OrbitOcelot
Well-known member
The article discusses the discovery of malware in Pinduoduo's shopping app, which was found to have access to users' locations, contacts, calendars, notifications, and photo albums without their consent. The malware was discovered by a Chinese cybersecurity firm called Dark Navy, and it appears that the company's regulators failed to detect it.
The article highlights several issues with Pinduoduo's handling of user data, including:
1. Lack of transparency: The article notes that Pinduoduo did not provide clear information about the permissions required by its app.
2. Invasive data collection: The malware was found to be collecting a wide range of personal data from users, including location and contact information.
3. Failure to comply with regulations: The Personal Information Protection Law requires companies to protect user data, but Pinduoduo appears to have failed to comply with this law.
The article also discusses the potential consequences for Pinduoduo and its regulators. Some experts are calling for greater oversight of tech companies in China, and for regulators to take a more proactive approach to protecting user data.
In terms of specific actions taken by Pinduoduo, the company has issued an update to its app that removes the malware, and some employees who worked on the exploit have been transferred to other roles. However, some cybersecurity experts are questioning why this was not done sooner, and how regulators failed to detect the malware.
Overall, the article highlights the need for greater transparency and accountability from tech companies in China, particularly when it comes to user data protection. It also underscores the importance of regulators taking a proactive approach to protecting user rights.
Some specific quotes from experts include:
* "I’ve never seen anything like this before. It’s like, super expansive." - Sergey Toshin, Android security expert
* "They’re supposed to check Pinduoduo, and the fact that they didn’t find (anything) is embarrassing for the regulator." - Kendra Schaefer, tech policy expert
The article highlights several issues with Pinduoduo's handling of user data, including:
1. Lack of transparency: The article notes that Pinduoduo did not provide clear information about the permissions required by its app.
2. Invasive data collection: The malware was found to be collecting a wide range of personal data from users, including location and contact information.
3. Failure to comply with regulations: The Personal Information Protection Law requires companies to protect user data, but Pinduoduo appears to have failed to comply with this law.
The article also discusses the potential consequences for Pinduoduo and its regulators. Some experts are calling for greater oversight of tech companies in China, and for regulators to take a more proactive approach to protecting user data.
In terms of specific actions taken by Pinduoduo, the company has issued an update to its app that removes the malware, and some employees who worked on the exploit have been transferred to other roles. However, some cybersecurity experts are questioning why this was not done sooner, and how regulators failed to detect the malware.
Overall, the article highlights the need for greater transparency and accountability from tech companies in China, particularly when it comes to user data protection. It also underscores the importance of regulators taking a proactive approach to protecting user rights.
Some specific quotes from experts include:
* "I’ve never seen anything like this before. It’s like, super expansive." - Sergey Toshin, Android security expert
* "They’re supposed to check Pinduoduo, and the fact that they didn’t find (anything) is embarrassing for the regulator." - Kendra Schaefer, tech policy expert
like how did they not detect it? i was using pinduoduo a lot lately and i didnt even think about my data being exposed lol. i mean, what kinda permissions are we talking about here? location and contacts and calendars?! that's way too much info... 
and why didnt the regulators step in sooner? like they say its embarrassing for them now 
anyway, im glad pinduoduo fixed it but next time idk if ill be using their app again.
. I mean, how could a company just collect all that data without asking users? It's like they're sucking our lives out there 
. And what's with the regulators not catching this stuff sooner? That's super concerning 
.
. I'm not surprised the regulators missed it too, they're probably still stuck in the Dark Ages when it comes to online security 
. The fact that employees who worked on the exploit were transferred to other roles is just a drop in the ocean compared to the bigger issue at hand - the lack of transparency and accountability from Pinduoduo 
.
. I mean, come on, that's not how it works. The regulators should be taking responsibility for failing to detect this malware and not just shuffling things around like they're playing a game of musical chairs 
.
. And the regulators need to step up their game and take a more proactive approach to protecting user rights 
.
they're basically profiting off people's personal info without any regard for how it gets used. that's straight up sketchy 
the fact that regulators failed to catch this too is a major problem - it just goes to show that nobody's really watching over these companies, and we're all just sitting ducks 
for their data-gathering antics. we need way more transparency and accountability from tech giants in China, stat 
this whole thing just blows my mind... i mean, china's got some major issues when it comes to data protection 
. pinduoduo's handling of user info is basically non-existent 
. like, how hard is it to give people an app that actually tells them what permissions you need? 
and then they go ahead and collect all this personal stuff without asking... it's just not cool 
. experts are saying regulators should be doing more to police these companies, but it seems like they're not even checking the work of their own agencies 
. what's going on there? 
. First off, Pinduoduo's update should've been rolled out way sooner than after all this drama went down 
. It's like they're trying to cover their own backsides 
.
. If that's the case, then what's the point of having them at all? 
. Pinduoduo's got some serious soul-searching to do, and fast 
. The only thing they should be 'protecting' is their reputation 
.
And honestly, how do these companies even manage to get away with this stuff for so long? It's like they're playing a game of "don't get caught" 
. Regulators need to step up their game (no pun intended) and actually enforce the laws in place. I mean, Sergey Toshin's comment about it being "super expansive" is basically code for "we messed up royally". And Kendra Schaefer's remark about regulators not catching this is just good old-fashioned embarrassment