How to Prevent OEM Software and Hardware from Spying on You?

[Average_Joe (Joey)]

@Sprout3425

Interesting @ignoramous, my knowledge in computer science is very vague, but I have a decent idea of what you are trying to say.

Trusted computing base is indeed the relevant term.

I am especially concerned about third party OEMs that are running Windows (e.g., Lenovo, HP, Dell etc.) or any other OS. I would prefer that the OS and hardware are made by the same companies or at least, two or more respectable companies.

What can I do to eliminate the spying abilities of third party OEMs like Lenovo, as much as possible?

Coreboot looks awesome, will I be able to use them and wipe my entire computer either now or in the future? Or are they pushing for new standards, without the goal of developing a BIOS or UEFI (no idea what the diff is between these two)?

Wow, as someone who’s looking to build a new PC Tower this is very scary!!

Is it possible to buy safe OEM hardware components for a new PC?

If not, how can we check that the hardware components are not sending information back to someone on the Internet???

This Microsoft article talks about “a secured core PC” but it doesn’t give suggestions for where to buy such hardware components which is really annoying:

Windows 11 Secured-core PCs

I just hope I can find some safe hardware

[foolclown]

Hello, I’m sorry to resurrect this but I recently got a ThinkPad with Lenovo Commercial Vantage preinstalled on it. I set it up and saw that it installed some missing firmware, incl. a critical BIOS update specific to my device.

I’ve been trying to find info re: potential privacy issues with this. I do believe that a lot of this service is not just bloatware, as I can already see it has tools to manage my Windows system that native Windows does not have, as well as the ability to install firmware that optimizes security that I wouldn’t know how to easily get elsewhere.

My knowledge of computer science is minimal. All I’m concerned with is that I prefer that no identifying data that can be used for mass/dragnet surveillance (e.g. live location data, detailed network and web data and histories) is not shared with at least 3rd parties outside of Lenovo.

Obviously, it’s also preferable that Lenovo itself doesn’t collect and retain more data than it needs for providing basic security and functionality - but I’ve given up a say in this already by buying their product in the first place. And obviously, I have no illusions about Windows itself. I’m just trying to minimize the threats, so to speak.

I have read posts about the Israeli OEM but they seem to be upwards of 2 years old. I also read posts advising to disable the “wifi network security” feature as it does appear to be bloatware, but also about 1-2 years dated.

Does anyone have any updates on this and maybe some advice for a standard user who may just have a bit more understanding and ability to FAFO than an average user?

[Average_Joe (Joey)]

@foolclown

Does anyone have any updates on this and maybe some advice for a standard user who may just have a bit more understanding and ability to FAFO than an average user?

I appreciate your reply!

I wish there were more hardware related threads on PrivacyGuides because what’s the point of having secure software if your hardware device is uploading personal data back to the Internet?

I’m always looking for hardware devices that I can trust.

[anon73250778]

I would agree that hardware should also be a significant discussion but i think there are more software leaning individuals here than hardware leaning individuals. Getting expert opinion is difficult to what I perceive to be its rarity.

[kissu]

@Average_Joe

what’s the point of having secure software if your hardware device is uploading personal data back to the Internet

I think the answer to this is simple: sometimes there is just no alternative.

Take an Nvidia GPU, like an RTX 4090.
What would be an alternative with Open Source hardware, with all the schematics and with a similar performance/price ratio?
Answer: there is nothing similar.

Thread closed, have a nice day.

This would unfortunately be 99% of the time, the answer for this kind of question.

And it probably never will be available because Risc V is not making as much money as Jensen, period. Different goals/business models whatsoever and unfair competition.

Just like you cannot compete with a Tesla and build your own open hardware/software tomorrow out of thin air while being competitive in terms of price. Most people do care only about the prices of things anyway, without even thinking about privacy.

[anon39279085]

@kissu

Most people do care only about the prices of things anyway, without even thinking about privacy.

This, you have to make it as affordable as possible if a person doesnt have unlimited budget, privacy or not

its why I said there are brand that I like their value for money but open to options

[Average_Joe (Joey)]

@kissu

Take an Nvidia GPU, like an RTX 4090.

I appreciate your reply!

But just because it’s a big name brand like NVIDIA doesn’t mean that it’s necessarily lacking in user privacy?

By paying extra for a premium product there seems to be more of a chance that the product will be respecting of user privacy. I think this is why low cost laptops come with so much bloat wear and advertising: the low cost laptops need a way to earn money back at the expense of the user?

[kissu]

@Average_Joe

But just because it’s a big name brand like NVIDIA doesn’t mean that it’s necessarily lacking in user privacy?

Big tech usually doesn’t become trillion company based on human conservative good actions. Selling chips to Palantir (military US company) isn’t a sign of healthy business model AFAIK.

So yes, big name doesn’t mean that it’s good or bad.
But paying something with a lot of money upfront doesn’t mean it won’t try to F you up either (there is no “good capitalism” here).

Also, you are never truly guaranteed that the thing won’t be locked down remotely or downgraded. History showed a lot of those examples in the past years of such practices with the trendy Enshitiffication^[1].

@Average_Joe

I think this is why low cost laptops come with so much bloat wear and advertising: the low cost laptops need a way to earn money back at the expense of the user?

True for the most part.
Framework laptops are good hardware, repairable and with open software on it. It doesn’t need to be shit if it’s accessible.
Also, if it’s expensive a company could (read: will, given enough time) try to juice you up by selling you some sort of subscription down the road because otherwise, you paid them once and might never need a device from them ever.

---

1. currently reading that very nice book myself ↩︎