That’s a weak excuse IMO. Firstly, the WiFi logic is probably entirely handled by Android, so the app doesn’t have to do anything with that. And that also doesn’t explain the WiFi names in logs. Or are they parsing their own logs to determine which WiFi to connect to? If it’s some structured data or a database, I would get it, but they surely aren’t logging something to reconnect to the mentioned WiFi names later.
The app handles the process of connecting to a WiFi network.
It doesn't have a standard Android interface. The only interface is through the Rabbit app, so by definition the app must also handle WiFi at some point.
The already released an update to reduce logging before this blog was posted.
I'm not defending their initial over-logging as a good security choice, but I do think it's being greatly exaggerated in this comment section. If you could access the device's storage, you could access the WiFi network name, period. The fact that it's in the logs, not just the config files/db, doesn't raise the severity of any vulnerabilities.
Per the article, this is a new development. It originally shipped with the Settings app, albeit hidden. They could have easily linked to the WiFi page; I have a hotspot which does just that but overall obscures the Settings page away.
> They could have easily linked to the WiFi page;
The device has an extremely small display and no keyboard. The stock WiFi settings app would not be a good experience.
It's great they don't log that now, but that doesn't magically fix what they've been doing, unnecessarily, for months.
You're also going out of your way to defend Rabbit in this thread, with several multi-paragraph posts rebutting the same things. If they're not paying you, they certainly should be.
Where do you see that they're sending it to their servers? The article doesn't say that WiFi names were sent to the servers.
> You're also going out of your way to defend Rabbit in this thread, with several multi-paragraph posts rebutting the same things. If they're not paying you, they certainly should be.
No, I'm just correcting misinformation in this comment section. Some people are apparently only here to pile on Rabbit regardless of the truth, but the rest of us are actually curious about the facts of the situation.
It was unkind of you to write up an elaborate accusation just because you felt frustrated.
There's one very obvious reason why they they don't use the Android Settings app: it's built for displays at least 2x as tall. (some of the dozens more in [1])
Additionally, a major point of frustration for you seems to be a perceived refusal to admit there's no reason to send WiFi info to the server. TFA doesn't claim they are. Just logged locally in files.
Note everyone along the way clearly said "this is bad and I don't like it" along with facts they were trying to communicate --- its really annoying to have to add those disclaimers because people might be on edge, I can't imagine how frustrating it was to add them and still get the personal attack.
source: I have no love for Rabbit. I left Google in October to found an AI startup. At Google, I worked on Android for several years.
[1] it's unskinned, has a bunch of unnecessary settings, would complicate it with legacy nonsense in what was sold as simplification of legacy nonsense, and they're using something that makes it the face of the device (setting their APK as launcher? kiosk mode?).
Accusations of shilling for a company is not only uncalled for, in my eyes it greatly weakens your argument because I will have to assume that all you have left are ad hominems. Let your arguments stand on their own and leave the insinuations out of it.
It's basically saying that someone shouldn't care how weak your claims are because it's a business you're wrong about.
It doesn't work against people who care about the truth.
Also, logging WiFi connections theoretically does raise the severity of vulnerabilities because it stores metadata you wouldn’t have if you only store all access points you ever connected to. If you have an access point called „tabledance gentleman’s club guest“ in your access point list, I know you probably went there once. If you’ve been married for a year and I see that you still connect to it every Saturday evening, that’s a lot more sensitive.
It's probably useful for knowing roughly where you are, and location is used for context. For example, you're connected to your home wifi so when you ask for the weather it can use that location quickly without looking up your location from an IP location service. I'm not saying it's a good idea, but I do see how it could be useful... not to mention locking GPS satellites more quickly.
(And yes, it is sent periodically regardless of what you're doing, not as part of specific queries)
Is this sent to the server all the time? Or just with requests? It shouldn't come as a surprise to anyone that a device designed to respond to questions like "What's a good restaurant near me?" is also sending location context with requests.
If they're sending a constant stream of location all the time for no reason, that would be concerning.
> Your WiFi network name. ... Your internet-facing IP address. The user token used by the device to authenticate with Rabbit's back-end API.
A device must store WiFi network names to reconnect to them. An IP address showing up in local logs isn't really surprising either.
Storing the user access token on the device is also a necessity for reconnecting without logging back in every time you turn it on. The fact that it's stored directly in logs isn't a good practice, but when those logs are stored on the same storage as the db or config file that contains them, it's also not really a new issue by itself. If they were uploading logs directly to their servers, that would be an issue of course.