eevBLAB 132 - Insta360 Ace Pro 2 Camera RANSOMWARE

[EEVblog]

The Insta360 Ace Pro 2 action camera comes with Ransomware out of the box. You MUST give them all your private data to register the camera through the app or it won't work. I'm sick of this crap, don't buy Insta360 or DJI products. And change your profile picture to a Clippy.

DJI Pocket 2 Ransomware:
Louis Rossmann Clippy:

[John B]

Let us know what the businesses say when you give feedback too, I do feel sympathy when they are caught in the middle and are perhaps unaware of the pitfalls of their product, but this crap has to be fought at every level.

I think you can even make a case with the guidelines laid out by the ACCC. Obviously being a government entity, they are very far behind when it comes to the technological landscape, so perhaps there's room to expand their guidelines too to include soft-locks and corpo-ransomware as specific breaches of consumer law.

[wilfred]

There is only one effective way to push back on this and that is to not buy it.

I don't buy action cameras so I don't know if they all do it and refusing to purchase is to effectively lock yourself out of the market.

I bought a cheap smart watch (it wasn't all that smart) out of a bargain clearance sale at K-mart for $10. I really only wanted the band which looked nice. So I didn't know anything about it. But I was shocked to find there was no way to even set the time without downloading an app and connecting it to a smartphone.

Aside from never getting around to having social media accounts (except youtube)  25+ years ago I bought a $1 disk to install a dial-up internet and email account. I never used it but I did create a dummy email account that I use for creating other accounts just so I can get the return authentication email. And I have an old smartphone that I use to avoid loading my real phone with junk.

I'm not paranoid about data privacy but I don't have to make it easy.

Not to want to sound snarky but how after having prior experience with this does one do it again? That was the question on my mind throughout. Especially someone who is not a regular consumer ignorant of technology. That's the key question. If a tech savvy person can buy it what chance is there for an unsophisticated consumer?

 

[EEVblog]

Let us know what the businesses say when you give feedback too

It's Amazon, so there will be no feedback.

[EEVblog]

Not to want to sound snarky but how after having prior experience with this does one do it again?

Huh? This is an entirely different company.
That's like asking why if Bosch screwed you over on your dishwasher, why buy another dishwasher from Miele?
Or if Tesla screwed you over on your EV, why buy a Hyundai EV?

None of the reviews I saw even mentioned this issue, it's not about being "tech savvy".
Heck, even Louis Rossmann got caught out with DJI several years after i made my video exposing this.

[Helix70]

Just curious, can you make up fake data for the registration? Maybe we all just need a fake persona that we use to use for these purposes.

[EEVblog]

Just curious, can you make up fake data for the registration? Maybe we all just need a fake persona that we use to use for these purposes.

Of course, but that doesn't send them a message.

[wilfred]

Not to want to sound snarky but how after having prior experience with this does one do it again?

Huh? This is an entirely different company.

Yes that is true but it wasn't my point. There have been a growing concern about companies encroaching on a buyers right to own and use their stuff without some insidious need to register it, tie it to a remote server or cloud service that can just stop. This is just one aspect of that.

You don't want to focus on too fine a point when consumer rights is a much broader issue. I watch LR too.

[golden_labels]

Just curious, can you make up fake data for the registration? Maybe we all just need a fake persona that we use to use for these purposes.

You can’t reasonably fake the data. You can fake your name or address, but nobody⁽¹⁾ cares about such stuff. It is with almost no value. The data they care about is the same as with Alphabet and majority of modern personal data market: ephemeral proxy variables or clicking “I agree” on the rights waiver. Oversimplified understanding of privacy and data is the tragedy for any attempt to push back. Because to most people privacy violations either don’t look like ones, or can be easily shrugged off with “it’s not done in private anyway” or “it is not data.”

So don’t think that by calling yourself Tux Kovalsky living in 0th Penguin Avenue, Antarctic is protecting you or is bringing any change.

(The above touches only the privacy aspect; of course with this camera other issues are probably more important!)

⁽¹⁾ Except those wishing to commit identity theft, but that is unlikely here and relatively rare in general.

[AndyC_772]

A while ago I bought a wi-fi base station that had a related issue. The user can configure it all locally, right up until the point at which it detects it has internet access, at which point the local UI is locked out and it absolutely insists on being remotely controlled using a Netgear account.

I sent it straight back and explained why; I like to hope that even if Netgear themselves don't care about the end user experience, their resellers can and will complain about the costs involved in refunding orders.

I gave the unit a 2 star review on the reseller's site, which to their credit they did publish.

These days I always download the full manual for any product I'm thinking of buying, and check for this sort of crap first. It's a shame I have to bother, and an even greater shame that most people don't.

[suzhiming]

Don't buy these electronic junk, but they are hard to distinguish.

[EEVblog]

So don’t think that by calling yourself Tux Kovalsky living in 0th Penguin Avenue, Antarctic is protecting you or is bringing any change.

That's why I sent it back.

[jh15]

I don't know about the latest models and victims, but my 8+ year Tesla S, I have full service manual pictures and procedures online, could d/l if needed.
     A few weeks ago, i was given notice that the 12 volt battery, being 8 years old, they l not update the latest software until replaced.

     The original lead-acid agm was from a reputable server back up system battery manufacturer.
     While being replaced in my driveway, the service tech was saying new 12 volt batteries are failing left and right, and expect to be lucky to replace in 3 years.
     Should have added old one to my ham radio and backup stuff, but it would not be good for WAF.

[rteodor]

Just curious, can you make up fake data for the registration? Maybe we all just need a fake persona that we use to use for these purposes.

https://datafakegenerator.com/generador.php

If enough people do then its "breaking the milk". But then the is the danger that there would be a powerful lobby to make registrations more strict with biometrics and id and "trusted computing" (trusted by corporations that is). As its already the case with online banking.

[golden_labels]

If enough people do then its "breaking the milk". But then the is the danger that there would be a powerful lobby to make registrations more strict with biometrics and id and "trusted computing" (trusted by corporations that is).

There is no reason for anybody pushing for that, because of what I wrote above. Your “official data” offers close to no value.

As its already the case with online banking.

Romania has some interesting banks! What you just wrote indicates, that banks beg the legislature to be regulated and required to employ procedures hurting their income.

Stronger identity checks are lobbied for mostly by the state: tax offices, law enforcement, and intelligence agencies. To some degree also by unrelated to business individuals or groups “aiming to protect society.” The banks, if expressing any interest at all, are either opposing such regulations or are forced to plead for them by another existing law.

The bank has no interest in your state-issued identity data, other than what is needed to know who they sign an agreement with. This is hardly an extravagant requirement, given the risk they take and what kind of services they offer.

[rteodor]

I had a TP-Link router that needed a f-king app to be able to set it up while the older ones (had 2) ran just fine without that crap. I bricked and tossed the damn thing because the return period expired. Does this qualify me for a clippy ?

The bank has no interest in your state-issued identity data, other than what is needed to know who they sign an agreement with. This is hardly an extravagant requirement, given the risk they take and what kind of services they offer.

Of course banks dont't care more than its absolutedly needed. They did not care back when authentication was based on matching together two pieces of a broken stick and they would'n care today as long as it works. But reality, you know... why banking apps refuse to run on jailbroken smartphones ?
Why is a smartphone required more and more often to do this shoddy registrations ? Why all large stores want an freaking app in my phone (enticing it with discounts) or at least a phone number ?

So aren't these "static id" data used as a proxy to get to more juicy informations to exploit one's vulnerabilities ?

You can’t reasonably fake the data.
[...]
Oversimplified understanding of privacy and data

Yeah but if its not faked it gets used. So it has to be fake. That is my inderstanding so far. I think I'll get back under my rock now.

[Brumby]

Not to want to sound snarky but how after having prior experience with this does one do it again?

Huh? This is an entirely different company.

Yes that is true but it wasn't my point.

So, what was your point?

[John B]

This is going to be an ongoing whack a mole game with companies finding new and novel ways to implement these things, so there's no point throwing shade on the customers. People are necessarily going to be screwed over in this process before knowledge spreads.

[Psi]

[wilfred]

Not to want to sound snarky but how after having prior experience with this does one do it again?

Huh? This is an entirely different company.

Yes that is true but it wasn't my point.

So, what was your point?

This which you cut out.

"Yes that is true but it wasn't my point. There have been a growing concern about companies encroaching on a buyers right to own and use their stuff without some insidious need to register it, tie it to a remote server or cloud service that can just stop. This is just one aspect of that.

You don't want to focus on too fine a point when consumer rights is a much broader issue. I watch LR too."

[BrianHG]

Yup, 'Defective.' is now my new return product reason why word...

Also, why do you need a cell phone and internet connection for these products?
What if you do not have a modern enough cell phone to install their app?

[BrianHG]

Just curious, can you make up fake data for the registration? Maybe we all just need a fake persona that we use to use for these purposes.

Of course, but that doesn't send them a message.

In eevblog video 132 - "in App Store or Google Play'....
This almost always means you will not be able to fake your data unless you have a separate cell phone with a phony cell plan and phony cell phone number.  The software will most likely demand access to your phone's ID and location to work.

[Deodand2014]

I picked up a radio (OXX Classic 600) recently at a flea market, one of it's features is the ability to pick up internet radio, but it could only be done by registering to a specific website, which apparently shut down in 2021. Thankfully the free to air broadcast features are not locked out, otherwise it would have been eWaste.

[Brumby]

Not to want to sound snarky but how after having prior experience with this does one do it again?

Huh? This is an entirely different company.

Yes that is true but it wasn't my point.

So, what was your point?

This which you cut out.

"Yes that is true but it wasn't my point. There have been a growing concern about companies encroaching on a buyers right to own and use their stuff without some insidious need to register it, tie it to a remote server or cloud service that can just stop. This is just one aspect of that.

You don't want to focus on too fine a point when consumer rights is a much broader issue. I watch LR too."

Ok then, not editing out the fluff.....  I will rephrase my question:

Since you are critical of what Dave has done here, what would you have had Dave do differently?

You didn't make that clear.

[wilfred]

Ok then, not editing out the fluff.....  I will rephrase my question:

Since you are critical of what Dave has done here, what would you have had Dave do differently?

You didn't make that clear.

Well my post goes on with this
"Not to want to sound snarky but how after having prior experience with this does one do it again? That was the question on my mind throughout. Especially someone who is not a regular consumer ignorant of technology. That's the key question. If a tech savvy person can buy it what chance is there for an unsophisticated consumer?"

I'm specifically trying to not be critical of Dave. And I generally don't like forum threads where individuals carry on a private debate in public.

Knowing others read forum posts even though they may not directly participate I was introducing a broader concept of the issue than just a single company and it's behavior. Irritating as that may be to be taken by surprise by such an outcome. It is nowadays not such an isolated incident that technically sophisticated consumers can reasonably be expected to be on the outlook for it. And especially if it has happened to them prior. So it then prompts the question how can a technically unsophisticated consumer be expected to navigate the insidious encroachment of such restrictions to ones free use of the product without also giving up personal data and possible future loss of function.

Louis Rossman advocates on the broader issue even when he uses topical examples to advance his case. If I were to be critical of Dave it would be that ranting on isolated issues may make him feel better (or perhaps not) but he has a platform to bring things into context. If unsophisticated consumers are to understand what effective response they can pursue to push back then they will need to have the dots joined for them to form the bigger picture.

So in the interests of what I thought was a more useful discussion I put my thoughts out there and if others wanted to they could expand with their own points.

I thought my post was perfectly comprehensible. And this is why I generally don't like public forum debate such as you and I are having about the post I made. To the broader forum audience in this thread it isn't of interest. No-one regards Dave as a sensitive snowflake unable to take up a defense of his own position. It is not entirely clear to me if you choose to pick apart my post because you do, or you were seeking to cast him in that light. Dave made a response that didn't seek to expand the discussion and it will eventually fade out. Many forum discussions I see here ramble wildly on all manner of tangents as a dwindling number of participants debate finer and finer esoteric points and eventually a small number are left having disenfranchised all others. I absolutely don't want to be one of those people.