eevBLAB 132 - Insta360 Ace Pro 2 Camera RANSOMWARE

[Brumby]

That's a lot of words.


While I won't dissent with anything said, that still didn't directly answer my question.  I can only infer - so let's do that...

... but how after having prior experience with this does one do it again?

There is a clear need to define EXACTLY what "it" is referencing.  Dave took it as a reference to purchasing the Insta360, whereas you appear to be referring to ANY tech purchase.  This is a detail that would have been better if spelled out clearly - which it wasn't.

But, more importantly, Dave explicitly stated that he had only experienced this rubbish with the DJI unit - that the GoPro didn't have any such restrictions.  So, out of a sample of two, one did things the way (some of us) have grown up with while the other added unnecessary restrictions.  To me, that would have one's expectations lean towards something - that doesn't NEED connection/registration/etc. to function - just working out of the box.  As such, it is entirely logical that Dave's discovery resulted in the reaction he has shared.

.... I was introducing a broader concept of the issue than just a single company and it's behavior. Irritating as that may be to be taken by surprise by such an outcome.

So (in contributing to an answer to my question) it seems you would have expected Dave to have researched the subject before making the purchase, thus avoiding disappointment.

It is nowadays not such an isolated incident that technically sophisticated consumers can reasonably be expected to be on the outlook for it. And especially if it has happened to them prior.

That is a fair statement, but since it only happened once before, I'm not going to harangue Dave about it - this time.  Certainly, he has now established a trend in this product market that will, no doubt, feature in future product encounters.

So it then prompts the question how can a technically unsophisticated consumer be expected to navigate the insidious encroachment of such restrictions to ones free use of the product without also giving up personal data and possible future loss of function.

Exactly!

In my opinion, by Dave being 'stung' on camera, with his reaction for all to see, he will have made a far greater impact than just trawling through pages and pages of T&Cs.  Even those of us who can stomach that sort of thing could lose focus.  That would be a much smaller audience reached than this video.

Louis Rossman advocates ....

Let me stop you there.  Louis does Louis.  Dave does Dave.  Having different takes on a common subject is how a wider audience is informed and, hopefully, invested in action.

If unsophisticated consumers are to understand what effective response they can pursue to push back then they will need to have the dots joined for them to form the bigger picture.

I completely agree, however, there are a lot of dots in a lot of areas to cover.  This is where Louis Rossmann is shining bright.  He has his Consumer Rights Wiki which goes into great detail on a wide range of subjects - including Ransomeware.  It's well worth checking out Consumer Rights Wiki  He also has a "call to arms" as it were encouraging people to change their profile picture to a Clippy.

Dave spends the last third of his video solely on what Louis is already doing.

So in the interests of what I thought was a more useful discussion I put my thoughts out there and if others wanted to they could expand with their own points.

I thought my post was perfectly comprehensible. And this is why I generally don't like public forum debate such as you and I are having about the post I made. To the broader forum audience in this thread it isn't of interest. No-one regards Dave as a sensitive snowflake unable to take up a defense of his own position. It is not entirely clear to me if you choose to pick apart my post because you do, or you were seeking to cast him in that light. Dave made a response that didn't seek to expand the discussion and it will eventually fade out. Many forum discussions I see here ramble wildly on all manner of tangents as a dwindling number of participants debate finer and finer esoteric points and eventually a small number are left having disenfranchised all others. I absolutely don't want to be one of those people.

I'm not interested in ad hominem at all.  I'm only interested in the main subject matter and if I see that being skewed, then I am motivated to address it.  Dave is big enough to look after himself and I'm not in the business of defending him.  He sometimes does things that I'm not a fan of or I find curious, but that's just my opinion and is often not worth sharing.

[EEVblog]

Not to want to sound snarky but how after having prior experience with this does one do it again?

Huh? This is an entirely different company.

Yes that is true but it wasn't my point.

So, what was your point?

This which you cut out.
"Yes that is true but it wasn't my point. There have been a growing concern about companies encroaching on a buyers right to own and use their stuff without some insidious need to register it, tie it to a remote server or cloud service that can just stop. This is just one aspect of that.

I'm with Brumby, what is your point? There doesn't seem to be a point there.
My video is literally fighting back against this practice, so 

[EEVblog]

I'm specifically trying to not be critical of Dave.

LOL, you are (in)famous for taking issue with almost everything I do or so.

I thought my post was perfectly comprehensible. And this is why I generally don't like public forum debate such as you and I are having about the post I made. To the broader forum audience in this thread it isn't of interest. No-one regards Dave as a sensitive snowflake unable to take up a defense of his own position. It is not entirely clear to me if you choose to pick apart my post because you do, or you were seeking to cast him in that light. Dave made a response that didn't seek to expand the discussion and it will eventually fade out.

Again I'm with Brumby here, what more did you expect me to do? 
I even mentioned and linked to Louis' video.
I did a video showing the true out of box experience and exposing what Insta360 are doing here, something which I don't think anyone else on Youtube has done.
Do you want song and dance girls?

Again, tell me specifically what you think I should have said or done?

[EEVblog]

FYI, Insta360's response:

[golden_labels]

FYI, Insta360's response:

PR bullshit that literally hurts my brain with being illogical.

[John B]

I would respect it more if they just posted a GIF of that guy from South Park rubbing his nipples.

[thm_w]

PR bullshit that literally hurts my brain with being illogical.

There is a grain of truth to it. If you receive a clone DJI camera and try to register it with DJI, presumably, it would fail.

Whether this is actually an issue these days, no idea. There seem to be less clones now and more just alternate competing brands popping up, that will still clone the camera shape/design but clearly put their own name on it.

[themadhippy]

Loada bollox, plenty of ways to prove if something is genuine without the need of an app.

[thm_w]

Loada bollox, plenty of ways to prove if something is genuine without the need of an app.

You'd be entering your details to register the camera regardless of if it was an app or not, so not sure what your point is, unless its purely "anti-app". Which I get, they could make it more clear on the box.

[themadhippy]

You'd be entering your details to register the camera regardless of if it was an app or not, so not sure what your point is, unless its purely "anti-app".

whos on about registering,the claim is its to prove its genuine

[thm_w]

whos on about registering,the claim is its to prove its genuine

Because to prove its genuine the serial number would be marked as activated once someone has bought it, otherwise a clone would just use the same serial number for all of their devices. Maybe some kind of challenge response code could work but I've never seen anyone do that.

The app also means the user is forced to upgrade the camera firmware (which I'm sure people will complain about), but ultimately means less returns for FW issues.

[Bud]

"And if it is not genuine, we will brick it."

[rteodor]

"And if it is not genuine, we will brick it."

"And if it is not genuine, future subscription is not paid we will brick it."

[kite31]

What private data do they want?

Having been on the internet since the early 90s, I assume the following is all known about me to anyone who delves:

• Name
• Current address (and some former)
• At least one of my e-mail addresses, most likely the one I used from my old company
• Phone (a unique identifier since 2000)
• Birth date (despite falsifying that since the early 2000s)

Every time I buy something on line all but the DoB will be disclosed. Any other question, I lie.

I have various other protections but for the moment, why should I worry too much about that which is assumed already available to a bad actor? As for marketing, reputable companies have an unsubscribe while for the rest my spam filter more than earns its keep every day.

Subscription models are something I am happy to be irritated about, and DJI's excuses are obviously paltry but do they really require any true answers to their query at all? You can delete the app after registration and I have two options for protection against data harvesting while the app exists.

[BrianHG]

FYI, Insta360's response:

If the camera wasn't genuine, then why-TF would a fake competitor's product request to download a third party app designed specifically for a the Insta360's camera brand?

How in the world does Insta360's response may any sense at all?

[thm_w]

If the camera wasn't genuine, then why-TF would a fake competitor's product request to download a third party app designed specifically for a the Insta360's camera brand?

How in the world does Insta360's response may any sense at all?

This is no different than saying: why do I a legitimate windows license owner have to enter a license key and register when a counterfeit copy can just be used without registration? I'm not agreeing with the practice, but this is a basic licensing/activation process.

[EEVblog]

How in the world does Insta360's response may any sense at all?

It doesn't, because they are lying.
The real reason is they want to harvest your data.

[EEVblog]

I have various other protections but for the moment, why should I worry too much about that which is assumed already available to a bad actor? As for marketing, reputable companies have an unsubscribe while for the rest my spam filter more than earns its keep every day.

Subscription models are something I am happy to be irritated about, and DJI's excuses are obviously paltry but do they really require any true answers to their query at all? You can delete the app after registration and I have two options for protection against data harvesting while the app exists.

It's people with views like this that they rely on to normalise this process so everyone just accepts it.
The only way to beat this is to send them a message by returning the product as faulty. Just inputting fake data just normalises the process.

[kite31]

You have not explained why it is a virtue to conceal information already available, repeated with every purchase. The "lie extras" are irrelevant.

[EEVblog]

You have not explained why it is a virtue to conceal information already available, repeated with every purchase. The "lie extras" are irrelevant.

Do you want to have to register every product before you use? Is this the world you want? If so, why?
With a camera I just want to take out the box and record video to the SD card, nothing more.

What if every toaster made you register before using it? Every fridge? Every appliance?

[golden_labels]

PR bullshit that literally hurts my brain with being illogical.

There is a grain of truth to it. If you receive a clone DJI camera and try to register it with DJI, presumably, it would fail.

Now explain, why would a fake device force registration.

The Windows example is not giving any answer, because in that case it’s still Windows that is being distributed. It’s an unlicensed distribution, but it’s still the same “item.” In the same domain, a more accurate parallel would be arguing, that Windows requires creating an on-line account to prevent people from using ReactOS disguised as Windows.

What private data do they want? (…)

A spot-on example of what I meant writing in the earlier post: “Oversimplified understanding of privacy and data is the tragedy for any attempt to push back. Because to most people privacy violations either don’t look like ones, or can be easily shrugged off with ‘it’s not done in private anyway’ or ‘it is not data.’”

[kite31]

I think my point was missed so I shall try to explain more clearly.

If I were to disclose things I won't for privacy reasons, you might think me paranoid rather than slack. The following might clarify a little anyway.

I never register appliances because consumer law protects me, as I know from experience.

I research products on the internet and by reading manuals prior to purchase, so I know the context in which to choose.

I purchase apps and refuse subscriptions. In the app store I always go straight to the "Data collected" section before reading further about it. I have a further protections against potentially intrusive apps but that is unimportant right now. I do not use clouds but inter-machine sync or a well-protected private server where I need that.

I described the manufacturer's excuses above as paltry. I could have used a stronger term, yet my question remains because risk management involves protecting things worth protecting while recognising what has already been captured, or can be afforded.

If I had an interest in that camera (I don't) then I would research further to determine what information was actually required, whether the connection was one-off, and then decide. If necessary I could deal with it in a sandbox/quarantine but I would have to be highly motivated to buy with no alternatives before going to that trouble.

I hope I have made myself clearer.

[kite31]

“Oversimplified understanding of privacy and data is the tragedy for any attempt to push back. Because to most people privacy violations either don’t look like ones, or can be easily shrugged off with ‘it’s not done in private anyway’ or ‘it is not data'.

An oversimplified understanding of privacy and data is exactly what I am pushing back against. Risk management includes not jumping at shadows, knowing where is the main game.

You have in your sig a reference to NIST on passwords, wherein it decries requiring unnecessary password changes. Exactly right, and something I knew decades ago when I was not bothering to change my outstanding, non-leaked, password despite "advice" from a bank. Assess the actual threat.

[thm_w]

Now explain, why would a fake device force registration.

We went over that, it wouldn't, unless you try to use DJI app or software on it.

The Windows example is not giving any answer, because in that case it’s still Windows that is being distributed. It’s an unlicensed distribution, but it’s still the same “item.” In the same domain, a more accurate parallel would be arguing, that Windows requires creating an on-line account to prevent people from using ReactOS disguised as Windows.

The clone can be the same physical item produced on ghost shift, or contain the same processor running the same code, or be an entirely different product design, I'm not sure why it matters. Obviously the main reason they want a registration is probably sales tracking and marketing, but there are clearly other possible reasons (simplify warranty, counterfeiting, stolen property, recall notices, etc.).

[EEVblog]

The clone can be the same physical item produced on ghost shift, or contain the same processor running the same code, or be an entirely different product design, I'm not sure why it matters. Obviously the main reason they want a registration is probably sales tracking and marketing, but there are clearly other possible reasons (simplify warranty, counterfeiting, stolen property, recall notices, etc.).

Which should be the choice of the customer if they want to register for that.
There is no excuse for crippling the product out of the box and forcing registration.