Xiaomi Recording ‘Private’ Web and Phone Use • Hacker News Board

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#31

Post by centimeter » Thu, Apr 30, 2020, 10:06 PM UTC

coolspot wrote: post #14

throwaway9587 wrote: post #7

Before you go shaming those bad, bad Chinese companies, imagine my surprise when I restored my Apple iPhone from iCloud only to find my (always set to private!) Safari back there with every tab I ever opened.

Your backup is encrypted https://support.apple.com/en-us/HT202303

That chart from Apple is quite misleading. Apple abandoned full strong encryption for iCloud data, apparently due to pressure from the US Government. https://9to5mac.com/2020/01/21/apple-reportedly-abandoned-en...

Only the things under "End-to-end encrypted data" are actually encrypted in a meaningful way - everything else just sits on servers that use disk encryption, but that fails to defend from 99% of realistic attack scenarios.

A lot of content - including photos (which I used to use to take pictures of sensitive personal data, like ID cards) - is not meaningfully encrypted.

Thankfully, Safari tab data is actually encrypted as of iOS 13.

While Apple has done a good job of protecting user privacy compared to the alternatives, they still have a lot of work to do before we can accurately say things like "iCloud backups are encrypted".

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#32

Post by baq » Thu, Apr 30, 2020, 10:06 PM UTC

i didn't know for sure that such things would happen but expected it. one of the reasons i'm on an iphone for 2+ years. i've got zero trust in chinese manufacturers, in my mind they're just extensions of the CCP.

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#33

Post by Tijdreiziger » Thu, Apr 30, 2020, 10:07 PM UTC

zaro wrote: post #30

“It’s a lot worse than any of the mainstream browsers I have seen,” It's a lot worse than Chrome ? The Xiaomi browser tracks your browsing. The Google browser in combination with the most of the sites in the internet track your browsing, your location, and a lot of other things. Choosing the lesser evil is quite popular now days, and it's obvious which one it is.

> it's obvious which one it is.

Indeed: it's Firefox.

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#34

Post by ficklepickle » Thu, Apr 30, 2020, 10:07 PM UTC

cambalache wrote: post #21

qppo wrote: post #10

The fucking huevos on Forbes to publish this article alongside the most godawful CCPA opt-out flow I've seen yet... Clicking the "do not sell my info" link takes you to a page where it asks you for your personal information to request to opt out... with the fine print telling you that you can actually opt out by going back to the previous dialog, selecting more info, then selecting one of the three cookie sections (w…

If you are a native English speaker kudos for writing "huevos" and not "Cahones" or other of its similar cringy misspellings. But 90% chance you are from the south cone so carry on.

To be fair, they both appear on the wikipedia page for Spanish profanity[0].

[0] https://en.wikipedia.org/wiki/Spanish_profanity#References_t...

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#35

Post by gruez » Thu, Apr 30, 2020, 10:07 PM UTC

zaro wrote: post #30

“It’s a lot worse than any of the mainstream browsers I have seen,” It's a lot worse than Chrome ? The Xiaomi browser tracks your browsing. The Google browser in combination with the most of the sites in the internet track your browsing, your location, and a lot of other things. Choosing the lesser evil is quite popular now days, and it's obvious which one it is.

That argument only makes sense if they're mutually exclusive. Opting out of Chrome in favor of Xiaomi browser doesn't magically remove all the google tracking throughout the internet (unless it has integrated adblocker, which it doesn't seem to have). So really, the choices are Google vs Google + Xiaomi.

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#36

Post by mrtweetyhack » Thu, Apr 30, 2020, 10:08 PM UTC

zaro wrote: post #30

“It’s a lot worse than any of the mainstream browsers I have seen,” It's a lot worse than Chrome ? The Xiaomi browser tracks your browsing. The Google browser in combination with the most of the sites in the internet track your browsing, your location, and a lot of other things. Choosing the lesser evil is quite popular now days, and it's obvious which one it is.

The difference being Goggle does it to make money, China does it to hack you, your friends, your neighbors

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#37

Post by [deleted] » Thu, Apr 30, 2020, 10:11 PM UTC

gruez wrote: post #11

throwaway9587 wrote: post #7

Before you go shaming those bad, bad Chinese companies, imagine my surprise when I restored my Apple iPhone from iCloud only to find my (always set to private!) Safari back there with every tab I ever opened.

It's entirely possible to implement that behavior in a privacy preserving way. Just encrypt "sensitive" data with a key that's stored on the secure element. That way if you restore to the same device, you get everything back. Sadly, I don't feel like wiping my phone to test this out, so whether Apple actually does that is an open question at this point.

[deleted]

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#38

Post by gruez » Thu, Apr 30, 2020, 10:11 PM UTC

ptx wrote: post #12

How does Windows 10 compare? It also tracks and reports which websites you visit, but maybe it doesn't in private browsing mode? Edit: People asking for sources, go to Settings -> Diagnostics & Feedback. See the part where it says "Send ... info about websites you browse"? You might also be interested in the setting below it; when you enable it "Microsoft will collect samples of the content you type"[1]. [1] https://…

[flagged]

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#39

Post by jotm » Thu, Apr 30, 2020, 10:13 PM UTC

monksy wrote: post #26

mbdesign wrote: post #18

On a Xiaomi device myself. Recently I've setup Nextdns.io to resolve all the DNS requests through it. Very frequent callbacks to Xiaomi servers for tracking. Blocked a bunch of them now, but it's half a solution.

You should be using a custom rom.

Do they allow it? I was surprised the Huawei Mate 20 Pro, at the time a flagship phone on par with the Note 9 and others, actually had a locked bootloader.

It would've been a good opportunity to allow people to install whatever they want, to show that they're different than Samsung and other competitors, but no, they went and locked that down because of "safety". Mhmmm.

Re: Xiaomi Recording ‘Private’ Web and Phone Use

#40

Post by jotm » Thu, Apr 30, 2020, 10:15 PM UTC

curiousgal wrote: post #5

schoolornot wrote: post #3

I recently wiped my factory-unlocked Samsung S20, enabled debug mode, and ran "pm list packages" over ADB. The results were beyond startling. There were close to 100 packages running under com.samsung and other various namespaces with tons of sensitive permissions. Most of these processes I could not identify what they existed for. And I still can't figure out why a freshly wiped unlocked phone w/ a Sprint SIM is run…

This is why I root my device and only allow apps I trust internet access.

Doesn't that permanently disable some features on Samsung? I read they use a goddamn eFuse for it