[Updated] OnePlus caught collecting user data for a second time

[dizmo]

Update:

Quote

OnePlus doesn't send information if the user has opted out of usage logging and crash reports. The phone will log SOME stuff locally (which is true of many other smartphone manufacturers), but it is not sent if the "Join User Experience Program" box is unchecked.

The blatant accusation that OnePlus "is still sending logs without your permission to a server in Singapore" simply isn't accurate. OnePlus has already addressed the issue by allowing users to clearly opt-out of the User Experience Program.

The proof and such is in the Reddit thread, but I didn't feel like going too deep into it. Feel free to explore if you like, but the gist of it is above.

Reddit thread:

They've still got a long way to go before they earn any kind of trust back from me though...

ORIGINAL POST:

 

OnePlus is in the news again, and once again it's for privacy concerns.

There's a system app, OPBugReportLite, that reports battery stats, kernel panics, watchdogs, ANRs, and device crashes every six hours and sends them to a server in Singapore. From the outside it looks rather harmless, as it's just a bug report right? However, they're continuing to harvest user data without consent, even after claiming that they'd stop.

 

Even worse, the code can apparently be used to dump media files and is remotely configurable. The logs are also lack any kind of encryption when stored, meaning any app with storage permissions could potentially read and use the data. In it's default state it collects mostly battery stats, but that's still a pretty big security hole.

 

You can find out if your device has the app installed by going to Settings - Apps - Show system apps and searching for BugReportLite in the list.

 

Personally, the first count was bad enough. Then there was the issue with the modified Qualcomm tool being left on devices, and now this?

Even though this sounds more like bug reporting, the fact that it doesn't seem to encrypt the reports has definitely sealed the fate of OnePlus for me. I don't care how cheap they price their devices, if they can't even get device security done properly I won't be buying one.

 

What do you guys think? Innocent mistake? Am I over reacting to all of these apparent security mistakes?

Will you still consider a OnePlus phone?

 

 

 

 

 

 

 

Source: https://www.gsmarena.com/fool_me_twice_oneplus_has_a_system_app_that_sends_out_data_to_a_server_every_6_hours-news-28380.php

 

 

[Crunchy Dragon]

It runs Android, correct? Android is open source, yes? If you knew code and all that one could theoretically edit the version of Android running on that phone to not report any of that kind of stuff. Although most people probably wouldn't do that

[DrMacintosh]

Of course!

[PCGuy_5960]

Come on Oneplus

 

[Oshino Shinobu]

One Plus's business practices have always bugged me a bit, a lot of their marketing comes off as kind of cocky and aggressive. They've had quite a lot of controversial things pop up in the news, like that time they tried to get women to take selfies in order to get a chance to buy the phone by being voted on. 

 

Mistake? Maybe. Innocent? Not at all. Just dumping unencrypted data in an insecure place isn't an innocent mistake, it's a pretty serious mistake through negligence. Doing it after being called out for something similar before isn't acceptable. 

 

I've never really considered One Plus phones, there has always been something about the company that has put me off a bit. Might have nothing to do with this, but I've never really liked them based on their marketing

[Mooshi]

One plus harvests data. Apple plays slap hands with authorities regarding data and I just have an LG minding my business over here.

[ItsMitch]

19 minutes ago, dizmo said:

What do you guys think? Innocent mistake? Am I over reacting to all of these apparent security mistakes?

 

Security mistakes should never be made by million dollar+ companies really, OnePlus got caught with their pants down in the mens room and it's pretty awks when your son walks in on them

[dizmo]

27 minutes ago, Crunchy Dragon said:

It runs Android, correct? Android is open source, yes? If you knew code and all that one could theoretically edit the version of Android running on that phone to not report any of that kind of stuff. Although most people probably wouldn't do that

I believe those are called custom ROMs

19 minutes ago, Oshino Shinobu said:

One Plus's business practices have always bugged me a bit, a lot of their marketing comes off as kind of cocky and aggressive. They've had quite a lot of controversial things pop up in the news, like that time they tried to get women to take selfies in order to get a chance to buy the phone by being voted on. 

 

Mistake? Maybe. Innocent? Not at all. Just dumping unencrypted data in an insecure place isn't an innocent mistake, it's a pretty serious mistake through negligence. Doing it after being called out for something similar before isn't acceptable. 

 

I've never really considered One Plus phones, there has always been something about the company that has put me off a bit. Might have nothing to do with this, but I've never really liked them based on their marketing

Oh man don't even get me started on their marketing, though I did make a fair bit of money off their first invitational.

The first phone was impressive for the price. Though, they lied there too, saying it was a 5.5" phone in a 5" phones body...when really, it was pretty massive. They changed their tune and said it felt like a 5" phone...but they'd already lost me. They've been liars since the very beginning.

14 minutes ago, Mooshi said:

One plus harvests data. Apple plays slap hands with authorities regarding data and I just have an LG minding my business over here.

I mean, I'm sure the other companies do to some degree as well, I just imagine they do it a little more securely

9 minutes ago, SC2Mitch said:

Security mistakes should never be made by million dollar+ companies really, OnePlus got caught with their pants down in the mens room and it's pretty awks when your son walks in on them

LoL, interesting way of putting it...

I agree though. They can't use the excuse of being young when it comes to matters like this, it almost just seems like it should be common sense. Then again, that's not that common anymore...

[BuckGup]

18 minutes ago, Mooshi said:

One plus harvests data. Apple plays slap hands with authorities regarding data and I just have an LG minding my business over here.

All while the NSA harvests everything 

[Crunchy Dragon]

8 minutes ago, BuckGup said:

All while the NSA harvests everything 

That's kind of their job, it's not exactly something anyone could do something about it

[Septimus]

About to buy a OnePlus 5T. I'll probably end up blocking whatever services/apps that do stuff like this.

[BuckGup]

57 minutes ago, Crunchy Dragon said:

That's kind of their job, it's not exactly something anyone could do something about it

To illegally spy on Americans? 

[TrigrH]

If ur worried and own a OP phone, install lineage OS on it.

[Droidbot]

2 hours ago, Mooshi said:

One plus harvests data. Apple plays slap hands with authorities regarding data and I just have an LG minding my business over here.

LG probably gather data also. 

 

Also have fun with rooting slowing down the device, thanks LG

36 minutes ago, BuckGup said:

To illegally spy on Americans? 

Illegally? 

[dizmo]

57 minutes ago, huilun02 said:

Meh

https://www.google.com.sg/amp/s/forum.xda-developers.com/oneplus-5/themes/magisk-oneplus-analytics-disabler-t3686636/page7/amp/

 

https://forum.xda-developers.com/oneplus-3/oneplus-3--3t-cross-device-themes-apps--mods/aroma-oos-debloater-t3615828

One shouldn't have to do that though...

[Guest]

10 minutes ago, dizmo said:

One shouldn't have to do that though...

Yes, but with Chinese OEMs I figure it would be best regardless of the company's reputation.

[Crunchy Dragon]

3 hours ago, BuckGup said:

To illegally spy on Americans? 

That's not illegal in any way, the NSA's purpose is to monitor national security, hence the name "National Security Agency"

[Not_Sean]

8 minutes ago, Crunchy Dragon said:

That's not illegal in any way, the NSA's purpose is to monitor national security, hence the name "National Security Agency"

Well yes and no, the problem is they have been caught a few times spying on people in other countries which frankly is none of their business.

[Crunchy Dragon]

1 minute ago, Not_Sean said:

Well yes and no, the problem is they have been caught a few times spying on people in other countries which frankly is none of their business.

Ok that makes sense, but he specified "Americans" and said spying on Americans was illegal and I was pointing out the fact that he was incorrect, I agree with you, spying on other countries like that is none of their business

[BlueChinchillaEatingDorito]

Long story short, every company you'll ever use, will collect your user data. 

[dfsdfgfkjsefoiqzemnd]

4 hours ago, BlueChinchillaEatingDorito said:

Long story short, every company you'll ever use, will collect your user data. 

Speaking of companies that collect your user data, this thread is brought to you by tunnel bear!  The simple and free to try VPN service that ...

 

 

Joking aside, there are companies that don't track you or collect your data, but those are few and far between.  People won't ever know for sure because they don't believe such claims anymore due to too many other companies making false claims about not tracking you.

[Matu20]

People boycotting Oneplus is so hypocritical to me, all the big companies do a lot worse and people turn blind eyes to them. Bash and boycott one, you bash and boycott all of them.

[Bananasplit_00]

well i already had no trust at all in OnePlus after the first one, this just drives it home even more. 

[TheRandomness]

I still don’t get why people care so much. If a company doesn’t get data on how you use your device, then how are they suppose to know how to improve the device for the general user? Also, if you’re storing important and sensitive data oh a phone, something that can be forcefully unlocked and/or stolen from you, you’re making a mistake. 

[suicidalfranco]

2 hours ago, TheRandomness said:

I still don’t get why people care so much. If a company doesn’t get data on how you use your device, then how are they suppose to know how to improve the device for the general user?

1. ask the people lurking your forum

2. ask your customer if they want to be your guinea pigs

3. use third parties for market research