Live data from Hacker News

Are Xiaomi browsers spyware? Yes, they are (2020)

palant.info

241–250 of 505 posts

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#241
post #29

Chinese browser collects your data? Spyware. American company collects your data? $1,400,000,000,000 valuation. This reminds me of how we call Russian billionaires "oligarchs" but we just call American billionaires...billionaires.

I find both to be disturbing and wrong. What do I win?

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#242

This paragraph stood out to me: > The intention here seems to be that aigt is the timestamp when the ID was generated. So if that timestamp deviates from current time by more than 7776000000 milliseconds (90 days) a new ID is going to be generated. However, this implementation is buggy, it will update aigt on every call rather than only when a new ID is generated. So the only scenario where a new ID will be generated…

> If we assume that Xiaomi aren't literally trying to spy for a government Is that even allowed by Chinese law?

[deleted]

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#243
post #174

Earlier quoted context omitted.

I'm writing this from a Xiaomi smartphone. I know Xiaomi is not the best brand to buy for privacy, but I consider their products one of the best in terms of value for money I own a few Xiaomi devices, I simply install Blokada on each one of them and I think you would be surprised by how many non Chinese domains it blocks, Google being one of the worst offenders. EDIT: see this screenshot https://imgur.com/a/UO0BGCy E…

How do you whether Xiaomi's spyware doesn't bypass Blockada ?

There are a lot of binaries other than Android that run on Smartphones that you cannot possibly control from within Android even with fully-privileged apps (let alone restricted user-space apps). And, even within Android, because Blokada doesn't support "Block connection without VPN", there's no guarantee that apps don't bypass the VPN it sets up. Besides, Blokada leaks DNS requests over TCP (only handles the UDP ones) [0]. All of this is discounting the fact that Blokada has a hard-coded list of applications it blanket allows by-default [1].

Also, these fingerprinting bits in their code-base doesn't inspire confidence either [2][3].

I'd not consider Blokada a serious security app at this point, though it does have the potential to be one.

disclosure: I co-develop a similar foss app.

[0] https://github.com/blokadaorg/blokada/blob/65992cdc/android5...

[1] https://github.com/blokadaorg/blokada/blob/8702350602b/andro...

[2] one identifier too many for a user-agent: https://github.com/blokadaorg/blokada/blob/8702350602b/andro...

[3] unique identifier per installation: https://github.com/blokadaorg/blokada/blob/04efb84e06e1/andr...

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#244
post #7

I truly don't understand, from a security and privacy perspective, why would anyone outside of China would voluntarily choose to run closed-source software from a company that's subject to domestic laws and regulations in China. The MSS is no joke. https://www.google.com/search?client=firefox-b-d&q=china+mss... This is the same reason that Zoom is banned at my workplace and many other partner companies. You've actual…

Xiaomi phones are frighteningly popular here in Russia because they're very cheap. Like, a-phone-could-not-cost-this-little cheap. A 7000₽ (around $100) phone? Why not, seems legit! And not many people really understand what Xiaomi is actually doing to offset that cost. Heck, when you open the built-in calculator app in MIUI, it has a freakin privacy policy and refuses to operate if you don't accept that. Same for th…

I love Xiaomi phones, I've owned a couple. But I wouldn't dream of using them without first replacing MIUI with Lineage OS.

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#245
post #29

Chinese browser collects your data? Spyware. American company collects your data? $1,400,000,000,000 valuation. This reminds me of how we call Russian billionaires "oligarchs" but we just call American billionaires...billionaires.

I find both to be disturbing and wrong. What do I win?

You can start championing for a resource-based economy?

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#246

Earlier quoted context omitted.

Considering the current target of deplatforming is the far-right, and given Germany's history specifically, they have a lot of reasons not to trust local hardware and software. The same goes for the Le Pen crowd in France, a somewhat adversarial government on the other side of the globe is often less risky than the status quo across the pond allied to the current French establishment.

I was wondering how long it would take until we got to the argument of "oh no, won't somebody please think of the unfortunate oppressed fascists! it's a good thing that xiaomi has phones and software for them, because their own local european government is against them". The paradox of tolerance and an open society is that if you allow actual fascism to flourish (and Le Pen is absolutely a fascist, in my opinion), yo…

The paradox of oppressing in the name of opposing oppression is that it is already something much worse.

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#247

What's worse is that the whole OS is actually spying on you, not just the Mi browser. Even when idle my phone is trying to send bits of data to their servers. Xiaomi are great but for me this is the end of the line with their phones. Privacy comes at a premium nowadays and lots of us are willing to pay for it. Those affected can block the following domains from resolving: - data.mistat.intl.xiaomi.com - sdkconfig.ad.…

Also tracking.intl.miui.com

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#248
post #35
post #11

I recently bought a Xiaomi phone (Poco m3) for development. I was shocked to learn that in order to enable USB debug mode in developer settings, I needed to BOTH : 1) make a Xiaomi account with and 2) insert a SIM card to the device (!) Is that not insane? Other people seem to think so too: https://android.stackexchange.com/a/186052 Apparently the only alternative to this is rooting the device, which may break it.

I've been told that the reasoning behind this is shady resellers loading unremovable system malware to the system partition (which runs as device admin++) before reselling this to you. Apparently this is a huge problem in China, where there seems to be quite literally no trust at all on online shopping. This actually does seem to be the case if you try buying devices from any NON-xiaomi-official store Aliexpress shop…

This is exactly what Android verified boot is meant to prevent: https://source.android.com/security/verifiedboot. Why can't Xiaomi just do that?

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#250
post #7

I truly don't understand, from a security and privacy perspective, why would anyone outside of China would voluntarily choose to run closed-source software from a company that's subject to domestic laws and regulations in China. The MSS is no joke. https://www.google.com/search?client=firefox-b-d&q=china+mss... This is the same reason that Zoom is banned at my workplace and many other partner companies. You've actual…

But in context: - Australia has similar laws. - Snowden releases showed the US don’t even ask, they just take it. So it’s not like there is a huge amount of difference around the world.

> But in context: > > - Australia has similar laws. > > - Snowden releases showed the US don’t even ask, they just take it. > > So it’s not like there is a huge amount of difference around the world.

I am not familiar with Australia privacy law, could you give me a rough idea what is look like?

Snowdon case made the US government look bad, please don't use the same reason to make the Chinese Communist Party look good or OK.

It's kind weird when something bad happens, everyone just points at the US and says they do that too! The CCP did something bad, Somehow it's OK because the US government did something bad.

If you are an US national and living in the US, you can complain and bitch about your government all you want and not worrying about your safety, hence you can talk about the Snowdon case or berate the president, and things might change. Would you dare doing that in Chinese soil even if your are not Chinese.

Post reply on HN