Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smartphones with Qualcomm chip secretly send personal data to Qualcomm

nitrokey.com

Post reply on HN
Print view View original

31–40 of 346 posts

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#31

Post by bogle »

mschuster91 wrote: post #6
dagmx wrote: post #3

This seems like a really shallow dive into what’s going on, and seems to exist largely to plug their own hardware? For example, how is the chipset getting “List of the software on the device” unless the chipset is aware of the operating system? They don’t actually do any packet data analysis to see what it includes as far as I can tell, so other than seeing some packets go through, the rest feels like idle speculatio…

> They don’t actually do any packet data analysis to see what it includes as far as I can tell, so other than seeing some packets go through, the rest feels like idle speculation. That's enough under GDPR, which is the point of the article. Even though the GDPR requires active informed consent, there are still so many layers openly sharting on that requirement, and no one holds the big players accountable.

NOYB [https://noyb.eu/en] do their best to hold big tech's feet to the fire (and they exist on donations so we can all help out).

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#32

Post by joezydeco »

freedomben wrote: post #21

This seems like much bigger news than it's being received as. Sure, other chip makers do sketchy things, but is that really where we're at in 2023? We're so beaten down by proprietary user-disrespecting hardware/software that we just shrug it off? This makes me mad. I'm so sick of this type of thing. It's a horrible time too because the embedded 5G chips are about to be part of everything , sending telemetry back abo…

Sorry, but trying to be optimistic about RISC-V is only going to lead to more pain.

It's just an instruction set architecture and it's still going to be made in large SoC fabs by Qualcomm-class companies that want to save a buck on ARM licensing. There's no way to win here.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#33

Post by kayson »

Did I miss something in the article? They see the connections were made, it was plain http, but they didn't actually show any of the real payload/data? Instead they quoted the list of what Qualcomms policy says could be collected? Seems like low hanging fruit...

Disclaimer: work at Qualcomm but have nothing to do with any of this

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#34

Post by heap_perms »

figgyc wrote: post #23

If the data is as they say sent via http then surely they can show a sample request with what data is _actually_ sent from the device instead of the list of what Qualcomm says might be sent (which was probably drafted by CYA lawyers instead of engineering)?

Right? That would be much more interesting, and I wonder why they didn't show packet data. They already went through the work of setting up wireshark, might as well peek into the packet data to see what's going on.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#35

Post by freedomben »

A4ET8a8uTh0 wrote: post #28
freedomben wrote: post #21

This seems like much bigger news than it's being received as. Sure, other chip makers do sketchy things, but is that really where we're at in 2023? We're so beaten down by proprietary user-disrespecting hardware/software that we just shrug it off? This makes me mad. I'm so sick of this type of thing. It's a horrible time too because the embedded 5G chips are about to be part of everything , sending telemetry back abo…

It is upsetting, but I am not sure how it can be countered. I am genuinely asking what is the alternative here. We go back to the lack of trust. You basically have to assume everything is trying to communicate with mothership. You mention RISC-V, but was it ever really tested against the same proposition? I miss the dumb everything days, where the manufacturer simply could not spare compute power on additional featur…

> You mention RISC-V, but was it ever really tested against the same proposition?

Good point, there's no reason a manufacturer couldn't build it in. My thought was more along the lines of lower barrier of entry that would enable more competition (Qualcomm is near monopoly and has pretty anti-competitive practices that make it super hard to compete with them), and hopefully there will be more transparent options out there. As a user of GPS I'd like the option of enabling something like this because the old days of taking forever to sync with the satellites did suck. But I want to be able to decide for myself, not have the decision forced upon me by the chip's firmware.

> I miss the dumb everything days, where the manufacturer simply could not spare compute power on additional features like telemetry.

Oh man, me too. The nostalgia for this burns like a fire in my soul.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#36

Post by fckgw »

freedomben wrote: post #21

This seems like much bigger news than it's being received as. Sure, other chip makers do sketchy things, but is that really where we're at in 2023? We're so beaten down by proprietary user-disrespecting hardware/software that we just shrug it off? This makes me mad. I'm so sick of this type of thing. It's a horrible time too because the embedded 5G chips are about to be part of everything , sending telemetry back abo…

This article just has little to no information in it, at least not enough to get all up in arms about. Supposedly this nefarious information is sent in the clear but no analysis was done to see what it actually happening? They're just guessing?

The whole article is "Qualcomm privacy policy says they can do xyz" and then extrapolating from there.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#37

Post by yabones »

kayson wrote: post #33

Did I miss something in the article? They see the connections were made, it was plain http, but they didn't actually show any of the real payload/data? Instead they quoted the list of what Qualcomms policy says could be collected? Seems like low hanging fruit... Disclaimer: work at Qualcomm but have nothing to do with any of this

Yeah, I'd be interested to see what's _inside_ the request, not just that it was made.

Was it a connectivity self-test or empty GET request? That's not ideal, but fairly benign.

Or was it a "phone home" reporting the device's ID, SN, IMEI, etc? That's a lot worse.

Or, did it truly contain PII or geolocation data? that's really bad. It matters a LOT what's inside the request, and it seems a little dishonest to not include it in the report.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#38

Post by [deleted] »

freedomben wrote: post #21

This seems like much bigger news than it's being received as. Sure, other chip makers do sketchy things, but is that really where we're at in 2023? We're so beaten down by proprietary user-disrespecting hardware/software that we just shrug it off? This makes me mad. I'm so sick of this type of thing. It's a horrible time too because the embedded 5G chips are about to be part of everything , sending telemetry back abo…

[deleted]

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#39

Post by ajross »

dagmx wrote: post #3

This seems like a really shallow dive into what’s going on, and seems to exist largely to plug their own hardware? For example, how is the chipset getting “List of the software on the device” unless the chipset is aware of the operating system? They don’t actually do any packet data analysis to see what it includes as far as I can tell, so other than seeing some packets go through, the rest feels like idle speculatio…

> For example, how is the chipset getting “List of the software on the device” unless the chipset is aware of the operating system?

This surely isn't "the chip" doing this. It's the driver suite provided by Qualcomm, which is (obviously) required for a functioning device. The open Android distros still need drivers, and are essentially copying these files verbatim without review.

Somewhere Qualcomm has a privileged daemon able to get this info.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#40

Post by freedomben »

fckgw wrote: post #36
freedomben wrote: post #21

This seems like much bigger news than it's being received as. Sure, other chip makers do sketchy things, but is that really where we're at in 2023? We're so beaten down by proprietary user-disrespecting hardware/software that we just shrug it off? This makes me mad. I'm so sick of this type of thing. It's a horrible time too because the embedded 5G chips are about to be part of everything , sending telemetry back abo…

This article just has little to no information in it, at least not enough to get all up in arms about. Supposedly this nefarious information is sent in the clear but no analysis was done to see what it actually happening? They're just guessing? The whole article is "Qualcomm privacy policy says they can do xyz" and then extrapolating from there.

Agreed, the article is lacking. In some other threads it's come out that this is a GPS sync feature to speed up the time it takes for GPS to get locks. A useful feature to be sure, but IMHO not one that has to be implemented in such a user disrespecting way. It should be a toggleable switch, preferably opt-in. It wouldn't be hard to throw up a dialog on first GPS access that lets the user opt in. As implemented where the user is utterly powerless to stop it, it's an egregious privacy violation.
Post reply on HN