Why isn't anybody questioning having to install an app from an unknown source?

[MavicRoolzOK]

Thought I'd chime in. Yes, sideloading a minor extra faff compared to Auntie Playstore sorting everything out and auto-updating as/when needed. Been using 'Fly on my humble MA2 for months now with no issues. However, before we blindly accept that Google's security controls are the be-all and end-all.....what about the all the data-harvesting / malware-loaded apps that made it through their controls, are freely available and downloaded... only to then proceed to infect/mess up users' devices...?

 

[Zbip57]

"Why isn't anybody questioning [...]" the fact that Google already knows far more about everything you do than DJI ever will?

[...] reports of user data being collected or security vulnerabilities.

I clicked on that link and read the article. I also followed the link referred from that page to the arsTechnica article.

You do realize those articles were posted more than two years ago, eh? And you do realize that almost every second sentence contains the word "allegedly" and "reportedly", without providing any shred of evidence to demonstrate that DJI has ever used any of these features for nefarious purposes.

In fact, the arsTechnica article actually says the following:

Both research teams said they saw no evidence the app installer was ever actually used, [...]

The researchers from both firms conducted experiments that showed how both mechanisms could be used to install arbitrary apps. While the programs were delivered automatically, the researchers still had to click their approval before the programs could be installed.

Both research reports stopped short of saying the app actually targeted individuals, and both noted that the collection of IMSIs and other data had ended with the release of current version 4.3.36. [...]

If you're really that paranoid over the potential lack of security when using your phone, use a separate cheap phone when flying your DJI drone dedicated to running only the Go app, i.e. a separate phone or controller containing none of your critically sensitive info, or turn off its internet connectivity, or use an iPhone, or update your Android version of the DJI Go app to at least version 4.3.36 as recommended two years ago in the links you yourself posted!

And don't forget to check under your bed every night before going to sleep to ensure there are no communists hiding under there.

 

[Ralph thompson]

I live in CANADA so this probably does impact me. But don’t you have to have and be logged into a DJI account to fly the drone? Certainly for a new DJI drone. So theyre gather your personal info and flight records wether u like it or not.

 

[portrayu]

Ok, well I don't trust software companies who bypass security controls, and until the software is either open source or has a cited independent security review then I will not be sideloading anything. This is such a shame, I used to love my drone. To the classifieds it goes

you actually trust google?

 

[Richard R]

New cybersecurity risk audit gives clean chit to DJI Mavic 3, Mini 2, Air 2S drones

A new audit of Mavic 3, Mini 2, and Air 2S has found that the DJI drones meet key cybersecurity and data privacy standards set by the US.

dronedj.com

 

[Zbip57]

don’t you have to be logged into a DJI account to fly the drone?

You do need to be connected to initially create a DJI account to activate the drone. During that process you are required to provide personal information and agree to DJI's Terms and Conditions and their Privacy measures. You did read all of those carefully before clicking to accept, no?

So they gather your personal info and flight records whether u like it or not.

They do gather your personal info during the account registration process, yes. It is in their best interest to limit their own liability in case you end up doing something stupid with one of their drones. If your drone somehow ends up landing on the White House lawn, and law enforcement subpoenas DJI for further information, their records can and will be traced back to you.

But they do NOT routinely gather your flight records unless you specifically choose to share them. There is an option in the Go app and Fly app to select whether or not you wish to automatically synch your flight records to their servers.

There are several good reasons to have the flight logs automatically synched, as they are then backed up and retrievable if you ever accidentally deleted them or lost your phone etc.

There are also many good reason NOT to auto-synch every flight. You can instead manually delete any flight records you decide not to share, or manually synch the records whenever you do have reason to upload them. Or you can simply copy the flight logs to a backup location of your own choosing, rather than sharing them with DJI.

 

[PaulN]

To answer your topic question. It's not an unknown source. You get it direct from the manufacturer. It is unknown to Google standards of the Play Store.

If you are happy to download an app from a Chinese company and disable your security settings from them I don't think I'd take any advice from you.

 

[GFields]

This thread has run its course. Good luck to the OP

​