Kingsong, one of China's spy channels on the rest of the world???

[Benphysics]

I just bought a new Kingsong 18XL and downloaded the new android app from their website, and installed it. I also allowed permission for location and storage like most forums claim are required. As I opened the Kingsong app, it requested permissions for:

1) to make and manage phone calls on my device...

2) to access photos, media, and files on my device...

3) to take pictures and record videos...

4) to record audio...

If I deny these permissions, the app replies that it cannot open due to needed permissions for the kingsong app to operate normally. Then the only two choices it gives is to "cancel" or "ok" which cycles the requests for the same permissions.

I've tried to reinstall the app several times, but It never goes past this point.

This, to me, is some serious requests to invade on my privacy. It would allow them to listen and see whom ever I talk to, take pictures and videos of everything I do and places I go to, look at my personal files and emails, and so on...!

I don't know about what you think, but this smells a lot like China spying on us in all different ways ! I have never encountered such open request to spy on our every move.

No matter what I do, there is just no way to go any further with the app, and my wheel remains a beeping brick.

If anyone has an alternative to this, I really would like to know.

Edited July 7, 2019 by Benphysics

[The Fat Unicyclist]

I want to know what it is that you are doing that might be of interest to the Chinese government?

But if you have an issue with it... remember that you only need the app for calibrations and adjustments. The rest of the time you can use WheelLog (which is only monitored by the Polish government). 

So just set the permissions when you need to use the KS app and then remove them afterward... 

[Sidewalk Enforcer]

Throwing "Kingsong" or any manufacturer under the bus because the OS their app runs on has the blunt instrument of "permission requests" to function is unfair.

Bad actors in the app stores of various platforms have caused the software houses that make the OS to force vendors who publish apps to these platforms to declare and "ask" the user for permission to apply the permissions level required for certain functions within the app to work. Many of the permission requests sound scary but the category of requests are broad and cover a large variety of functional calls that the app makes to the OS.

Want to offer your customers the ability to track their ride within the wheel app? - gonna need to access files to create the log data so that you can read it later, read GPS location data etc.
Want to record your own audio warnings in the app? - gonna need to have permission to record audio. etc. etc.

[Benphysics]

I just want to ride, I don't care about these bells and whistles. The app should allow me to chose what I want to do. If I don't allow certain permissions, then I don't get the luxuries, period. Which should my choice; not theirs. f you do not see the privacy invasion here, then you do not see the behind the scenes here. The app should allow your phone, via bluetooth to perform all the tasks necessary to operate the wheel. You already have gps on your phone. Kingsong does not need to make and manage the phone calls on your device, or access photos, media, and files as they please, take photos and record whenever, and whatever else they require permission for, otherwise not allow the wheel to be used. This is outrageous, no matter how you dress it up.

[CampDylan]

If you post this in the King Song titled topic page the reps will see it and respond .  They seem to be pretty good about it.  I'm not entirely sure what you're talking about specifically because I have yet to even ride my first EUC yet - I have a KS16X as my first on pre-order so this is a bit of a concern for me.

Are you saying the KS wheels can't be operated without an active phone plan and then allowing consent to your contacts, etc.?  Because I don't have an active smart phone with data!

[gon2fast]

get a non-contract phone and run the app on that. If you spent $1800+ on the wheel, what is $100 more? 

[UniVehje]

On iOS side these permissions are not required. It only needs location at the time of adjusting speed limit for the first time. Once it’s activated you really only need the app for calibration and that is rare. 

I understand the concern, though. These permissions should not be always needed. Looks like someone cut corners when making Android version of the app. @Micheal Shen represents Kingsong here for the app. 

 

[scotchtape]

Gotway doesn't need any permissions but it's still a POS and you have to make an account and have data to get it to work.  Although apparently now wheel log can do almost everything.

[Rehab1]

7 hours ago, The Fat Unicyclist said:

The rest of the time you can use WheelLog (which is only monitored by the Polish government). 

[esaj]

No idea if it works with the newer wheels, but I've kept on using the old(est) green app if I need to change some settings:  https://www.electricunicycles.eu/kingsong_ks14ks16_electric_unicycles_mobile_app-c__162

If I remember correctly, you still need to (possibly manually, at least with some phones) to give it permission for location for it to work, but it doesn't ask for any really suspicious permissions. Usually I don't use the apps (even Wheellog) at all.

[Marty Backe]

I'll use the KingSong app about 1-percent of the time. Otherwise I use WheelLog.

So if you're really that concerned, only enable the features for the brief time that you need that app.

[TomOnWheels]

11 hours ago, Benphysics said:

I just want to ride, I don't care about these bells and whistles. The app should allow me to chose what I want to do. If I don't allow certain permissions, then I don't get the luxuries, period. Which should my choice; not theirs. f you do not see the privacy invasion here, then you do not see the behind the scenes here. The app should allow your phone, via bluetooth to perform all the tasks necessary to operate the wheel. You already have gps on your phone. Kingsong does not need to make and manage the phone calls on your device, or access photos, media, and files as they please, take photos and record whenever, and whatever else they require permission for, otherwise not allow the wheel to be used. This is outrageous, no matter how you dress it up.

Even if I think you over react on it, I'm agree with you... Permissions = functions/feature = options = choice to use or not...

[tessa25]

I fully agree that the app should work without all those permissions. I've uninstalled many an app that was too nosy. KS doesn't need to know my location to unlock features of the property that I own.

[Benphysics]

While giving these permissions, it takes mere seconds for Kingsong to retrieve all my personal data on my device, including any contacts I may have. This is so wrong in my opinion. And for those who do not delete the app after unlocking and calibrating the wheel, or turn off the permissions, they remain an open book to them. What you do, where you go, and who you talk to says lots about your purchase tendencies; making you prone to subliminals for which China has no laws against. As the brother of a criminal lawyer, we can see endless issues with these permission requests. If you think that I'm overthinking this, it may just as well be that you remain oblivious of the underlying infringments.

[LanghamP]

It's an entirely legitimate concern even among Android and Apple application stores. For out in the wild applications, the risk is probably quite great, as you are essentially giving them permission to, well, everything.

I was required to take a security application course (s) by PluralSight for application permissions, and...it's bad. My feeling is that the KingSong application should just have a one time GPS unlock, and then a titlback and other related speed. And that's it. Ludicrous they add all this other crap that essentially gives KS + company full access to your phone.

But then again, both Android and Apple phones get a mandatory spyware application when you pass through Chinese borders. Both Facebook and Googles End User Agreement have no agreement to any sort of privacy. 

While what you sayight not be illegal now, who is to say that wont be illegal in the future, and then applied retroactively? It used to be we'd ask the writer what he meant, but now we ask people how they feel, and then apply hate speech laws retroactively. You want to keep all your information private because, obviously, it'll be used against you.

[Marty Backe]

28 minutes ago, Benphysics said:

While giving these permissions, it takes mere seconds for Kingsong to retrieve all my personal data on my device, including any contacts I may have. This is so wrong in my opinion. And for those who do not delete the app after unlocking and calibrating the wheel, or turn off the permissions, they remain an open book to them. What you do, where you go, and who you talk to says lots about your purchase tendencies; making you prone to subliminals for which China has no laws against. As the brother of a criminal lawyer, we can see endless issues with these permission requests. If you think that I'm overthinking this, it may just as well be that you remain oblivious of the underlying infringments.

I'm an open book. They can have it all. I'm sure the contents of my phone would be absolutely fascinating 

Life's too short for me to worry about all this "big brother" stuff.

[Benphysics]

1 hour ago, Marty Backe said:

I'm an open book. They can have it all. I'm sure the contents of my phone would be absolutely fascinating 

Life's too short for me to worry about all this "big brother" stuff.

Good for you Marty, but I want my private life to remain private. What you do is your business, what I do remains mine. Although I value your youtubes, being an aeronautical engineer, I see things that you do, especially when repairing your wheels, that shows you are not mechanically inclined. All bolts, nuts and screws ought to be torqued; and here is the reason why: all bolts have an ideal tension specification to allow maximum strength yet remaining secured. If you go beyond its specific torque, you weaken its tensile strength making it prone to break under reduced loads. When I saw you wrench on your gotway monster's axle bolts, you have weaken its load capacity. Loosening them to re-torque them to the right specs will mot recover their original strength. On airplanes and race cars, if we mistakenly over-torque a bolt/nut combination, we discard them and replace them with new ones. So posting this on youtube does more damage than good. Those who follow your lead will run into serious breakage.  Unfortunately, the axle in these wheels are part of the motor. Braking an axle leads to a dramatic fall and expensive repair. So, even though you intend well, please research thoroughly first, then post.

Edited July 7, 2019 by Benphysics
just needed to inform Marty about something I was concerned about.

[Patton250]

4 minutes ago, Marty Backe said:

I'm an open book. They can have it all. I'm sure the contents of my phone would be absolutely fascinating 

Life's too short for me to worry about all this "big brother" stuff.

Yeah but what about banking? :-(

[stephen]

22 minutes ago, Patton250 said:

Yeah but what about banking? :-(

I think predicted text put a B Banking  instead of W then I'll worry what they see on my phone 😁😜

Edited July 7, 2019 by stephen

[CampDylan]

Well, I DO have one Android and one iPhone, old ones, un-activated that can both access the Internet/GPS where WiFi is available.  This should suffice to get my new wheel calibrated, yes?

 

 

Edited July 7, 2019 by CampDylan

[Marty Backe]

19 minutes ago, Patton250 said:

Yeah but what about banking? :-(

I use high quality passwords and two factor authentication for areas where it actually matters (which are very few).

I'm just saying that there are ~4-billion online users in the world. You really think anyone cares where you or I have been or who we're talking to?

I'd rather take advantage of all the services available to me rather that wall myself off in my own private world so that there's zero possibility of being spied upon. This is me and how I run my life (notice my profile name is my name vs some scrambled letters). Everyone else can obviously do whatever they want. No sweat off my back 

10 minutes ago, stephen said:

I think predicted text put a B Banking  instead of W then I'll worry what they see on my phone 😁😜

[Seba]

14 hours ago, The Fat Unicyclist said:

The rest of the time you can use WheelLog (which is only monitored by the Polish government). 

And by my wife, as I have to convince her all the time that I spend hours in front of the computer on developing WheelLog and not on chatting with other girls 

[Benphysics]

14 hours ago, Sidewalk Enforcer said:

Throwing "Kingsong" or any manufacturer under the bus because the OS their app runs on has the blunt instrument of "permission requests" to function is unfair.

Bad actors in the app stores of various platforms have caused the software houses that make the OS to force vendors who publish apps to these platforms to declare and "ask" the user for permission to apply the permissions level required for certain functions within the app to work. Many of the permission requests sound scary but the category of requests are broad and cover a large variety of functional calls that the app makes to the OS.

Want to offer your customers the ability to track their ride within the wheel app? - gonna need to access files to create the log data so that you can read it later, read GPS location data etc.
Want to record your own audio warnings in the app? - gonna need to have permission to record audio. etc. etc.

Kingsong deserves to be thrown under the bus for such privacy invasion. The app, after download should be authenticated with a wheel's serial # and a password, period. The rest of its functions should be done off-line, bluetooth only. There is no reason for these outrageous permissions. It takes mere seconds for them to retrieve all the content of your device.

[gr8ps]

1 hour ago, Marty Backe said:

I'm an open book. They can have it all. I'm sure the contents of my phone would be absolutely fascinating 

 

Show me the man and I'll show you the crime. 

I'm not doing anything illegal to my knowledge anyways. Now are there some embarrassing, potentially career harming messages on my phone? Maybe. People have become way to flippant about privacy. Once it's gone, it's hard to claw back. 

[Seba]

1 minute ago, Benphysics said:

Kingsong deserves to be thrown under the bus for such privacy invasion. The app, after download should be authenticated with a wheel's serial # and a password, period. The rest of its functions should be done off-line, bluetooth only. There is no reason for these outrageous permissions. It takes mere seconds for them to retrieve all the content of your device.

You're right. This app is a piece of s*it and even if some permission are really needed for social features, as for Android standards it should work as a mere control app when these privileges are not granted. But... this is theory. In practice, you should do what others wrote - install this app, make what is needed to configure your wheel and uninstall app. Personally, I use old phone that doesn't contains any data. Otherwise I use WheelLog.

Anyway you don't have to worry to much. It won't have access to all the content of your device. Each Android application is sandboxed, so KS app won't have access to others app data. And don't forget that the real spy is Google. And if you really value your privacy, you should first stop using Android devices. Period.