[nytgop77]

tldr;

- sends various analytics to google and xiaomi

- downloads "blacklist", which contain china-sensitive phrases. Actual filtering is fortunately disabled in EU. (I personally am not sure what filtering actually does. Decompiled code and the blacklist use "Ad" in naming a lot. So if to believe the naming, filtering is for advertisements)

- sends sms to xiaomi for number registration when using cloud. There is some EULA type text, which user must accept for this to happen. Text does mention sms sending there. After sending sms is deleted (user can not check what was sent), its content encrypted, saved in db and sent to xiaomi server.

edit: forgot the fact that blacklist filtering can be turned on by xiaomi at any moment.

[square_usual]

It should be stated clearly and unequivocally that Xiaomi phones cannot be trusted. They have been known to track your usage of their devices and send it back to their servers, including what you see in incognito tabs of their bundled browser. To see your local files or downloads on your phone you need to accept a ToS and a Privacy Policy, because of course they're sending that information back to the mothership too. Do not fall for Xiaomi's low prices - you are paying with your data instead.

https://www.forbes.com/sites/thomasbrewster/2020/04/30/exclu...

[jeroenhd]

You can actually deny the permission popup every time and still use the application. As far as I've found, no actual data exchange happens if you do that. However, that does mean clicking the deny button every damn time you open one of the system apps.

Thay being said, I haven't found that many things that Xiaomi is sending to the cloud that Google isn't sending already. The calculator uses exchange rates, the file explorer had a whole bunch of cloud features as a core selling point and there's various antivirus and other such tooling built into most applications. With Google there's a single checkbox that says "I agree, upload everything", with Xiaomi there's popups for each app.

I don't trust Xiaomi but I haven't found any concrete evidence of the supposed data leaks as long as you turn off ALL the cloud stuff.

I don't use the built-in web browser because built-in web browsers have always been proven to be crap to me so I can't comment on that.

My pihole history is mostly filled with American trackers. The occasional MIUI URL gets filtered out, but I'm honestly not as worried about the data it's trying to submit.

I bought my phone when it was relatively new hoping that I'd receive official LineageOS support. That didn't work out, but so far I haven't had any trouble with MIUI to be honest. The data collection seems to be on par with the average American or Korean ROM, although that could be because it was sold in the EU area.

[inetknght]

> As far as I've found, no actual data exchange happens if you do that.

What research have you done on the matter?

> I haven't found that many things that Xiaomi is sending to the cloud that Google isn't sending already.

Two people find you and take your wallet. One says your wallet was empty and the other says you can have it back if you just keep walking.

Both are just as evil.

> I don't trust Xiaomi but I haven't found any concrete evidence of the supposed data leaks as long as you turn off ALL the cloud stuff.

Oh yeah sure. That's great. Nothing stops Xiaomi from pushing an "update" to reset the settings. Or, like Apple, from pushing "new features" that are automatically turned on "for your convenience"

[jeroenhd]

> What research have you done on the matter?

I've put a TLS intercepting proxy between my phone and the internet. Most traffic flows towards Google (either sync or analytics). I do it every now and then to see if any of the apps I recently installed contain any funny trackers.

> Both are just as evil.

But one of them is completely vilified by mainstream media while the other is vilified by tech nerds and politicians disliking search results that call out their racism.

Of course all of the stalking is bad, but there's no reason to call out any specific company here.

> Oh yeah sure. That's great. Nothing stops Xiaomi from pushing an "update" to reset the settings. Or, like Apple, from pushing "new features" that are automatically turned on "for your convenience"

I'll be pissed when that happens, but the annoyance with having to turn that shit off is worth the €400 I saved by going with a cheap Chinese phone. I don't make Silicon Valley money, that stuff counts.

[cblconfederate]

like i 've said before, if it becomes a dillema, i prefer to be tracked by china than the US, because china has no leverage on my daily life, can't affect my finances, and i have no strong desire to live there

(i m not in the US , which matters a lot)

[atlasunshrugged]

Really? But at least with the U.S. there is due process and some accountability. Who knows what China will own in the future and how much power they'll have. What if they buy your favorite airline and now don't want to let you use it because they have your data? What if they build up the 5G infrastructure across the world? I mean, today they might not have that much global reach (although I think just earlier this week they went after some random person who tweeted something negative about the CCP while living abroad) but what about in 20 or 30 years?

[crateless]

>> But at least with the U.S. there is due process and some accountability

https://www.google.com/search?q=us+drone+strikes+2021

[atlasunshrugged]

Yeah, I don't really want to argue this side because I think the drone strikes are reprehensible but in the U.S. there will likely be at a minimum internal investigations, quite possibly congressional hearings, etc. I doubt the same could be said if China did something similar.

[crateless]

It's not even a debate. Where are the triumvirate of Bush/Cheney/Rumsfeld after falsely starting a war and destabilising an entire region? It doesn't matter what the country stands for, it's what it does that counts.

Due process only applies to American citizens depending on how wealthy you are. The rest of us are sh* out of luck. Which was GP's point.

[iszomer]

Agreed but `crateless` diverted the issue.

The experience of using Google to search in China is vastly different than the rest of the world, unless you rely on a VPN service. IIRC, VPN usage is illegal and is reserved for the more state-sponsored "privileged users".

[sofixa]

> Really? But at least with the U.S. there is due process and some accountability

For non-citizens ? Since when and what is it?

[atlasunshrugged]

The most extreme example I can think of is extending the right of habeas corpus to challenge illegal detentions even of non-citizens on foreign territory (RE Bush/Guantanomo).

https://www.forbes.com/sites/danielfisher/2017/01/30/does-th...

[sofixa]

"Foreign territory" to an extent and within very specific cases ( a US ran illegal detention center and US customs).

As a non-US citizen living in France, i have no rights under the US constitution because it has no jurisdiction over me. That doesn't stop the NSA though.

[kube-system]

That data can be sold to anyone else around the world, or used to remotely mess with your life. You don’t have to physically be in the country where your data is compromised to experience bad effects. Data brokers don’t care where their customers are physically located as long as they have the cash.

[tomComb]

This issue of our data being bought and sold is a big issue, but nation states and some of the big tech companies don't do it. They simply have other objectives.

It's the huge number of smaller companies (and your ISP probably) who we pay little attention to that are buying and selling your data, to the best of my knowledge.

I don't think we should be giving these smaller companies a pass, and I don't think we should accuse those aren't (currently) doing it of doing it - that makes it lose its' meaning.

[kube-system]

Many governments most certainly do buy data and (not many but some) sell it too. Big tech buys a lot of data, but they primarily exploit it for their own profits rather than sell it, unless it's their primary business.

The mention of "China" above was in regards to data collected by a tech company in China anyway: Xiaomi.

[tomComb]

You are right: I should have said sold, not 'bought and sold'. Thanks.

[inetknght]

> china has no leverage on my daily life

No leverage other than, you know, letting you have tons of products that it can update on a whim and monitor what you do, where you go, etc. The funds you gave them end up in Chinese taxes, or more, and that ends up as an absolute nightmare against your own country's best interests. How can you even try saying that's not leverage?

[Ekaros]

Don't seem too different from the other side. And which one should I prefer the one which just ended 20 year occupation in abysmal way. Or one that is currently and in close future focusing on areas near itself...

[BTCOG]

This is the only reasonable comment made in the top 30 I see here. The rest arguing pedantically about politics, why? China is censoring, don't trust and use their phones. It's this simple. Why must most of you build up political facades just to comment on bad phones? Start from only truth.

[hdjjhhvvhga]

Unfortunately Xiamo is producing on only smartphones, but a whole plethora of connected devices, from vacuum cleaners to security cameras. They literally own a surveillance army.

[iszomer]

They've been quietly trying to enter the featurephone market as well with candybar styled phones with their own custom Android firmware: Qin 1s, F21 Pro, etc.

Although they're not specifically tailored for the American market, folks whom are looking to enter or are following the digital minimalism lifestyle have been snatching them off Aliexpress and making review content for them.

[namero999]

Alternatively, since the hardware is excellent, burn LineageOS on them (most of them are supported and stable).

To unlock the bootloader you still need a xiaomi account and to wait a week. Otherwise you can contact someone on reddit or telegram with EDL keys.

[someperson]

> Decompiled code and the blacklist use "Ad" in naming a lot

It's a common tactic for spyware to use the term "Ad" and other terms that sounds innocuous at first glace. AdUps is a great example [1]

[1] https://www.slashgear.com/adups-chinese-spyware-still-on-and...

[arthur2e5]

The “AD” name isn’t that far off. Chop the presentation off an advertisement framework… isn’t the tracking and C&C code already spyware?

[someperson]

The AdUps spyware constantly uploads all private messages, GPS locations and more from the Android device to a cloud server in China controlled by an unknown entity.

The unknown entity is not the operating system vendor and there is no opt-out.