News for hackers. Stuff that matters.
Re:Line app allowed Chinese firm to access personal user data by sloshnmosh on Wednesday March 17, 2021 @10:35AM (#26491815)
I purchased an Alcatel smartphone several years back and about a week after the device received a firmware update I started getting weird pop-ups with fake virus warnings that led to some bogus cleaner app on the Play Store.

I started examining the apps on my phone and saw that all the preinstalled system apps had been modified to siphon off social media data to Chinese servers.

I collected as much information as I could to report the manufacturer to the Facebook.

Several months later the New York Times reported that Facebook had been allowing cellphone manufacturers (including Alcatel) to access users social media data regardless of what privacy settings the user had set because FB considered them “Trusted partners”

Alcatel has been found to have placed backdoors with root access and hard coded credentials in TCL branded televisions and their smartphones have been reported for DNS rebinding attacks to TCL clouds and also having packet sniffers in their low-end smartphones.

Re:Line app allowed Chinese firm to access personal user data by swiley on Wednesday March 17, 2021 @11:43AM (#26492754)
This is where the Android security model really falls apart: The assumption that the ROM publisher/device manufacturer is trustworthy (or even just not pathologically hostile) is often false and the immutable OS means even technical users struggle to remove malware.

IMO: this sort of stuff means the pinephone actually has a better UX than the cheaper android phones despite calls and SMS often not working because the basic "computer with cellular data" works exactly the way you would expect.

Re:Line app allowed Chinese firm to access personal user data by throw98117 on Wednesday March 17, 2021 @02:08PM (#26494830)
This doesn't apply to the Pixel phones. If one wants not too expensive, Pixel 4a seems good.
Re:Line app allowed Chinese firm to access personal user data by 908B64B197 on Wednesday March 17, 2021 @03:42PM (#26495930)
There's a reason why iPhones are so popular.

Hint: it's not marketing.

Re:Line app allowed Chinese firm to access personal user data by bloqs on Thursday March 18, 2021 @06:52AM (#26501383)
iPhones are popular because of a monolithic product that doesnt try and depart from the core brand and feel of the OS with manufacturer quirks (ie. Why Samsung and Huawei feel so different). Their marketing is very much the reason:

iPhones are pitched and priced to appeal to the highest social status possible, the rest bleeds down from there.

The percentage of people who buy iPhones specifically because of debated security benefits is substantially smaller. People who may have heard this but dont know/understand it will find it simply reinforces their existing preference for an iPhone on the earlier grounds.

Re:Line app allowed Chinese firm to access personal user data by jareklupinski on Wednesday March 17, 2021 @04:36PM (#26496472)
no it's marketing
Re:Line app allowed Chinese firm to access personal user data by wdutch on Wednesday March 17, 2021 @08:41AM (#26490226)
> Most of Line’s 86 million userbase is made up of Japanese users

The app is also ubiquitous in Taiwan and Thailand from my personal experience. It's very bad news for Taiwan if the PRoC has been snooping on its citizens.

Re:Line app allowed Chinese firm to access personal user data by samcheng on Wednesday March 17, 2021 @01:47PM (#26494569)
It's very bad news for LINE if the Taiwanese people view it as a tool for the PRC...
Re:Line app allowed Chinese firm to access personal user data by euske on Wednesday March 17, 2021 @09:38AM (#26491029)
Sigh. This is all not surprising at all, and I'm certain that the government officials and the company high-ups are helpless. There's a great division between the geeks and suits in Japan (this division certainly exists in the US but it's much bigger here). Experts are proud of not stepping into other fields (that'd be insolent), and managements tend to boast not knowing the technical details (too mundane to them). There were a few notable high-stake failures in the past weeks (including nationwide ATM glitch and COVID tracking app bugs), and I'd bet there will be a few more to be revealed. Sadly Japan is such a backward nation now.
Re:Line app allowed Chinese firm to access personal user data by eric4smith on Wednesday March 17, 2021 @10:30AM (#26491739)
We use LINE here in Thailand for business and personal - more than any other chat app. If you don't have LINE, you really can't communicate very well in Thailand.

But their technology sucks.

They don't have typing indicators. Vietnam, Japan, Thailand are separate fiefdoms, there are certain things you can't do across countries.

To open a business account you have to pay a secondary firm in Thailand who barely has anything to do with LINE.

The whole UI is super-clunky and has many bugs.

We get the feeling that they do not really care about the product itself. They keep adding lots of features for business that don't really work.

But everyone here uses it, so you really have to get on board.

Re:Line app allowed Chinese firm to access personal user data by Legogris on Wednesday March 17, 2021 @08:23AM (#26490063)
I recall LINE having indicators similar to WhatsApp for conversations stating that they were end-to-end encrypted - was that all a complete lie? Or are there side-channels enough that it's technically true but practically meaningless?

Also, for anyone who doesn't know, LINE is ubiquitous in East Asia and parts of South East Asia. In Japan and Korea, everyone and their grandmother are there. Not being on LINE here is "worse" than not being on FB in the west.

Re:Line app allowed Chinese firm to access personal user data by wodenokoto on Wednesday March 17, 2021 @08:45AM (#26490289)
According to the other story on the front page earlier today about this, the messages are encrypted but the firm had access to user information - name, email phone number. That kind of stuff.

https://news.ycombinator.com/item?id=26488445

On a different note: Has KakaoTalk gone out of fashion in korea? I thought line was mostly Japan and Taiwan and korea was KakaoTalk, China WeChat and everywhere else WhatsApp.

But I have noticed line appearing in some never kdramas.

Re:Line app allowed Chinese firm to access personal user data by viceroyalbean on Wednesday March 17, 2021 @11:14AM (#26492355)
LINE has never had any significant market share in Korea, it's 100% Kakaotalk. LINE does have a large amount of development going on in Korea, however.
Re:Line app allowed Chinese firm to access personal user data by Agentlien on Wednesday March 17, 2021 @02:17PM (#26494929)
That's interesting. I recently noticed LINE showing up in a number of Korean shows on Netflix and I wondered how popular it was over there.
Re:Line app allowed Chinese firm to access personal user data by viceroyalbean on Wednesday March 17, 2021 @09:21PM (#26498829)
I wonder if it's actually an indication of how unknown it is. Korean media is usually very precise with showing brands - if you can see a logo it's almost definitely product placement. Using a relatively unknown app allows them to avoid showing something recognizable.

This is just an idea though, I have no real basis for the claim. I have noticed the same thing, though.

Re:Line app allowed Chinese firm to access personal user data by wodenokoto on Friday March 19, 2021 @03:31AM (#26510818)
They prominently displayed the line characters, Brown and Cony in a message chat between the two main characters in 2015s "Hyde Jekyll Me" on Netflix.

I doubt you'd do that as a mean to show a generic chat. I think that is more of an attempt to make inroads in Korea (or perhaps pandering to viewers outside Korea)

Re:Line app allowed Chinese firm to access personal user data by Legogris on Wednesday March 17, 2021 @09:17AM (#26490728)
It's a couple of years since I spent extended time there, but if there's anything I know it's that Koreans move fast, so I wouldn't be surprised if I'm slightly off there.

It's absolutely the case in Japan, though.

LINE is bigger than WhatsApp in Taiwan and I think Thailand, though.

Re:Line app allowed Chinese firm to access personal user data by philliphaydon on Wednesday March 17, 2021 @09:52AM (#26491225)
I’ve never met anyone in Thailand or Taiwan who don’t use LINE.

It’s also my primary messaging app. What’s App is only used for business stuff in Singapore.

Re:Line app allowed Chinese firm to access personal user data by goatinaboat on Wednesday March 17, 2021 @09:38AM (#26491026)
I recall LINE having indicators similar to WhatsApp for conversations stating that they were end-to-end encrypted - was that all a complete lie? Or are there side-channels enough that it's technically true but practically meaningless?

The metadata - who talks to who and when - in many cases is more valuable to an adversary than the actual content of the messages. All the crypto in the world doesn't help once the identity of one person you associate with becomes "of interest" you are of interest too and old-fashioned methods can be used.

Re:Line app allowed Chinese firm to access personal user data by fomine3 on Wednesday March 17, 2021 @08:08PM (#26498362)
Messages are E2E encrypted by default. When a user reported abuse, messages are sent to LINE corp without E2E encryption so their employee or contracted company can read only reported message
Re:Line app allowed Chinese firm to access personal user data by shantara on Wednesday March 17, 2021 @11:26AM (#26492538)
End-to-end encryption doesn't matter, if the app itself is backdoored.
Re:Line app allowed Chinese firm to access personal user data by deepstack on Wednesday March 17, 2021 @08:37AM (#26490180)
icons!
Re:Line app allowed Chinese firm to access personal user data by threatofrain on Wednesday March 17, 2021 @08:55AM (#26490408)
IMO it’s increasingly obvious that regardless of how a company is structured, tech companies situated in a nation are inescapably related to geopolitical security matters.

They are all easy targets for intel and manipulation, and any nation that cannot manage its own tech faces uncomfortable strategic vulnerability.

Re:Line app allowed Chinese firm to access personal user data by swiley on Wednesday March 17, 2021 @08:38AM (#26490189)
There are zero (0) secure chat apps that are centralized. Use jabber with OMEMO or delta chat if you really need an IM style UI.
Re:Line app allowed Chinese firm to access personal user data by fouric on Wednesday March 17, 2021 @12:27PM (#26493376)
Isn't Signal both secure and centralized?
Re:Line app allowed Chinese firm to access personal user data by swiley on Thursday March 18, 2021 @06:46AM (#26501346)
They can easily force updates that exfiltrate keys. You have no choice but to use a recent version of the only client and you have no good way of verifying that the it was built from what's on github.
Re:Line app allowed Chinese firm to access personal user data by WentFullRetard on Wednesday March 17, 2021 @04:21PM (#26496308)
If you want to trust that go ahead. There's been quite a few changes within the past year and a half that lead people to believe otherwise. All their servers are also US based. Remember Lavabit?
Re:Line app allowed Chinese firm to access personal user data by amelius on Wednesday March 17, 2021 @10:23AM (#26491626)
How is this possible? Aren't app stores supposed to protect us from this?
Re:Line app allowed Chinese firm to access personal user data by nowherebeen on Wednesday March 17, 2021 @09:59AM (#26491331)
I have been using Line app for the last few weeks and I am not surprised. Line itself sends me a ton of spam per day and you aren’t allowed to delete message once sent. The general feel I get is that they aren’t too focused on security or code quality. I am pretty sure none of the text messages are encrypted and any employee can browse at anytime.
[dead]
Re:Line app allowed Chinese firm to access personal user data by dragonelite on Wednesday March 17, 2021 @12:02PM (#26493007)
I just assume every thing from a big tech company is spyware, data is way to valuable.
Re:Line app allowed Chinese firm to access personal user data by summm on Wednesday March 17, 2021 @06:14PM (#26497433)
Grab a random Chinese app, do a tiny bit of static analysis, and you will see that is quite justified...
Re:Line app allowed Chinese firm to access personal user data by Shadonototro on Wednesday March 17, 2021 @10:17AM (#26491555)
they definitely need team, azure, github, windows server and office 365/decade