Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Xiaomi browsers spyware? Yes, they are (2020)

palant.info

Post reply on HN
Print view View original

461–470 of 505 posts

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#461

Post by giantrobot »

fsflover wrote: post #395
giantrobot wrote: post #255

Earlier quoted context omitted.

Purism is never going to end up with fully open source baseband firmware. It's not going to happen because the radios are subject to several regulations which means customers can't be able to modify that firmware. There's going to always be a trust hole.

People should push for open source as much as possible. At some point it will be easier to lobby for the new regulations when everything else is fully open source. See also: https://forum.pine64.org/showthread.php?tid=11815

The regulations around radios exist because the spectrum is limited and emissions propagate over a wide area. You and I (assuming you're in the US) have the same standing to use radio spectrum. If I go and modify my phone's firmware to increase the power output I could literally jam communications from your phone.

It's very different than if I modified the firmware on my hard drive or UEFI on a PC. I might fuck up my stuff but it doesn't affect you. I can fiddle with my hard drive firmware all day but I'm not going to block a 911 call you're trying to make.

Also a company giving out modem firmware is an exception and not a rule. It re-classes the device as a hobbyist/experimental device and if they go traipsing around with it they could potentially face fines (unlikely but possible).

Again it's not about lobbying it's about a limited spectrum and people being stupid/assholes not realizing or caring their pocket radio affects others. You live in a world where shitheads try to make their cars louder on purpose and you can pick up dozens of WAPs because everyone sets the power to the highest number the interface allows.

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#462

Post by happppy »

block every company that tries to compete with US companies. First it was Huawei, now its Xiaomi. Fb, Google are both US companies nd they literally track the hell out of their users to target ads but they are doing great, never had much issue except Zuckerberg was in the news a few months ago but US didn't block them, because they are US companies nd bring $$$ into the country

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#463

Post by UnpossibleJim »

danpalmer wrote: post #399
UnpossibleJim wrote: post #187

Earlier quoted context omitted.

|This should have been caught at a security review stage during design, it should have been caught at the code review stage, it should have been caught by automated tests, it should have been caught by QA, it should have been caught once live by data tests, it should have been seen once live by analysts, it should have been fixed at so many different points.| If the very first people (presumably the "higher ups"/more…

This is something that a company with a mature security posture needs though. Yes it's hard, but that's the point. There are many ways to work around this, having teams whos incentives are tied to finding issues, maybe in a different reporting chain or office or country to those writing the software is one way.

I think incentivizing and anonymizing issue finding by restructure sound like amazing ideas, to be honest. Having batch issues come in to the devs via bug tracking software and conversations be labeled with a user ID rather than name would make a world of difference; so would basic professionalism. An understanding that it isn't team against team. Sdets (and manual testers) are not adversaries to devs or management... Though, I think a lot of devs realize this but project management/producers have a harder time understanding this. This is where I think a basic understanding of coding and the development pipeline would help a lot.

But, here we are. In the real world =/

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#464

Post by mmmmmk »

melomal wrote: post #430
AniseAbyss wrote: post #417

Earlier quoted context omitted.

I don't get it either. Whenever someone uses the words "the West" I cringe because because every goddamn privacy invasion has come from our friendly American overlords. Who I might ad are not just like us.

> I cringe because because every goddamn privacy invasion has come from our friendly American overlords Exactly! It seems that the propaganda machine is still rolling heavy.

There is a big difference. An open, democratic government can be peacefully corrected. A closed, totalitarian government cannot be. If the chinese and russian governments were open, then we could worry less about them.

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#465

Post by mywittyname »

amelius wrote: post #408
mcv wrote: post #403

Earlier quoted context omitted.

The only company I would trust with home automation at this point is IKEA. They're the only ones doing this who are actually in the business of making their customers' homes nice, rather than collecting and monetizing their customers' data. (And now I'm half expecting someone to respond that IKEA also collects our data. I don't know if they do, and I'd expect them not to, but I'd really like to know if they do.)

It's a company. With shareholders. Even if you can trust them now, that's no guarantee for the future. Trusting companies is just silly.

Shareholders care about public perception. Selling user data isn't that profitable. It makes sense that a company would weigh in the potential cost to the brand when determining whether to sell user data.

I could see IKEA using their "good behavior" as a marketing expenditure or selling point. Much like Apple does. This would align well with their general brand perception vis-a-vis sustainability and whatnot.

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#466

Post by nextos »

ornornor wrote: post #362
goodells wrote: post #294

Related to Xiaomi, the company is also doing some sketchy things in the smart home space under their brand "Aqara". I use HomeKit in my apartment and opted for Aqara branded wireless buttons and temp/humidity sensors because of the attractive hardware and good reviews. The devices require a wi-fi connected hub, not too strange for things that use Zigbee, so I gave that a go. Well, on cursory examination, the Aqara/Xi…

I use some xiaomi connected lamps. First thing I did was connect them to home assistant via a dedicated VLAN that has no internet access. I see pages and pages of denied connections in the firewall from the smart lamps. They work with HA just fine, I just wonder what they’re trying to do with these servers. This is pure speculation but I’m convinced that all these smart devices from China are the largest state sponso…

I love some of their non-smart devices that can't spy me. For example, their Mijia precision screwdrivers are exceptionally good quality (Wiha heads) and the price is fair.

Their phones running Android One are also fine and can be reflashed. But the rest of the items are quite shady. I have sniffed on the network traffic some devices generate and it's quite scary.

The same thing applies to other Chinese industrial equipment. For example, I know some labs put BGI sequencers inside airgapped subnetworks because of industrial espionage fears.

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#467

Post by squarefoot »

circo wrote: post #393
squarefoot wrote: post #58

Earlier quoted context omitted.

I just bought the same phone as a gift for my girlfriend, and was considering getting one for me one day since it's a really nice piece of hardware for the price. Some searches around brought this link of a community of non official developers attempting to clean up the system from some preinstalled junk. https://xiaomi.eu/community/

You are probably better off wiping it and installing stock android or some popular custom ROM over trying to hack away the MIUI spyware.

Is there any tested and safe way to reflash it with a custom ROM (suggestions?). The chance of bricking a new phone doesn't look that appealing.

ps: Sadly, the Pinephone is permanently out of stock, otherwise I wouldn't even consider anything else.

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#468

Post by boring_twenties »

grishka wrote: post #116
walrus01 wrote: post #7

I truly don't understand, from a security and privacy perspective, why would anyone outside of China would voluntarily choose to run closed-source software from a company that's subject to domestic laws and regulations in China. The MSS is no joke. https://www.google.com/search?client=firefox-b-d&q=china+mss... This is the same reason that Zoom is banned at my workplace and many other partner companies. You've actual…

Xiaomi phones are frighteningly popular here in Russia because they're very cheap. Like, a-phone-could-not-cost-this-little cheap. A 7000₽ (around $100) phone? Why not, seems legit! And not many people really understand what Xiaomi is actually doing to offset that cost. Heck, when you open the built-in calculator app in MIUI, it has a freakin privacy policy and refuses to operate if you don't accept that. Same for th…

Here in the US, a Moto G7 Play is $130 brand new from amazon.com, and seems to be much more reasonable from a privacy standpoint. I seem to remember being presented with a clear choice to disable phoning home to Motorola during initial setup.

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#469

Post by africanboy »

ignoramous wrote: post #243
petra wrote: post #174

Earlier quoted context omitted.

How do you whether Xiaomi's spyware doesn't bypass Blockada ?

There are a lot of binaries other than Android that run on Smartphones that you cannot possibly control from within Android even with fully-privileged apps (let alone restricted user-space apps). And, even within Android, because Blokada doesn't support "Block connection without VPN", there's no guarantee that apps don't bypass the VPN it sets up. Besides, Blokada leaks DNS requests over TCP (only handles the UDP one…

that's a very interesting analysis

what's the name of the app you co-developed?

Re: Are Xiaomi browsers spyware? Yes, they are (2020)

#470

Post by varjag »

rchaud wrote: post #458
varjag wrote: post #435

Earlier quoted context omitted.

You write this on the same day the President called for Amazon workers to unionize.

Which is a performative act of solidarity with warehouse workers. What happens if those in right-to-work states unionize and get sacked? Biden isn't shouldering any of the risks they are. Actions matter more than words. At this time, it's not even clear if Biden will go to the mat for a nationwide $15/hr minimum. That would do far more to incentivize Amazon to improve working conditions, as its $15/hr starting rates…

This is some 5d chess rationalization. There would be no calls to unionize Amazon if the govt was in Bezos' pocket.
Post reply on HN