Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secret app on millions of phones logs key taps

theregister.co.uk

Post reply on HN
Print view View original

71–80 of 193 posts

Re: Secret app on millions of phones logs key taps

#71

Post by marcf »

tptacek wrote: post #66
DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

What percentage of all the SMS messages send by Sprint Android phones in a day do you think 10 gigabytes is? Start here: the US generates about 2 trillion SMS messages in a year across all phones. There are multiple YC startups that could write the (bad) marketing sentence "we receive raw data (known as metrics) from X and convert them into reliable, repeatable Measures which feed into analytic applications". Persona…

At 160 bytes per text and 2T texts per year, there are 800 gigabytes of texts per day. Thus Carrier IQ is monitoring the equivalent of 1% of all texts across all phones. That is still quite significant.

Re: Secret app on millions of phones logs key taps

#72

Post by mitchty »

runjake wrote: post #36
revscat wrote: post #16

Earlier quoted context omitted.

To be fair, the response from CarrierIQ implies that this is the case: "In an interview last week, Carrier IQ VP of Marketing Andrew Coward rejected claims the software posed a privacy threat because it never captured key presses. “Our technology is not real time,” he said at the time. "It's not constantly reporting back. It's gathering information up and is usually transmitted in small doses.” Note that last clause…

What does it matter if it's real time or not? It's still creepy, and it's still my privacy.

The fact that it has hooks to even know of the keystrokes is the real issue here. Even without recording or logging them afterwards, the fact that it has the ability means its a possible attack vector for things like worms/etc...

Even if they never do anything with keystroke data, just the fact that they can is the dangerous part. What is to prevent some switch to start sending the keystrokes in the future? I'll be blunt, this companies implementation of its business model strikes me as being borderline wiretapping.

Re: Secret app on millions of phones logs key taps

#73

Post by vedant »

tptacek wrote: post #66
DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

What percentage of all the SMS messages send by Sprint Android phones in a day do you think 10 gigabytes is? Start here: the US generates about 2 trillion SMS messages in a year across all phones. There are multiple YC startups that could write the (bad) marketing sentence "we receive raw data (known as metrics) from X and convert them into reliable, repeatable Measures which feed into analytic applications". Persona…

Nobody had computed the percentage:

Using 2e12 SMS messages/year, 160 characters/message, and 1 byte/character:

(2e12 * 160) / (365 * (2^30)) = 816.501983 GiB/day

So 10GiB/day is about 1.2% of daily SMS traffic.

EDIT: Too slow.

Re: Secret app on millions of phones logs key taps

#74

Post by revscat »

EwanToo wrote: post #15

There is no evidence the data is being logged and sent. Accessed yes, logged, well nobody has found the log yet, and sent, nobody has found any network traffic. It's still bad, but the reports seem to be over-hyped by journalists looking for a scoop.

Irrelevant.

The issues are:

(1) That a vector is there for an untrusted third party to record and report all keystrokes

(2) It was put there at the insistence of the carriers, and

(3) That there is no way for a user to turn it off without voiding their warranty.

edit:

(4) This has serious implications for the trustworthiness of Android-based platforms as we attempt to move towards using NFC for financial transactions. Who in their right mind would trust Android (or any smartphone, really) as a debit card after this?

Re: Secret app on millions of phones logs key taps

#75

Post by recoiledsnake »

AJ007 wrote: post #67
recoiledsnake wrote: post #39

Earlier quoted context omitted.

Logging is not the same as sending over the network. What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes? Not saying it doesn't send keystrokes, but the video is definitely not proof of that and it bears further investigation, not knee jerk reactions.

There is a video camera in your bathroom secretly recording you. If the perpetrator never stops by to pick up the tape, is a crime committed?

If someone implies that there is proof that the perpetrator picked up the tape when there is no such evidence, are they right?

Re: Secret app on millions of phones logs key taps

#76

Post by sycren »

AJ007 wrote: post #67
recoiledsnake wrote: post #39

Earlier quoted context omitted.

Logging is not the same as sending over the network. What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes? Not saying it doesn't send keystrokes, but the video is definitely not proof of that and it bears further investigation, not knee jerk reactions.

There is a video camera in your bathroom secretly recording you. If the perpetrator never stops by to pick up the tape, is a crime committed?

How did the perpetrator plant such a device in the first place? Did he have permission? If not, perhaps a different crime was committed.

Re: Secret app on millions of phones logs key taps

#77

Post by onemoreact »

tptacek wrote: post #66
DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

What percentage of all the SMS messages send by Sprint Android phones in a day do you think 10 gigabytes is? Start here: the US generates about 2 trillion SMS messages in a year across all phones. There are multiple YC startups that could write the (bad) marketing sentence "we receive raw data (known as metrics) from X and convert them into reliable, repeatable Measures which feed into analytic applications". Persona…

There software is not on all phones so the total number of SMS messages is irrelevant. Assuming the average text message are 80 charters and they can be compressed 75% then 10GB could be 500 million messages a day and 180billion / year which would be 10% of the total messages in a year. Or with enough meta data 10GB could represent a tiny fraction of that. So, IMO the real question is what information they actually collect not how much data they are storing.

Re: Secret app on millions of phones logs key taps

#78

Post by spyder »

jgrahamc wrote: post #26
DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

They say they are installed on > 148.3M phones. If we imagine that they are gathering 10GB per day then that's about 76 bytes per phone, if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes) then it's 680 bytes. It's more likely to be in the middle (because otherwise the recruiter would have rounded up) so you are talking 100s of bytes per phone per day. I don't think it's reali…

Probably not all phones sends the data every day, they can be scheduled monthly or they request data from phones only if there is a network problem.

Re: Secret app on millions of phones logs key taps

#79

Post by tptacek »

marcf wrote: post #71
tptacek wrote: post #66

Earlier quoted context omitted.

What percentage of all the SMS messages send by Sprint Android phones in a day do you think 10 gigabytes is? Start here: the US generates about 2 trillion SMS messages in a year across all phones. There are multiple YC startups that could write the (bad) marketing sentence "we receive raw data (known as metrics) from X and convert them into reliable, repeatable Measures which feed into analytic applications". Persona…

At 160 bytes per text and 2T texts per year, there are 800 gigabytes of texts per day. Thus Carrier IQ is monitoring the equivalent of 1% of all texts across all phones. That is still quite significant.

The point isn't how many texts they're getting --- one would be too many. The point is "10 gigabytes per day of metrics" doesn't itself imply that they're getting message contents.

Re: Secret app on millions of phones logs key taps

#80

Post by tptacek »

AJ007 wrote: post #67
recoiledsnake wrote: post #39

Earlier quoted context omitted.

Logging is not the same as sending over the network. What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes? Not saying it doesn't send keystrokes, but the video is definitely not proof of that and it bears further investigation, not knee jerk reactions.

There is a video camera in your bathroom secretly recording you. If the perpetrator never stops by to pick up the tape, is a crime committed?

By that logic we should all be very angry at our TTY drivers.
Post reply on HN