app, so it won't work with Google apps as you say. Is there no other way to get at this traffic? Possibly something at the application level, like throwing a debugger at the calls that are originating the telemetry traffic?

> Only problem is that you have to explicitly enable the use of custom CA certs in your app, so it won't work with Google apps as you say.

Or any other app doing nefarious things.

Enabling apps to ignore user-installed certs is flat-out evil an inexcusable.

Re: OnePlus OxygenOS built-in analytics

#153

Post by CharlesDodgson »

482794793792894 wrote: post #128
CharlesDodgson wrote: post #96

Earlier quoted context omitted.

you're are right, I was a bit unclear. I guess I just feel I can trust Google more. Sure Google will take my data and deliver me targeted adverts, share it in some sort of aggregate form with partners and possibly use it to learn more about be than I know about myself, however I feel Google is good with dealing with privileged data. There data security is good and I never feel my account will be leaked, it's not Yaho…

The NSA, FBI, CIA and partnering intelligence services from the However-Many-Eyes countries all also have access to Google's servers...

I'm so uninteresting to any intelligence agency!

Re: OnePlus OxygenOS built-in analytics

#154

Post by CharlesDodgson »

Yhippa wrote: post #108
CharlesDodgson wrote: post #97

Earlier quoted context omitted.

I did this for 2 months, mainly forced to, I had my phone stolen, it was kinda nice, I read more newspapers and learnt i could send SMS messages from payphones!

> learnt i could send SMS messages from payphones How did you manage this?

I live in the UK, most of the newer (like after 2000) BT payphones can do. It was kinda funny, I'd started dating at the time and I got some funny feedback from ladies I was dating. Although I did find someone who thought I wasn't a massive weirdo!

Re: OnePlus OxygenOS built-in analytics

#155

Post by remir »

AndrewCHM wrote: post #35

Google's is similarly excessive https://i.imgur.com/fWvV7R4.png Though I get the feeling google's approach of trying to desensitize me (emailing me about how great I am for traveling to mcdonalds like a slob, and gamifying my use of google maps, for example) instead of shamefully hiding it, is a fair bit worse

You should take a look at this post from Android Police: http://www.androidpolice.com/2017/10/10/google-nerfing-home-...

Apparently there's a feature in the Google Home Mini that allows you to long press on the speaker to bypass the hot word detection ("Ok/hey Google"). Apparently there was a bug on this feature and random sounds could activate the listening of the Home, so it was recording data all day long.

Re: OnePlus OxygenOS built-in analytics

#156

Post by _qjt0 »

mxstbr wrote: post #43

TL;DR: OxygenOS tracks your every activity in every app, and there's no settings to disable the tracking. To get rid of it you have to uninstall the tracking app via adb: (no root access needed) $ adb start-server $ adb shell > pm uninstall -k --user 0 net.oneplus.odm Note: This requires adb to be installed, your phone to be connected and USB debugging to be enabled.

I wonder if there's an opportunity to reduce the privacy problem by having the phones log data to an intermediate server. The intermediate server will be open-source and run by a trusted entity (EFF, Apache Foundation, whoever). OnePlus will be able to submit whatever code they want to this server after a public privacy-focused code review by the trusted entity.

The proxy server will aggregate and anonymise the data before uploading it to upstream OnePlus servers. For example, it can strip out IP addresses. Eliminate data points which are too few and can therefore dangerous. Maybe if too few people are using an app, records about the usage of that app aren't uploaded to upstream OnePlus servers. If OnePlus wants to know how many photos an average user is taking, the intermediate server could just that information, or percentiles, not data about each individual user. These are all not possible to do on-device.

With this, we don't have to worry about what code is running on the phone, or what OnePlus servers are doing, both of us are closed-source and unavailable to us to inspect. But the intermediate server will be open-source.

Re: OnePlus OxygenOS built-in analytics

#158

Post by kllrnohj »

subway wrote: post #146
kllrnohj wrote: post #100

Earlier quoted context omitted.

You can have a similarly libre smartphone. All the phones Google sells have unlockable bootloaders and you can build Android from source yourself including the kernel. There are many 3rd party open-source ROMs built on this. But since you end up with essentially the same OS with essentially the same userspace doing essentially the same thing it raises questions of why go through the effort and hassle. You're complete…

What's really scary is that most Android SoCs now have the baseband sitting in the same package as your CPU, with similar levels of access to system memory. The baseband firmware is usually unmaintained, but often in theory can be altered OTA by your carrier.

Intel & AMD CPUs also have firmware that can be updated as well. Not to mention the BIOS itself which is often blindly trusted.

Re: OnePlus OxygenOS built-in analytics

#159

Post by subway »

kllrnohj wrote: post #158
subway wrote: post #146

Earlier quoted context omitted.

What's really scary is that most Android SoCs now have the baseband sitting in the same package as your CPU, with similar levels of access to system memory. The baseband firmware is usually unmaintained, but often in theory can be altered OTA by your carrier.

Intel & AMD CPUs also have firmware that can be updated as well. Not to mention the BIOS itself which is often blindly trusted.

Sure -- fortunately on most Intel and AMD CPUs you have some level of control in isolating the host from mobile carriers and those acting as mobile carriers.

Re: OnePlus OxygenOS built-in analytics

#160

Post by kbart »

api wrote: post #88
kbart wrote: post #76

Earlier quoted context omitted.

"why can we have a top of the line desktop PC which is totally libre, but not a smartphone?" "totally libre PC"? All major CPU manufacturers implement hardware level backdoor we can't disable. The newest version of the most popular OS tracks your every step by default. All of these tiny chips in pretty much any modern electronic device are full of binary blobs you have no way to inspect. Maybe we live in different wo…

PCs are comparatively much more open than phones, and it is actually possible to disable some of that stuff with various hacks on some systems. Phones are closed, locked down, and bugged by design.

I don't deny that, but saying "PCs are totally libre" is vast overstretch. PCs are getting more and more complex, include high number or sub-systems, that are actually mini-computers themselves, so by installing an open-source OS on the topmost layer we only get an illusion of the open system. But unless we have an open hardware along with source code for firmware running on all those sub-systems, we can't call PCs "libre".
Post reply on HN