Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Xiaomi browsers spyware? Yes, they are (2020)

palant.info

Post reply on HN
Print view View original

271–280 of 505 posts

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#271

Post by javajosh »

cosmodisk wrote: post #182
sammorrowdrums wrote: post #108

Earlier quoted context omitted.

Genuinely, I really want to see Purism succeed and increasing numbers of competitors in that space, because we need tools that don't require so much blind trust. Whether caused by inept software devs, scope for malicious code / backdoors in firmware, analytics spyware, and whether this stuff is well intentioned or not, if it can be abused, it will be. Open source and verifiable down to the firmware is the only chance…

The problem is that purism doesn't pay as much as all the tracking, preinstalled bloatware, random 3rd party utilities and other stuff. This will never ever be solved through competition,because people either don't care, or there aren't enough of those who do. Legislation is the only way to make it work, but then again, that's hardly an option for most of the world.

There is clearly at least a niche market for "transparent devices". See https://www.crowdsupply.com/sutajio-kosagi/precursor for example.

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#272

Post by rglullis »

techrat wrote: post #234
rglullis wrote: post #201

Earlier quoted context omitted.

Yeap. Don't use Chrome if you can avoid it. I'm using Brave for years already and I am very happy with it.

Except Brave itself also collects telemetry and has been caught whitelisting cross site apis from sites like Facebook. https://nakedsecurity.sophos.com/2019/02/12/privacy-browser-... Honestly, when Brave makes the kind of claims that they do, an oversight like this is inexcusable. Privacy should mean privacy, even if that means losing functionality on a select few sites.

Oh, give me a break.

> collects telemetry

https://brave.com/privacy-preserving-product-analytics-p3a/

   * P3A doesn’t collect any personal information. 
   * You can turn P3A off at any time in the “Privacy and Security” section of the browser preferences.
   * All the P3A code will be open source (...) you can check that your browser is only sharing the specific things we promise.
> Honestly, when Brave makes the kind of claims that they do, an oversight like this is inexcusable.

The claim was never about absolute privacy but rather as strong as default as possible while keeping the web functional. And in that department they are delivering more than any alternative - more than even Firefox out of the box. Not to mention that TFA itself states that the implementation was far from ideal.

Anyway, the biggest question I have for those that are so quick to criticize Brave is "what else do we have with a business model that can disrupt Surveillance Capitalism?". Apple could if they wanted, but where is Safari for Windows/Linux? Any of the others? Doubtful. Even Mozilla's dependency on ad revenue from Google makes them less credible. So why shit on Brave when there is absolutely zero potential alternatives?

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#273

Post by cmeacham98 »

45ure wrote: post #236
danpalmer wrote: post #16

This paragraph stood out to me: > The intention here seems to be that aigt is the timestamp when the ID was generated. So if that timestamp deviates from current time by more than 7776000000 milliseconds (90 days) a new ID is going to be generated. However, this implementation is buggy, it will update aigt on every call rather than only when a new ID is generated. So the only scenario where a new ID will be generated…

>I remember the UK government investigation into Huawei concluding that not only was their security posture insufficient for critical infrastructure, but their engineering practices were likely a decade away from being at a point where they could start to claim good security practice. This paragraph seems to suggest a similar problem at Xiaomi. ASFAIK, Xiaomi does not sell any critical infrastructure equipment, nor i…

Presumably phones used by government employees in relation to sensitive data are security critical? I'm not aware if their phones are being used in the wild in such a way but it's not hard to imagine such use cases.

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#275

Post by lovelyviking »

Why don't we address the root of the problem? Who controls computer? If user of computer (with phone features) doesn't have a full control over it then this situation can and will be abused by some one who does. It seems a logical consequence of not having full control over your own computer.

Why we discuss mostly the degree of such abuse and not the core of the problem ?

Another core of the problem is dealing with communist regimes. We never learn? Communists are literally responsible for millions of deaths in the 20th century.(https://www.youtube.com/watch?v=NDTbNmUgeXk) They have a good record of disrespecting human rights. Why someone sane would expect them to respect any of his rights now?

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#276

Post by tomc1985 »

lovelyviking wrote: post #275

Why don't we address the root of the problem? Who controls computer? If user of computer (with phone features) doesn't have a full control over it then this situation can and will be abused by some one who does. It seems a logical consequence of not having full control over your own computer. Why we discuss mostly the degree of such abuse and not the core of the problem ? Another core of the problem is dealing with c…

Because there is a lot more money to be made when you don't control the computer.

We are in the middle of a data gold rush. Business types can't resist.

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#277

Post by esperent »

walrus01 wrote: post #7

I truly don't understand, from a security and privacy perspective, why would anyone outside of China would voluntarily choose to run closed-source software from a company that's subject to domestic laws and regulations in China. The MSS is no joke. https://www.google.com/search?client=firefox-b-d&q=china+mss... This is the same reason that Zoom is banned at my workplace and many other partner companies. You've actual…

Well, to play devils advocate, as a random Irish guy it seems like my choice is between Chinese companies spying on me or US companies spying on me. I don't see that huge a difference - although I do acknowledge there's a difference in freedom of speech and culture in the US, that applies to US citizens and when it comes to spying on people outside the US the difference is much smaller.

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#278

Post by Zak »

skynet-9000 wrote: post #262
Havoc wrote: post #252

Earlier quoted context omitted.

I’m running a Xiaomi air filter. Not connected to wifi. Even without wifi access it is vastly superior to previous choices. At similar pricing to my previous one. I’m quite wary of the whole monitoring scene but my next air filter purchase will be a Xiaomi again. Can’t really speak to their other products but on that front they have made a convert out of me despite my aversion to questionable data practices. Also app…

Why does an air filter need wifi?

Same reason a ceiling light does.

I know, I know, you're thinking that doesn't either, but you can control it remotely through an app or website, and automate certain actions. You might want your air cleaner to start running when you leave your office, for example so that your air is dust-free when you get home.

I've actually used a Xiaomi light remote-controlled over the internet to simulate being home while on another continent so that anyone casing the place for a burglary might be dissuaded. I disabled its internet connectivity when I was done with that.

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#279

Post by crazypython »

userbinator wrote: post #256
crazypython wrote: post #196

A very good rule of thumb: Freedom-respecting (fully, 100% open-source) software won't screw you. Simply knowing someone could be watching you and your source code reduces the chance of malicious code.

The Linux kernel is 100% open-source. Yet it's growing user-hostile features --- https://news.ycombinator.com/item?id=26285683 --- and guess what all the locked-down Android phones run...? Open-source doesn't mean anything for freedom if all you can do is look, because you don't have the signing keys and such to modify what you want. It just means they get to show you exactly how they put the noose on you, that's all…

> The Linux kernel is 100% open-source. Yet it's growing user-hostile features --- https://news.ycombinator.com/item?id=26285683 --- and guess what all the locked-down Android phones run...?

That feature is optional, and depends on proprietary, closed-source TPM firmware. You just proved my point– it has to be 100% open-source to respect your freedom.

> Open-source doesn't mean anything for freedom if all you can do is look, because you don't have the signing keys and such to modify what you want. It just means they get to show you exactly how they put the noose on you, that's all.

I agree. That's why I prefer the term freedom-respecting software. Under the free software definition, that is no longer FLOSS, because users do not have the right to modify the software.

> and guess what all the locked-down Android phones run...?

Alas, Linux is not under GPLv3, which ensures that users have an equal right to modify their software.

> Firefox is also chock-full of "telemetry" and it's 100% open-source. That one you do get to modify, but it's still a bloody bastard to strip it all out and recompile to your liking.

Get a prebuilt build of LibreWolf: https://librewolf-community.gitlab.io/

That it's fully open-source checks Mozilla's power to do abusive things. Telemetry can be disabled in Firefox settings.

I've used both of your examples to advance my point further. 100.0% open-source = freedom-respecting and non-abusive.

Post reply on HN