Hacker News Reader

Comment by madez | Hacker News Reader

I backed the Pebble Time on kickstarter but recently canceled the pledge due to privacy concerns.

Why do companies think that it is okay that devices, that customers carry all day long on them, phone anywhere unless they are told so and controlled by the user?

By default, I do not agree to collection of any data about me, not even anonymised.

I'm increasingly concerned that it seems that hardware companies try not to only sell the product, but also to never give up control of the individual products. What can we do about that?

I'd happily buy an even considerately more expensive iPhone, if it'd only put me in ultimate control.

View on HN

Gadgetbridge is a FOSS companion app for Pebble and other devices that seeks to put users back in control of their data. I don't believe it has Pebble Time support yet,and the feature set is limited, but it looks promising. https://fossdroid.com/a/gadgetbridge.html

Thanks for pointing out Gadgetbridge. While informing myself before deciding to cancel my order of the Pebble Time I already found it. However, afaik the Pebble Time is not supported by Gadgetbridge and I didn't want to buy a product I maybe can't use.

Thank you for sharing this! I had no idea it existed before, but this sounds like exactly what I've been looking for.

I want to find out if it needs to make the same requests to zalew.net.pl as the official Android app in order to configure my Pebble!

I agree. It worries me that finding out exactly what data your device or software shares with whom is very hard to find nowadays. You buy something without really knowing what it does.

This is not really new (how many people, even today, are aware that most color laser printers embed their serial number on every page they print?) but the rise of ubiquitous mobile computers equipped with a camera, an always-on microphone and permanent net access raises grave privacy concerns.

Can you elaborate on what data you think Pebble is collecting?

Yes, sure. From http://pages.getpebble.com/pages/privacy I quote

    We may collect information such as occupation, language, zip code,
    area code, unique device identifier, location, and the time zone
    where a Pebble product is used.

and

    We also may collect information regarding customer activities on
    our website, Pebble Android App, Pebble iOS App, account.getpebble.com
    services and from our other products and services.

and

    We may collect smartphone device-specific logs which, for example,
    include your hardware model, operating system version and unique
    device identifiers.

I'm not okay with any of these rules.

Huh. Well, I don't really have a problem with any of those except maybe location, and that's behind a privacy setting in iOS. Pebble also provides an option to opt out of sending the anonymized data, which puts them on better footing than most apps and websites these days. Thanks for actually posting info though :)

I understand, accept and respect your point of view, but I don't share it.

I want devices I bought to solely work in my interest. So, the system must not send data on its own anywhere unless I was notified and I agree. Please note, this issue is ideally orthogonal to software freedom, even though in practice they correlate positively.

Not everybody agrees with me on this and it's fine. However, there could be a more diverse market, I think. I could imagine two versions existing: one "normal" and one privacy-respecting version. I wouldn't even mind if the latter would be more expensive.

I've given up on companies and developers respecting my privacy. Not because they're all evil, but because it doesn't scale. There's an unlimited number of companies that you would have to deal with.

Use a firewall that blocks or MITMs all outbound network requests by default. It's the only way to know what every app is calling home to and reporting about.

Think about it, which scales better? Raise your point of view with the developer of every app you want to use, or putting blanket protections in place at the gateway level one time and performing minor whitelisting tweaks (that you can do yourself!) over time?

I just fear for all those who don't know any better.

How do you browse internet with this setup?

When a site is blocked, I can enter a username and password to override the block, or I can choose to whitelist that traffic. Different devices have different policies applied to them re what to block.

These approaches are not exclusive and both are recommendable.

Did you know that if you attempt to configure your pebble from your phone, that requires a connection to some server hosted under a domain name that as far as I can tell has nothing to do with pebble?

Use a MITM proxy and see for yourself.

My firewall blocks outbound requests by default so when I found I wasn't able to configure my pebble without allowing this traffic, I just said fuckit and left my pebble unconfigured. If I knew about this before I bought it I never would have agreed to the purchase.

Edit: Pulled the host that it wants to talk to from DNS logs, zalew.net.pl. If I don't allow traffic to that domain, I can't configure my pebble.

Edit: This is from an Android phone, I can't speak for the iOS app.

Whoa, I was actually looking into buying one, but this is actually really disconcerting and totally off putting.

I think so too.. I sent them an email asking them to respond to his post.

Might that be related to a watchface that you already installed on your watch / downloaded to your app, perhaps the Modern watchface? http://www.mypebblefaces.com/apps/1486/1299/

The domain name seems belong to this gentleman: http://forums.getpebble.com/discussion/4453/light-enable-int...

There must be a relationship here because I do indeed have that watch face installed.

Though, without allowing that traffic, I don't seem to be able to remove that watchface, and cannot get into the Settings screen in the Pebble Android app to configure anything else.

Dear downvoters, without articulated critique I don't know what to improve.

Ignore any votes, up or down, in the first half-hour. They tend to balance out over time, as they have here.

Reply on news.ycombinator.com