Doctor Web discovered vulnerabilities in children’s smart watches

More people should consider open-source smart watches PineTime: https://www.pine64.org/pinetime/.

Moral of the story: don’t buy any old smart garbage off the internet. It probably doesn’t have your best interests at heart.

EDIT: Someone deleted the comment I was replying to, but I've put enough time into writing it that I'd like to post it as a separate one anyway. The original person, in short, was discussing how disgusting it is for companies to intentionally build ad-tech into their products like this and this was my reply.

--------------------

>"we should make smart watches for kids, and then sell the data to ad-tech companies, or use it to profile children so that we can make predictions about peoples adolescent and adult behavior based on categories of childhood behaviors that emerge from the data, and then leverage that data to charge them more for other products later in life."

I don't think you're wrong, but I do think (as someone who engineers IoT products for a living) that it's often the nature of large corporations putting employees into silo's that enable things like this, not necessarily that most people are morally bankrupt. It's more to do with ignorance and negligence.

I might design a device, and extract data from it to give back to the user to help them make informed decisions about their health (heart rate, sleep health, step tracking, device time usage etc.) All useful information to have that can arguably help make their life better. At no point do I want this data to be used for anything insidious - it's against my own principles, and according to the constant bombardment I get during corporate culture trainings, against theirs too.

Using the same tools that I created, a data scientist in the company takes this raw information and performs some analytics. They track how long the batteries last, what the network coverage is like, what locations these devices are used in etc. They use this data to produce actionable insights, in order to help make future products better and give the engineers some points to draw from, as well as to know what people are using it for. Again, they're not doing anything worrying with this information; they're simply trying to help improve visibility of the data with some nice graphs and such, ready to make the next product more efficient, reliable or affordable.

Here you reach the business folks. You're now a few degrees of separation from the people who made the product. The business people are looking for any way they can monetize the assets that they have. They find that they're sat on a mountain of data, which while intended to improve the lives of the people it was taken from or used to improve the next generation of product, has the potential for much more value beyond that. Some external customers are offering to pay a lot of money for this data, with the surety that it'll be used to help other companies design other great and valuable products. This is where I say the negligence comes in. All it takes is someone not doing their due diligence, and this data makes it's way to some scummy ad-tech company who are directly in the business of manipulation-for-profit.

I'm not trying to divert responsibility from any party here. I constantly question whether I'm in the right industry and should stop making these products as they have such potential for harm, but equally I think it can and has been a force for good (be it for energy saving, medical usage, industry optimization, or early disaster warning) and maybe following Luddite philosophy would equally be the wrong thing to do. It's a debate I have internally almost every day. I think we're moving in the right direction, using edge insights to perform all the privacy essential processing on the device instead of the cloud, and implementing new standards on how we store and use peoples data, but all it takes is a situation like the above for it to end up in the wrong hands.