Warnings for Xiaomi phone users; Security researcher claims devices collect browsing data

It is not the first or the last time that a smartphone company has been accused of collecting user data, and today Xiaomi it’s even taken for granted by a security researcher working with Forbes. According to an analysis of Gabriel Cirlig, Romanian developer discovered by members of the Facebook group Mobilissimo here, Xiaomi phones record most of the activities performed by users.

He noted that his daily phone, a Redmi Note 8, records almost everything he does on the device and sends data to servers in Russia and Singapore, although the domains are hosted in Beijing. It seems that we are talking here Home screen activity, visited websites, open folders, even about changed settings or music played in the default app.

Furthermore, we learn that the default browser collects the data even in incognito mode, even when using another solution like DuckDuckGo on phones. All this data would be “poorly encrypted” using the base64 format that allows easy transcription of text data. The same security researcher claims that he downloaded the ROMs for Xiaomi Mi 10, Redmi K20 and Mi Mix 3, all of which have the same security vulnerability.

There’s also researcher Andrew Tirney, who discovered similarly dubious behavior in My Browser Pro and Mint Broswer. As for Xiaomi’s official response, it did not take long to appear and all these accusations are denied. We learn from the company’s blog post that Xiaomi complies with all local laws and regulations regarding the privacy of user data, and the collected browsing data has been anonymous.. The reason this data is collected is apparently related to the company’s desire to improve the user’s browsing experience, being standard practice.

Last but not least, Xiaomi says the data cannot be associated with a specific user. Xiaomi’s detailed answer is available here.