Cool post. One thing that rubbed me the wrong way: Their response was better than 98% of other companies when it comes to reporting vulnerabilities. Very welcoming and most of all they showed interest and addressed the issues. OP however seemed to show disdain and even combativeness towards them... which is a shame. And of course the usual sinophobia (e.g. everything Chinese is spying on you). Overall simple security design flaws but it's good to see a company that cares to fix them, even if they didn't take security seriously from the start.

Edit: typo

I agree they could have worked more closely with the team, but the chat logging is actually pretty concerning. It's not sinophobia when they're logging _everything_ you say.

(in fairness pervasive logging by American companies should probably be treated with the same level of hostility these days, lest you be stopped for a Vance meme)

>everything Chinese is spying on you

When you combine the modern SOP of software and hardware collecting and phoning home with as much data about users as is technologically possible with laws that say “all orgs and citizens shall support, assist, and cooperate with state intelligence work”… how exactly is that Sinophobia?

If all of the details in this post are to be believed, the vendor is repugnantly negligent for anything resembling customer respect, security and data privacy.

This company cannot be helped. They cannot be saved through knowledge.

See ya.

Note that the world-model "everything Chinese is spying on you" actually produced a substantially more accurate prediction of reality than the world-model you are advocating here.

As far as being "very welcoming", that's nice, but it only goes so far to make up for irresponsible gross incompetence. They made a choice to sell a product that's z-tier flaming crap, and they ought to be treated accordingly.

Nipponophobia is low because Japan didn’t successfully weaponize technology to make a social credit score police state for minority groups.

> And of course the usual sinophobia (e.g. everything Chinese is spying on you)

to assume it is not spying on you is naive at best. to address your sinophobia label, personally, I assume everything is spying on me regardless of country of origin. I assume every single website is spying on me. I assume every single app is spying on me. I assume every single device that runs an app or loads a website is spying on me. Sometimes that spying is done for me, but pretty much always the person doing the spying is benefiting someway much greater than any benefit I receive. Especially the Facebook example of every website spying on me for Facebook, yet I don't use Facebook.

> Their response was better than 98% of other companies when it comes to reporting vulnerabilities. Very welcoming and most of all they showed interest and addressed the issues

This was the opposite of a professional response:

* Official communication coming from a Gmail. (Is this even an employee or some random contractor?)

* Asked no clarifying questions

* Gave no timelines for expected fixes, no expectations on when the next communication should be

* No discussion about process to disclose the issues publicly

* Mixing unrelated business discussions within a security discussion. While not an outright offer of a bribe, ANY adjacent comments about creating a business relationship like a sponsorship is wildly inappropriate in this context.

These folks are total clown shoes on the security side, and the efficacy of their "fix", and then their lack of communication, further proves that.

> Overall simple security design flaws but it's good to see a company that cares to fix them, even if they didn't take security seriously from the start.

It depends on what you mean by simple security design flaws. I'd rather frame it as, neglect or incompetence.

That isn't the same as malice, of course, and they deserve credits for their relatively professional response as you already pointed out.

But, come on, it reeks of people not understanding what they're doing. Not appreciating the context of a complicated device and delivering a high end service.

If they're not up to it, they should not be doing this.

To be honest the responses sounded copy and pasted straight from ChatGPT, it seemed like there was fake feigned interest into their non-existent youtube channel.

> Overall simple security design flaws but it's good to see a company that cares to fix them, even if they didn't take security seriously from the start

I don't think that should give anyone a free pass though. It was such a simple flaw that realistically speaking they shouldn't ever be trusted again. If it had been a non-obvious flaw that required going through lots of hoops then fair enough but they straight up had zero authentication. That isn't a 'flaw' you need an external researcher to tell you about.

I personally believe companies should not be praised for responding to such a blatant disregard for quality, standards, privacy and security. No matter where they are from.

I mean, at the end of the article they neglected to fix most of the issues and stopped responding.

I think the response wouldn’t be so hostile if they had continued to engage. One round of fixes clearly wasn’t enough.

Same here. Also once it turned out to be an android device in debug mode the rest of the article was less interesting. Evil maid stuff

They'll only patch it in the military model

/s

It’s not sinophobia to point out an obvious pattern. It’s like saying talking about how terrorism (the kind that will actually affect you) is solely an Islamic issue, and then calling that islamophobic. It’s okay to recognize patterns my man.