Can one trust OS and apps from Onyx: app store, modified Android, Onyx Cloud

Question

Onyx Boox is a brand of e-book reader produced by Onyx International Inc, based in China. They have e-book readers based on Android OS. They have features that can violate user privacy or other accounts security:

1. App store with optimized for e-book apps from other App stores: kindle, office, evernote and etc
2. Account manager: Dropbox, Evernote and etc
3. Option to enable Google play and other Google services (like Calendar)
4. Onyx Cloud (sync personal notes and etc)

So the question is: are there any sings of backdoors or vulnerabilities known about their modified apps or OS itself or other stuff that can lead to user data leaks (like privacy leaks or leaks of sensitive information: like passwords or other data)?

Answer 1

I think this is a personal question, and I doubt anyone can give you a definitive answer. Only you can decide whether you trust a company which offers a certain service, and this in turn depends on the service itself and on your personal threat model.

Are there opportunities here for something nasty to happen to your information? Certainly, but that can be said for every product out there. The real question is: are these risks that you are willing to take in order to use this product? This is the real question.

Also, the question in its current form is probably too wide: all 4 points you raised would require an in-depth security discussion, as the attack surface varies wildly between them. Your attitude to risk could also easily be different depending on the point you raised: for example, you might trust their cloud enough to store your documents there, but you might not want to give them access to other clouds such as Dropbox or Evernote. Once again, this is not something that we can answer for you.

If you are interested in a thorough review, your best best is to reach out to the producer and request some security documentation, so you can make an informed security decision.