MS uses kill swithc to revoke certs - Windows Phone 7 General

http://pocketnow.com/windows-phone/...&utm_campaign=Feed:+pocketnow+(pocketnow.com)
this damn phone is more locked down than Alcatraz...

Thats not so. You can read it in another Thread in this nice Forum.
If happens so in Future, MS will loose more customers
Sent from my HTC HD7 using Board Express

Told you so!
Sent from my SGH-T959 using XDA App

as mentioned in there... you can just reapply the unlock. let's see what happens from the chevron boys before jumping the gun.
edit: and here we go... http://mobilitydigest.com/microsoft-did-not-relock-chevron-unlocked-phones/
In our preliminary discussions with Microsoft, we were surprised to hear that after a short amount of time — approximately two weeks — phones unlocked via ChevronWP7 would revert back to their original locked state. We couldn’t verify this claim at the time and didn’t look into it again.
Our bad. Don’t panic, though!
Contrary to circulating reports, Windows Phone 7 devices unlocked via ChevronWP7 are not being targeted by Microsoft. Instead, the phone is reverting back as a result of a periodic check. Simply put, the phone rings Microsoft and asks “Hey, am I supposed to be unlocked?”. If Microsoft responds with a “No, what are you thinking?”, the phone apologizes and initiates a lock down.
Unfortunately, while in this state, an unsigned application launch results in a misleading (and scary sounding) error message:
“[application name] has been revoked by Microsoft. Please uninstall it.”
This is not the case.
Click to expand...
Click to collapse

False alarm: Microsoft isn’t remotely locking your phone
source: http://www.chevronwp7.com/

Related

Do Not Pay Imei-check.co.uk (or Paypal, Ever) If You Use Vista!!!

So, I'm going through the process of cleaning out and fooling around with a second-hand Wizard I got cheap. I go through the hard reset, all the functions seem to work out alright, etc. So now it's time for me to unlock it! I go through the process of SIM unlocking it with a coworker's SIM card. Easy as pie. Ok that's done, now to CID unlock it. This one's another G4, so unfortunately I have to fork over money to unlock it.
So I go to IMEI-CHECK.CO.UK, and pay up the 20 GBP (Which comes out to $38 USD), and get the software and the .unl file. I've done a backup, everything, etc. I go to run the program, and Windows SHUTS DOWN. Kind of annoying. But you know what? It happens, and I email them. I get a very nice reply after like 5 minutes! Impressive, considering they're off in the Chinese Never Never Land. We go through a couple emails, again quickly, and I start getting the impression that they don't know what's going on either. That's OK, I'm a software developer, I understand
So we go through some troubleshooting tips, and then mention that support for Vista is Beta. Now, on the page, it says "Note that the unlocker work only under Windows 2000/XP/VISTA. It WILL NOT run under 98, or ME." Nothing about Beta, so I mention that they should probably put up a notice or something, and that I'm still willing to help troubleshoot if they are. Well, eventually they get to a point where they say that I need to use another computer, or do a full re-install of Vista. Unfortunately, I only have one laptop that I use for both home and work, so re-installing is not an option, and I can't run unauthorized software on office-owned computers.
So I politely mention I'd like a refund, and if they ever get the software working, I will rebuy it! At this point, it's taking about a day or so to get a response from them, so I file a PayPal claim. Unfortunately, I get an instant response from PayPal:
"As stated in our User Agreement, the claims process only applies to the shipment of goods. It does not apply to complaints about the attributes or quality of goods received. Therefore, we are unable to reverse this transaction or issue a refund."
So, I'm out $40, and PayPal could care less, and the folks at IMEI-CHECK could care less, because they're pretty much running a monopoly on this software.
Don't buy from them if you have Vista. I wouldn't buy from them at ALL personally, I'd wait until *eventually* a free G4 solution comes out. There are other methods of flashing ROMs.
And PayPal SuXorZ. Yeah, I had to go there.
Wow, that's a bummer. I haven't had to deal with these guys myself, but I know PayPal's "protections" are pretty bogus.
My question is why did you waste your time with those guys anyhow? You can flash any carrier/cooked ROM you want without paying anyone. Look here.
So, save your money and flash away!
Yeah...
I just figured if I could get it CID unlocked, I wouldn't have to go through the ShellTool hassle (I've actually had good luck using RUU through Vista on another Wizard). That would have been worth it, IMHO. But I got burned, and just wanted to warn others to learn from my mistakes. (IMHO, it wasn't a mistake, but then again, I was the impatient one, lol)
Lesson learned. $40 lesson. But learned.
I'm sure they will resolve this issue for you, or refund you. IMEI check have always been fairly good from what I have seen here. I have used them twice myself, and florin who I think is one of the main people behind it, has done lots for the community over the years.
Just be patient, sounds like it's paypal that's screwed you, not IMEI check, not yet anyway.
One thing you CAN do is copy the files to your storage card.. and use a friends computer without Vista to unlock.
If computer shuts down then check yr active sync version..it shd be anything but not 4.5...try and yr computer will not reboot..
Thanks for the replies
Looking throughout the forums, I've noticed that Florin's bumped up against some people, but you're correct, he does seem to eventually work things out. Given it's the weekend, I hold hold it against them for now.
I'm not worried about losing files on this one, it's a unit that I just got from someone, so I'm hard-resetting it anyhow.
Unfortunately, like I told IMEI-CHECK, I don't have another computer that I can use (other than work computers, but those are off limits).
Having Vista, I don't have ActiveSync; I've got Windows Mobile Device Manager, and it's up to date.
I appreciate everyone's help in this community, and I don't know if I made it clear enough in my first post, but I'm more anti-PayPal than anyone else
Update...
I am still in email arguments with IMEI-CHECK. I originally contacted them on the 18th, still not getting any kind of good reply. Does Florin represent them, work for them, etc? I am constantly told to use another computer, when I have, in many emails, explained that I do not have access to any other computers. This computer doubles as my personal and business computer, so re-installing a fresh copy of Vista is not an option at this point, when Vista does not seem to have any issues.
I am really hoping that IMEI-CHECK steps up and does the right thing...
*sigh*
p.s. PayPal sent me a survey on what I thought of their *cough* "customer service". I basically told them where to stick their survey.
i have use imei 4 times ... they have fix a error for me only for the price of unlocking my g4 prophet!
some guys have trouble with the ipl/spl 3.08 version and imei have fix too.
talk with they guys ... but ... here you found a lot of threads with vista problems! if you have no changes to use XP ... try vmware and emu. it!
Finally!
First email: Jun 18
Rec'd Ref.: Jul 4
Ok, so finally IMEI-CHECK proposed a deal that I send my phone out for someone else to do the upgrade. They offered GBP100, but apparently it was a bluff. I *accepted* their offer, and next thing I knew, there was a refund. I lost a dollar in the GBP<->Dollar but I don't care.
Funny thing, I actually got a email from Pay-Pal after the whole mess, saying that they completed their investigation and I've been refunded. For the record, no PayPal, you suck, you didn't investigate sh*t.
Here's my proposal to IMEI-CHECK: I have kept the .UNL file. If you release a version of the program that I can use, and that works, I'll pay you! (I haven't decided if I'll pay full price after everything, but still, I'm an honest guy, and I feel like it's worth paying for your time and effort)
For the record, if anyone can use the .UNL file, let me know. I know it can't be used to unlock your phone (unless you happen to have the same IMEI as I do o.o;; ), but it could be used for testing/development!
I like smiley's.
ChristoA1 said:
bla bla bla bla bla bla
.
Click to expand...
Click to collapse
after reading your endless bla bla, i can just suggest you one thing:
1.) use your device with your's provider original sim card, so you don't need unlock it
or
2.) use a normal OS on your pc
Even those guys are my competitors, i have to say that they have pretty good soft and it works.
Hmmmm....
raskal said:
after reading your endless bla bla, i can just suggest you one thing:
1.) use your device with your's provider original sim card, so you don't need unlock it
or
2.) use a normal OS on your pc
Even those guys are my competitors, i have to say that they have pretty good soft and it works.
Click to expand...
Click to collapse
I'm not sure you were following along the whole time... In response to your points:
1) IMEI-CHECK is not for SIM unlocking. It's for CID unlocking, which has nothing to do with my provider's card. Plus, your logic is a bit flawed if you think that people shouldn't unlock their phones and should just leave things the way they are. IMHO, that's kinda against the point of this site.
2) Vista happens to be the "current" Microsoft OS. XP is now a previous edition of Windows. Granted, it's fully supported, and probably will until the year 3045, but that's besides the point. And seeing as 1) Microsoft encompasses the majority of the OS market, and 2) IMEI-CHECK's software only runs on Windows, and not the other OS's, it's a fair assumption that this should suffice for "normal os". Also, they recommended I do a "fresh install" of Vista. Seeing as this is my only computer, which I've previously mentioned, that's not a plausible solution.
Let me make it clear: I don't necessarily have a problem with IMEI-CHECK. I think they're a smart company, that's filling a niche very nicely. I don't have a problem with their software, any more than I can have a problem with any software. I simply have a problem with how they handled the situation this time.
Please take the time to read and think about others' positions before reacting. If I wanted to write "bla bla", I would've simply written it. Takes much less time.
ChristoA1 said:
1) IMEI-CHECK is not for SIM unlocking. It's for CID unlocking, which has nothing to do with my provider's card. Plus, your logic is a bit flawed if you think that people shouldn't unlock their phones and should just leave things the way they are. IMHO, that's kinda against the point of this site.
Click to expand...
Click to collapse
IMEI-CHECK does both. If you wanted just CID, consider SIM as a bonus.
ChristoA1 said:
2) Vista happens to be the "current" Microsoft OS. XP is now a previous edition of Windows. Granted, it's fully supported, and probably will until the year 3045, but that's besides the point. And seeing as 1) Microsoft encompasses the majority of the OS market, and 2) IMEI-CHECK's software only runs on Windows, and not the other OS's, it's a fair assumption that this should suffice for "normal os". Also, they recommended I do a "fresh install" of Vista. Seeing as this is my only computer, which I've previously mentioned, that's not a plausible solution.
Click to expand...
Click to collapse
Well, as I see things, their software hooks between ActiveSync/Device manager and your HTC, maybe by "brutal" means.
What I want to say is that MS maybe just fixed their latest Device Manager to disallow what could be seen as an "hack", and they IMEI-CHECK just tested their software with an out of the box (outdated?) Vista, and that worked. You know how much Vista is trying to protect itself against modification.
Furthermore, as a more personal note, many people run XP, or had switched to Vista then downgraded (I had these kernel panics when I hooked an VGA monitor on my ATI VGA output, and that a shame for a laptop) and writing good vista drivers will take some time.
ChristoA1 said:
Let me make it clear: I don't necessarily have a problem with IMEI-CHECK. I think they're a smart company, that's filling a niche very nicely. I don't have a problem with their software, any more than I can have a problem with any software. I simply have a problem with how they handled the situation this time.
Click to expand...
Click to collapse
Yes, but what would have you done ? Once they mailed you the unl file, they can't prevent you from using their tool. They want to avoid the "Ok lets order a key, I use it, it work, good, now refund me I run under vista" scheme. I think a acceptable deal would have been to "ok, we'll write on our website that vista support is experimental, ship you phone (at your expense) to us and we'll send to you back with dhl free after we patch it using our computer".
BTW, 90% of computer out there run XP, you shouldn't have any problem to borrow/use one of them for 5 minutes.
thebrave said:
IMEI-CHECK does both. If you wanted just CID, consider SIM as a bonus.
Click to expand...
Click to collapse
Hmmm... Didn't know that. But the primary objective in using them is the CID lock. But thanks for the heads up!
thebrave said:
Well, as I see things, their software hooks between ActiveSync/Device manager and your HTC, maybe by "brutal" means.
What I want to say is that MS maybe just fixed their latest Device Manager to disallow what could be seen as an "hack", and they IMEI-CHECK just tested their software with an out of the box (outdated?) Vista, and that worked. You know how much Vista is trying to protect itself against modification.
Click to expand...
Click to collapse
I understand, and agree as well. I think the biggest problem was that the website said they supported vista, then they emailed saying they didn't, *then they emailed saying they did
thebrave said:
Furthermore, as a more personal note, many people run XP, or had switched to Vista then downgraded (I had these kernel panics when I hooked an VGA monitor on my ATI VGA output, and that a shame for a laptop) and writing good vista drivers will take some time.
Click to expand...
Click to collapse
I've heard the horror stories. Hopefully *knocks on wood* I won't have any issues (that I can't fix).
thebrave said:
Yes, but what would have you done ? Once they mailed you the unl file, they can't prevent you from using their tool. They want to avoid the "Ok lets order a key, I use it, it work, good, now refund me I run under vista" scheme. I think a acceptable deal would have been to "ok, we'll write on our website that vista support is experimental, ship you phone (at your expense) to us and we'll send to you back with dhl free after we patch it using our computer".
Click to expand...
Click to collapse
Yes, at the end, they actually offered to pay freight to a "public forum" to do the patch, and throw in 100GBP. It was when I actually accepted their offer that I received a refund, lol I completely agree with the logic of not wanting to "give away" tools like such, but I also told them that when the program (which can be downloaded without paying, just won't do anything without the UNL file) is fixed to work, I have no problem paying them.
thebrave said:
BTW, 90% of computer out there run XP, you shouldn't have any problem to borrow/use one of them for 5 minutes.
Click to expand...
Click to collapse
Yes, unfortunately I live/work not only out in Bublefuck, but on the outside of Bumblefuck I've got a computer, and the office has two, and I cant use those.
But anyways, I will periodically try to tool every now and then and see if there's improvement. If so, money to IMEI-CHECK. But working product first!
It does work in vista.
Hey,
I've written a short instruction on how to make it work in Vista.
It's here: http://forum.xda-developers.com/showthread.php?t=315650
Cheers,
Xenose
if you paid through paypal using your creditcard then you could file a complaint that goods received were not as described through your visa/mc and get your money back ASAP!!!

[Info] Refused Warranty!

I called HTC UK support a few days ago not for my wildfire s but my sons, it has a dodgy power button really hard to press and sometimes no response, hitting the side of the phone helps lol, so maybe a loose connection between the flex cable and connector.
It has always been a bit unresponsive since first purchase but wasn't too bad, I guess I only noticed it because mine was so much easier to press, anyway it has been getting worse over time.
So HTC asked if it was rooted or had been s-off as if it was they would not do the repair without a charge of £50-£60 and stated the engineers will check for this before any work is carried out.
I argued that the problem was hardware related and not software/firmware and it should be covered but they dissagreed.
I think this is poor customer service.
If I bricked my phone then I wouldn't argue, it would be my problem but this is faulty hardware so I'm pissed.
I will do the repair myself when it gets to a point that it becomes a real problem for my son, as I used to repair mobiles in a shop and currently repair pc's.
Just would've been nice to have the warranty option.
Anyway moral of the story s-off or unlocked bootloader don't expect any kind of warranty from HTC whether a software or hardware issue.
Edit: almost forgot. I asked if I send it would they flash the firmware as I didn't want them to!
Their response was they would flash the phone whether I want them to or not even though its a hardware issue.
How crazy is that.
THANKS HTC AND SHAME ON YOU :banghead:
That's bad. But I think it depends also on the country you live in. Some countries, like mine have specific laws for such a case. That means, if e.g. the defect is not caused by a software issue, they have to do the repair.
Yeah I might send a letter to a UK customer service manager and see what kind of response I get.
Good luck. You should also consider - if your son's device is already unlocked - to downgrade a stock rom. I somehow doubt that htc people check, if the device has gone through the htcdev process. They maybe just check HBOOT and if there is neither LOCKED (OOW), UNLOCKED nor RELOCKED, they think it's okay.
Didn't htcdev it.
Xtc clipped it but either way I told the guy its stock etc etc but he didn't care.
He said they've had a few phones returned to customers without repair because the engineers check the bootloader and htcdev.
In Germany you have different kinds of liability from the manufacturer's side.
If the malfunction appears within the first 6 months, it is generally believed to be a manufacturing fault and if the manufacturer doesn't want to replace it, he has to prove that it was not.
If the malfunction appears after more than 6 months, but less than 24 months, the manufacturer still has to replace devices that failed due to a manufacturing fault, but the burden of proof is on the consumer side. Obviously it's hard for a consumer to prove that the malfunction is due to a manufacturing fault, so if the manufacturer refuses to replace the device you're probably gonna fight a losing battle. However, most manufacturers will stil replace the device as anything else would harm their reputation.
The manufacturer cannot ask you to agree to forfeit either of these claims, as such an agreement would be void. However, after more than 24 months you're definitely out of luck from the legal point of view. You will only get service if you signed up for a special maintenance contract with the manufacturer, which obviously is only relevant for very expensive and long-lasting goods.
theq86 said:
Good luck. You should also consider - if your son's device is already unlocked - to downgrade a stock rom. I somehow doubt that htc people check, if the device has gone through the htcdev process. They maybe just check HBOOT and if there is neither LOCKED (OOW), UNLOCKED nor RELOCKED, they think it's okay.
Click to expand...
Click to collapse
You have to provide them some kind of unique identifier for your device before they give you the unlock token. I think they know which serial the device had that this identifier is from and will then check the serial against some database.
They asked me the condition and as I explained its my sons its in a brand new condition in a case not been out the house really as he uses his blackberry outside.
It's about 7 months old.
Not sure about the law in the UK. Getting in contact with some jurist will probably help. I don't know where you're working, but most bigger companies have some kind of "legal department". Maybe you can contact one of your colleagues while relaxing over a beer.
A lawyer will probably charge far more than the phone's worth.
no.human.being said:
You have to provide them some kind of unique identifier for your device before they give you the unlock token. I think they know which serial the device had that this identifier is from and will then check the serial against some database.
Click to expand...
Click to collapse
You are right. And I also found out, that whatever you do, whatever you down or upgrade the state of the bootloader lock persists.
I downgraded to an older ROM ,thus getting back HBOOT 1.08.0000. after installing HTCDEV HBOOT again, it remembered the RELOCKED state. When you first flash the HTCDEV HBOOT you get LOCKED (OOW). So somewhere this information is stored.
theq86 said:
You are right. And I also found out, that whatever you do, whatever you down or upgrade the state of the bootloader lock persists.
I downgraded to an older ROM ,thus getting back HBOOT 1.08.0000. after installing HTCDEV HBOOT again, it remembered the RELOCKED state. When you first flash the HTCDEV HBOOT you get LOCKED (OOW). So somewhere this information is stored.
Click to expand...
Click to collapse
Most of the security-related information is stored along with the Radio firmware. S-ON/S-OFF is, CID is, SIM-Lock is, so bootloader lock is probably too.
HTC is not who you need to talk to. You need to go to the store where you bought the thing.
Went there today (o2 store) the guy basically said if that's what HTC said then its my hard luck.
intel007 said:
Went there today (o2 store) the guy basically said if that's what HTC said then its my hard luck.
Click to expand...
Click to collapse
What an ass hole lol.
I would just spam HTC customer support up with complaints like I did when there was no bootloader unlock. They don't like me anymore. It also kills there reputation badly so they will say things to try and make up for it.
Just call or email them again, hope you get some stupid ass HTC woman who don't know jack **** about phones and gives you a free HTC One X as a replacement lol.
Sent from my HTC Wildfire S using xda premium
benjamingwynn said:
hope you get some stupid ass HTC woman who don't know jack **** about phones and gives you a free HTC One X as a replacement lol
Click to expand...
Click to collapse
Yeah I'll get on the case thanks, the one x should make up for my troubles lol
benjamingwynn said:
What an ass hole lol.
I would just spam HTC customer support up with complaints like I did when there was no bootloader unlock. They don't like me anymore. It also kills there reputation badly so they will say things to try and make up for it.
Sent from my HTC Wildfire S using xda premium
Click to expand...
Click to collapse
I've been bombing their inbox for days now about getting ANY Marvelc kernel sources. They keep refering me to http://htcdev.com/contact, and I keep responding that I have, and I want Marvelc sources. I must admit, I'm not being nice anymore either.
"Danielle" is taking it in stride though.
This sort of behaviour is not unheard of. in 2007 my daughter bought a Compaq laptop with a international warranty. She went to Nottingham and had a problem. When contacted HP essentially said that take it back to India for repairs, and quoted some page (14 or something) of their web warranty, basically claiming that since the model was not sale in the UK (the numbers always change across borders) they did not want to know. Then she wrote back that she is a lawyer, and was a PG at Notts U. They immediately advised her to take it to the service centre in (or just at the fringe of) the campus. Then unit was sent to the HQ and was back with a new power board within three days (this too in the XMas period).
So you have to persist, and if possible bare your fangs to get anything done.
I've not done this with HTC but with other companies in the past i have told little white lies usually saying it wasn't a fault of mine even when it was.

terrible warranty story

Hi guys, I would like to share my, for now, terrible story.
On 11 November I was using my HOX quietly, shortly after, I lay and take it back after 5 minutes.
I find myself stuck in airplane mode and with a battery that fell off a cliff.
Having unlocked my HOX, because I need the root account, change rom.
I'm not a novice, I do everything as it should.
No, the problem is hardware.
I turn to the service center, to be precise to the point of collection in Naples.
I look forward to one month, I repeat, one month.
My HOX back from service, where it says that it was repaired under warranty and that was done a software update and calibration, signed by an engineer before Communication (I think, how nice, I am a slow heart but be prepared, have realized that it is caused by the release of the bootloader!)
I turn on my terminal and yes and no, it was done a reset, the problem is still there.
Disappointment.
Call the lawyer and I recommend sending it back, I do.
The clock is ticking and my HOX back to me yesterday, where c 'is written that tampering was done to me a quote of 250 euro and I refused.
I call the call center and they tell me that I have rejected the budget, which is not true because I was never contacted.
They threatened to take legal action, also because, chats to give even the prank, I have scratched the display and I found three areas of pixels off.
I promise that I will call Mr.. Philip, their manager.
Today he calls me and asks me to explain my problems, all the bend and precise damage to the display and on the site of HTCDEV, it says plainly that unlocking may void your warranty and most importantly the safety remains active on the radio (but looks a little, which to me does not work)
He says sorry, he tells me to run the practice on the upper floors and offers me a free courier to send back the phone for repair, but I'm not sure the repair.
Ask him if he gives me grounds to take legal action and refuses to privacy, control over the HTC site and find a home in Rome.
Tomorrow I will talk to my lawyer.
You have any recommendations?

Bought a google locked S9

So, I recently bought a Samsung Galaxy S9 (T-Mobile) from some random stranger online, And when i got the S9 it did not come with anything else but the phone which immediately raised a flag for me.
When i tried to set it up it asked me to connect to the internet to set up, And once i connected to the internet and clicked next, I then found out it was google locked? It required me to log in with the previous owners email, When i contacted the owner he did not respond at all and i assume he stole it from someone else and sold it to me. I started to search around the internet and found a video of a person unlocking it in some way with Odin3 so i tried to do what he asked and nearly got a virus from it which left me unable to trust any other videos or sites, So I was wondering if anyone here would be able to help me some way to unlock and use this device, I tried going to a phone store near me to try unlocking it and they said it would cost me $120 usd, But i was sure i am able to do this at home by myself for free, But i'm not quite sure what to do without getting any malware. So if anyone could help me it would be greatly appreciated
You could try flashing stock firmware using Odin. Look up your model number on Sam-mobile.
What you are asking is the same as "I stole a phone that is FRP locked, help me gain access"
We have no way to know if you bought it or stole it
If you bought via eBay or similar, contact the site owners, if you used PP or a credit card, open a dispute and get the transaction reversed
If you did a bank transfer, you have details that can identify the seller, start legal proceedings, contact the bank
If you bought online, you will have some sort of digital footprint to find him
And at the end of the day, you took the risk buying unprotected like that
What *Detection* said, this "random stranger" didn't just show up on your computer, you had to find him on a website. If what you said is true, then there is some type of digital footprint. If it was on Ebay, then you have a way to possibly get your money back. Next time, demand a screenshot of the IMEI and do a quick search to find out if the IMEI is clear. If you bought a stolen phone, then your guilty of buying stolen goods.
I know a a method to unlock/bypass it easily but u can google it. like many of the other users are saying, you could have stolen it and trying to get a partner in crime. Just get a refund or ask the person for the info temporarily and then he/she just.change their pw quickly. It'll notify them when u have sucessfully unlocked the device. Good luck.
What's your conscience telling you? Do a trace, get a refund, and return the phone to its original owner.
Thread closed.
FRP (Factory Reset Protection) is done for something and we at XDA do not allow discussions to bypass such security systems. Even if it's for good reasons in the end we don't take that risk.
Please read the rules again HERE.
In particular, this one here below:
9. Don't get us into trouble.
Don't post copyrighted materials or do other things which will obviously lead to legal trouble. If you wouldn't do it on your own homepage, you probably shouldn't do it here either. This does not mean that we agree with everything that the software piracy lobby try to impose on us. It simply means that you cannot break any laws here, since we'll end up dealing with the legal hassle caused by you. Please use common sense: respect the forum, its users and those that write great code.
Click to expand...
Click to collapse
Thanks
Wood Man
Senior Moderator

General Google Pixel mail-in repairs have allegedly twice resulted in leaked pics and a privacy nightmare

https://www.theverge.com/2021/12/4/22817758/broken-google-pixel-phone-privacy-leak
Google says it’s investigating the latest report
By Emma Roth Dec 4, 2021, 7:43pm EST
After game designer and author Jane McGonigal sent her Pixel 5a to Google for repair, someone allegedly took and hacked her device. This is at least the second report in as many weeks from someone claiming they sent a Google phone in for repair, only to have it used to leak their private data and photographs. McGonigal posted a detailed account of the situation on Twitter on Saturday and advised other users not to send their phones in for repair with the company.
In October, McGonigal sent her broken phone to an official Pixel repair center in Texas. She tweeted later that Google said it never received the phone, and during the ensuing weeks, she was charged for a replacement device.
“THE PHOTOS THEY OPENED WERE OF ME IN BATHING SUITS, SPORTS BRAS, FORM-FITTING DRESSES, AND OF STITCHES AFTER SURGERY”
But according to McGonigal, FedEx tracking information shows the device arrived at the facility weeks ago. Late Friday night — a few hours after she says she finally received a refund for the device — someone seems to have used the “missing” phone to clear two-factor authentication checks and log in to several of her accounts, including her Dropbox, Gmail, and Google Drive.
The activity triggered several email security alerts to McGonigal’s backup accounts. However, she speculates that whoever has the phone may have used it to access her backup email addresses and then dumped any security alerts into her spam folder.
“The photos they opened were of me in bathing suits, sports bras, form-fitting dresses, and of stitches after surgery,” McGonigal writes. “They deleted Google security notifications in my backup email accounts.”
In a statement emailed to The Verge, Google spokesperson Alex Moriconi says, “We are investigating this claim.” It’s still unclear whether the device might have been intercepted within the repair facility or while it was in transit, or who has it now. Google’s official repair instructions recommend backing up and then erasing a device before sending it in. Still, as Jane McGonigal points out, that’s either hard or impossible, depending on the damage.
The whole situation reminds us of the security concerns whenever we hand over our devices for repair, and unfortunately, such activity has precedent. In June, Apple paid millions to a woman after repair technicians posted her nude photos to Facebook. Apple recently said it would start selling DIY repair kits, giving users the chance to fix their own phones, or at least have the task done by someone that a user trusts, as opposed to sending it in or dropping it off at an Apple Store.
For Pixel phones, your options for official service are either via mail-in or, in some countries, local service through an authorized provider. In the US, Google partners with uBreakiFix franchises. Whatever phone you have, the options for repairs are still somewhat limited, and you end up having to trust that no one with bad intentions will get their hands on your phone while it’s out of your possession.
Click to expand...
Click to collapse
It also happened to a woman with an iPhone. Nothing new.
These people obviously don't have a reasonable screen lock.
Also, google should provide instructions to wipe with USB that can be followed by a normal person.
96carboard said:
These people obviously don't have a reasonable screen lock.
Also, google should provide instructions to wipe with USB that can be followed by a normal person.
Click to expand...
Click to collapse
for the most part, these people have no lock or biometrics on. and their screen is dead (so they think the phone is dead). but I agree, they should develop a tool but it wouldn't be easy. Have you tried running commands or whatever with a blank screen? its very difficult. but you're right, a tool that either locks or wipes the device would be awesome, no commands or messy fastboot menus for the user would help a ton.
Lesson learned don't take nudes lol
Alekos said:
for the most part, these people have no lock or biometrics on. and their screen is dead (so they think the phone is dead). but I agree, they should develop a tool but it wouldn't be easy. Have you tried running commands or whatever with a blank screen? its very difficult. but you're right, a tool that either locks or wipes the device would be awesome, no commands or messy fastboot menus for the user would help a ton.
Click to expand...
Click to collapse
The lady that sent it in said she did have a screen lock and took every precaution she was instructed to take since she couldn't power on her device.
pcriz said:
The lady that sent it in said she did have a screen lock and took every precaution she was instructed to take since she couldn't power on her device.
Click to expand...
Click to collapse
yup. I just read the article. the guy on reddit who posted a few days ago admitted there was no lock on the screen. so who knows. they could have had an easy unlock code (1234, 1111) which is the same as having no unlock code pretty much. but yeah it'll be interesting to find out the truth.
Alekos said:
yup. I just read the article. the guy on reddit who posted a few days ago admitted there was no lock on the screen. so who knows. they could have had an easy unlock code (1234, 1111) which is the same as having no unlock code pretty much. but yeah it'll be interesting to find out the truth.
Click to expand...
Click to collapse
Still though. If it's true, the service provider is in the wrong either way. Locked or unlocked. Easy or hard.
pcriz said:
Still though. If it's true, the service provider is in the wrong either way. Locked or unlocked. Easy or hard.
Click to expand...
Click to collapse
yes. 100%. my comment makes it seem like it was the user's fault. this is 100% the blame of the repair agents/shipping/ whoever accessed the phone. this should never happen. but all we can do is minimize the likelihood
A.Priori said:
Lesson learned don't take nudes lol
Click to expand...
Click to collapse
Most people don't want to hear this, but it's still an universal truth - if you don't want nudes to leaks, don't take any (at least not with a smart device/cloud capable phone). If you really need to have nudes of yourself, take a polaroid and share them with your partner manually. That way, it's at least physically restricted to your immediate surroundings.
Every device can be hacked, every cloud can be broken. All those ICloud leaks could have been avoided, plus a lot of drama. It doesn't mean you can't make any nudes, just use tech that is too ancient to become a problem.
As a golden rule of thumb: Any and each information you spread to the internet, is permanently stored. And - in doubt - is accessible by at least one more person other than yourself. Keeping that in mind is paramount to understand the world wide web.
So DO NOT share any information you do not want to get accidentally leaked.
Of course this is still a terrible crime (OP linked story) and Google + the repair shop have to be held responsible. Still, you should always expect other people to behave like an a** - to deceive, cheat, fraud, lie or fool - that's the way of life for many.
Ergo life is, most often or not, about making sure that you do not share any vulnerable sides unnecessarily. At least if you want to avoid trouble.
What I don't get is when I sent my phones back it SPECIFICALLY states to factory reset the phone? Do people not read? Also, if you don't want your nudes to be seen don't take any? Like...EXPECTATIONS<REALITY
Gytole said:
What I don't get is when I sent my phones back it SPECIFICALLY states to factory reset the phone? Do people not read? Also, if you don't want your nudes to be seen don't take any? Like...EXPECTATIONS<REALITY
Click to expand...
Click to collapse
How do you propose to do that if the phone is not able to turn on or connect to an external source? If this story is actually true, and I have my doubts, this would be the time you eat the cost of the device and put it in a drawer or smash it to smithereens.
Gytole said:
What I don't get is when I sent my phones back it SPECIFICALLY states to factory reset the phone? Do people not read? Also, if you don't want your nudes to be seen don't take any? Like...EXPECTATIONS<REALITY
Click to expand...
Click to collapse
I agree with ya here. To me, this stuff seems like common sense (which the world's population seems to be losing). My thoughts are:
If you don't want your nudes stolen, don't take nudes in the first place. Even if you're not shipping your phone somewhere for repair, your pictures are still getting uploaded to Google Photos and can be snatched in other ways. But still, if you really want to take nude photos anyway, then you should put them into a locked folder within Google Photos just after taking them so that they're not immediately visible within the Photos app. Granted, I'm not sure if the jpg files of locked folder pictures would still be present in the normal "DCIM" folder... But I imagine they'd be hidden somewhere at the system level (which normally can't be accessed without root)...?
I should probably test this on my phone - but I'd have to take some nudes first, haha. (Jk, of course)
Alekos said:
for the most part, these people have no lock or biometrics on. and their screen is dead (so they think the phone is dead). but I agree, they should develop a tool but it wouldn't be easy. Have you tried running commands or whatever with a blank screen? its very difficult. but you're right, a tool that either locks or wipes the device would be awesome, no commands or messy fastboot menus for the user would help a ton.
Click to expand...
Click to collapse
It wouldn't be hard. Just running "fastboot format userdata" would clear it, so you don't need to mess with menus -- just power it on with the right volume button pressed. So really all the tool needs to do is monitor for fastboot on a USB and issue the format command.
Google says Pixel repair privacy breach wasn’t from employees, new security instructions coming
Ben Schoon
- Dec. 8th 2021 8:23 am PT
Google has been under scrutiny this week as multiple reports of mail-in Pixel repairs resulted in compromised accounts and leaked photographs. Now, the company is saying that this breach of privacy wasn’t at the hands of Google employees, and the company will apparently update instructions for mail-in Pixel repairs and help customers lock down their data.
Speaking to The Verge, Google has said that an investigation of these privacy issues has confirmed that the account invasion was not from Google employees/Pixel repair techs. The company has not said where the breach came from at this point or where the invaded devices are. Transit seems like the most likely scenario at this point.
After a thorough investigation, we can say with confidence that the issue impacting the user was not related to the device RMA [Return Merchandise Authorization]. We have worked closely with the user to better understand what occurred and how best to secure the account going forward.
Google Spokesperon Alex Moriconi
Click to expand...
Click to collapse
To prevent this sort of issue in the future, too, Google will apparently start providing new instructions to help users lock down their accounts and data, presumably in addition to the current instructions that already recommend resetting the device before sending it in.
Specifics aren’t available, but Google apparently told Jane McGonigal that new security instructions for those who cannot factory reset their phone before sending it off for repair will be coming.
Click to expand...
Click to collapse

Categories

Resources