Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secret app on millions of phones logs key taps

theregister.co.uk

Post reply on HN
Print view View original

51–60 of 193 posts

Re: Secret app on millions of phones logs key taps

#51

Post by artursapek »

jff wrote: post #45
artursapek wrote: post #40

Earlier quoted context omitted.

Right, the argument is logged keystrokes never leave your phone because that amount of data from each Android/Blackberry phone would be a lot more thn 10 GB a day. I agree though, why are they logging it at all if the app isn't sending it to them? Very suspicious.

You, uh... you can enter 10 GB of text on your phone per day? I think maybe if you recorded all of the touch events, you'd end up with many megabytes worth, but I doubt the average user will enter more than a few kilobytes worth of text in a day.

That's a figure for all phones, not each phone. Read EwanToo's comment towards the top.

Re: Secret app on millions of phones logs key taps

#52

Post by code_duck »

kevin_jacobs wrote: post #29

As a WP7 user, I emailed HTC yesterday asking whether or not this software (or similar products) are used on their WP7 devices. Here's the response I got: "Dear Kevin Jacobs, I understand you would like more information about the Carrier IQ software, or any software of this nature on your device. I understand your concerns about this issue and protecting my privacy is definitely one of my top priorities as well. We h…

That's a very non-reassuring answer, as her 'sure' statement doesn't sound very sure. The original report at http://androidsecuritytest.com/features/logs-and-services/lo... states "Devices supported include android phones, Blackberries, Nokias, Tablet devices and more."

Re: Secret app on millions of phones logs key taps

#53

Post by therec »

jff wrote: post #45
artursapek wrote: post #40

Earlier quoted context omitted.

Right, the argument is logged keystrokes never leave your phone because that amount of data from each Android/Blackberry phone would be a lot more thn 10 GB a day. I agree though, why are they logging it at all if the app isn't sending it to them? Very suspicious.

You, uh... you can enter 10 GB of text on your phone per day? I think maybe if you recorded all of the touch events, you'd end up with many megabytes worth, but I doubt the average user will enter more than a few kilobytes worth of text in a day.

I agree with you they will very easily record all the touch events. If you were typing 10 characters per second (which already seems like quite a lot) after 24h you will not even have a megabyte of information. Just over a megabyte if you encode the character in Unicode. ;-) This is without even take into account that this information can be heavily compressed for the transfert.

Re: Secret app on millions of phones logs key taps

#54

Post by gcb »

artursapek wrote: post #44
smokinn wrote: post #37

Earlier quoted context omitted.

And you guessed wrong. It says iphones and blackberrys are equally affected.

Blackberries possibly, I saw no mention of iOS devices.

Ios also collects all that. It's just more difficult to see inside a safe.

Remember the js code that showed all the places the phone have been using a mere phone backup data?

ios is already worse then all of this

Re: Secret app on millions of phones logs key taps

#55

Post by freehunter »

kevin_jacobs wrote: post #29

As a WP7 user, I emailed HTC yesterday asking whether or not this software (or similar products) are used on their WP7 devices. Here's the response I got: "Dear Kevin Jacobs, I understand you would like more information about the Carrier IQ software, or any software of this nature on your device. I understand your concerns about this issue and protecting my privacy is definitely one of my top priorities as well. We h…

>I am sure they did not include any software of this kind.

While I am a WP7 owner, I find this to be a little presumptuous. Microsoft may not have included _this specific_ software, but how does HTC know they didn't include anything like it? I don't believe Microsoft gives handset makers the source code for the software. I know they don't allow them to customize it. Perhaps HTC has not installed anything like it or been allowed to install anything like it, but how would HTC know if MS did it themselves?

Re: Secret app on millions of phones logs key taps

#56

Post by EwanToo »

drivebyacct2 wrote: post #35
EwanToo wrote: post #25

Earlier quoted context omitted.

They are collecting data, but I'm pretty sure it's not keystroke data - that kind of volume would be 10s of TB per day, not GB. From your link to the recruiter: Each handset collects and reports 100's of metrics of device and user behavior in real time. That's data like phone location, applications used, etc. Very bad yes, keylogger reporting your password, no.

Did you read any of the articles or watch the video? The guy shows `adb logcat` running and showing CarrierIQ logging keystrokes with their ASCII codes. (edit: I make no claims about the transmission of data. I merely took "collection" and assumed that if the app was recording (even if not persistently) keystrokes on my phone that it counted as collection. Further, the fact that it can is enough to piss me off, espec…

Adb logcat showing the usb debugging output isn't really the same as storing on a file or uploading to a remote server, is it?

They're obviously doing bad stuff, but I see no evidence of uploading your keystrokes

Re: Secret app on millions of phones logs key taps

#57

Post by Fliko »

recoiledsnake wrote: post #39
drivebyacct2 wrote: post #35

Earlier quoted context omitted.

Did you read any of the articles or watch the video? The guy shows `adb logcat` running and showing CarrierIQ logging keystrokes with their ASCII codes. (edit: I make no claims about the transmission of data. I merely took "collection" and assumed that if the app was recording (even if not persistently) keystrokes on my phone that it counted as collection. Further, the fact that it can is enough to piss me off, espec…

Logging is not the same as sending over the network. What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes? Not saying it doesn't send keystrokes, but the video is definitely not proof of that and it bears further investigation, not knee jerk reactions.

It's still pretty dangerous even if it doesn't send keystrokes.

Re: Secret app on millions of phones logs key taps

#58

Post by masklinn »

gcb wrote: post #54
artursapek wrote: post #44

Earlier quoted context omitted.

Blackberries possibly, I saw no mention of iOS devices.

Ios also collects all that. It's just more difficult to see inside a safe. Remember the js code that showed all the places the phone have been using a mere phone backup data? ios is already worse then all of this

> Ios also collects all that.

Do you have the slightest evidence for your claim?

> It's just more difficult to see inside a safe.

Anything can be seen on a jailbroken iphone.

> Remember the js code that showed all the places the phone have been using a mere phone backup data?

This was (explained as) a location cache the developer forgot to clean (most phones will cache the last few locations so it does not have to boot the location circuitry if an application only needing a very rough location estimate needs a fix) which mistakenly existed in a backuped location (note that unless users sent them, those backups never left their machine). And the issue was fixed in the next update (both the backuping and the too-greedy cache).

> ios is already worse then all of this

I'll go with no until you provide evidence.

Re: Secret app on millions of phones logs key taps

#60

Post by masklinn »

smokinn wrote: post #37
funkah wrote: post #17

Before reading, I guessed that "millions of phones" meant millions of Android phones. Because if this was happening on iPhones, that would merit mention in the headline. Funny how that works.

And you guessed wrong. It says iphones and blackberrys are equally affected.

> It says iphones and blackberrys are equally affected.

No, it says Blackberries and Nokia phones are equally affected. The application requires 1. carrier-custom ROMs and 2. very low level access to the OS. Both are things iOS does not provide, Apple does not allow carriers to tinker with iOS images and does not allow low-level OS access (unless you jailbreak).

Post reply on HN