ES File Explorer privacy/security concerns?

[electricpete]

I recall there was some discussion on this subject by a respected staff member.

Can anyone provide more details on whether / why we should be concerned to use ES File Explorer on our phones and connect it to accounts like.... dropbox.

 

[Unforgiven]

I can remember many times @EarlyMon referenced it, but this is one I found.

http://androidforums.com/threads/why-do-we-root-then-vs-now.887730/page-4#post-6824481

 

[EarlyMon]

I still use ES but *never* outside my phone. Overall I prefer X-plore.

 

[Crashdamage]

A little scary. I staying with FX File Explorer by the same developer who does System Panel. Might be a bit heavy on the eye candy but it really works and I don't think I'll be worrying about it saying hi to China.

 

[Thom]

I still use ES but *never* outside my phone. Overall I prefer X-plore.

I have folder at ...

/sdcard/tlanet/notifications​

... that has some system notification sounds.

I tried to rename "notifications" to "Notifications" using ...

Astro
ES
File Explorer HD
X-plore​

Some of them refused. Some of them reported that it was changed and when the app was reloaded it was shown the old (unchanged) way.

ES is the only one that did it right.

I spent a looooooooooooooong time trying to do something very simple and ES is the only one that did it right.

... Thom

 

[Unforgiven]

I think like EM said in the linked post, put it behind a firewall and using it locally is OK. Letting it phone home and connecting to cloud storage is where the concern is.

 

[EarlyMon]

And the latest ES version will pop up and offer to delete any orphaned folders on the sd card after an app uninstall.

I'm not sure how I feel about it monitoring my install actions and I haven't traced it for that (rooted, firewall) - but I have to admit that is a pretty cool feature.

 

[electricpete]

Begin a recording session, open ES File Explorer, attempt to log in to Dropbox using a dummy account, not your own.

Go immediately back to Network Connection and explore where ES went.

Last I checked, that password - in fact the entire login screen - was a product of the ES Chinese servers.

Stop recording, add ES to your firewall blacklist.

This is great info and I appreciate earlymon for sharing it. If they present a login screen that looks like Dropbox but really comes from China, that is a real smoking gun. And showing us how to check it is like teaching us to fish rather than just giving us a single fish.

I have zero doubt about the veracity of earlymon’s account. I did try to recreate it while screen recording since I thought it would be cool to have hard evidence.

The result was unsuccessful as shown screen recording here:

0:03 - I highlight the time as 11:20 (so we can check it when we view the logs)
0:06 – I start recording in Network Connections
0:12 – I show ES File Explorer Privacy Policy
0:19 – I attempt to connect dropbox using madeup email and password
0:51 – Unscuccsful Login
1:06 – Pull downward on list to refresh list of connections in Network connections. There are four connections for ES File Explorer after the video started. I tap on them them one at a time to show the associated websites:
Google
Dropbox
Google
Amazon

I can think of at least two explanations why my results don't match earlymon's
1 – Maybe I did something wrong? It's been known to happen.
2 – Maybe ES File Explorer people are smart enough to watch the internet dialogue and respond to cover their tracks. Perhaps ES File explorer now checks to see if there is a security app or process running that might detect it’s activities and does things properly when it thinks someone is watching. Since probably no more than 5% of the people have such apps/process running they can still do what they want for the other 95%.

What do you guys think?

Possibly unrelated subject. I was doing routine moving files around with ES File Explorer on 3/30/15 when ES File Explorer popped up asking for ROOT access. I immediately pressed DENY. I didn’t get a screenshot of their request but I captured the ES File Explorer message where they seemed to be “explaining” why they would need root access (attached) as well as screenshot of su log. The screenshot shows their silly explanation "Your system forbis ES from writing on external SD card (check https//code.google.....) so ES can only write on it after rooted". I realize sd card permissions are tricky depending on os version (I have 4.4.4 with some xposed tweaks that may affect sd card btw) but this seems out in left field. I have done all kinds of moving files around in ES since and successfuly moved back and forth between internal and external storage without any further error messages. It’s fishy to me… as if they were trying to trick me into granting root access by intermittently showing an error message. At least I did capture the error message on screenshot though.

 

[EarlyMon]

I'll simply say this -

I've had rounds with ES about this, supposedly escalated to management - and the offense was removed. Excuse - junior programmer left test code in.

Then, a few updates later - it returned. Excuse - it was actually required to bypass the Great China Firewall. (Nonsense.)

I just opened up my firewall and I agree - the latest version does not go wrong on a Dropbox login. I didn't check the others.

I was originally alerted to this when I got a blank page for a login so I contacted support.

"Do you use rooted ad blocking?"

"Yes."

"OK, please turn it off. Rooted ad blocking is a known problem for Dropbox."

As my Dropbox app worked just fine, that began my investigation.

And just now, no issues with login and ad blocking because it was going straight to the right place.

This time.

If you look at my exchanges, believe that that's how a truthful organization acts and that they won't turn it back on with a future update as soon as the spotlight is off of them (and they do know about my posts), then by all means - trust away.

No way I will, not in this lifetime. I have ways to connect with my cloud services that are above and beyond reproach.

Your mileage may vary.

 

[RazzMaTazz]

Sorry to necro this thread but I've been using ES File Explorer for years until recently learning that it's a security risk, in that your information and cloud-storage logins could possibly be available to the Chinese government. I just tried a few other free file managers; Astro, Total Commander, and X-plore.

X-plore is my favorite. It's free with no ads. It has all of the functionality that I used in ES File Explore (file management, cloud account access, LAN server access ) and then some (disk map, zip/unzip, multi-pane). Astro was good too but it's ad-supported and I kept accidentally hitting the ads. I found Total commander too clunky/difficult to use-- especially for LAN access.

 

[Dorian2kx]

Nothing beats xplore I've been using it from Symbian days