Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secret app on millions of phones logs key taps

theregister.co.uk

Post reply on HN
Print view View original

81–90 of 193 posts

Re: Secret app on millions of phones logs key taps

#81

Post by artursapek »

masklinn wrote: post #58
gcb wrote: post #54

Earlier quoted context omitted.

Ios also collects all that. It's just more difficult to see inside a safe. Remember the js code that showed all the places the phone have been using a mere phone backup data? ios is already worse then all of this

> Ios also collects all that. Do you have the slightest evidence for your claim? > It's just more difficult to see inside a safe. Anything can be seen on a jailbroken iphone. > Remember the js code that showed all the places the phone have been using a mere phone backup data? This was (explained as) a location cache the developer forgot to clean (most phones will cache the last few locations so it does not have to bo…

You made me wonder- is jailbreaking an iPhone the equivalent of rooting an Android phone? It's just about becoming the root user in the Unix system right? I've never played with either.

Re: Secret app on millions of phones logs key taps

#82

Post by samstave »

marcf wrote: post #71
tptacek wrote: post #66

Earlier quoted context omitted.

What percentage of all the SMS messages send by Sprint Android phones in a day do you think 10 gigabytes is? Start here: the US generates about 2 trillion SMS messages in a year across all phones. There are multiple YC startups that could write the (bad) marketing sentence "we receive raw data (known as metrics) from X and convert them into reliable, repeatable Measures which feed into analytic applications". Persona…

At 160 bytes per text and 2T texts per year, there are 800 gigabytes of texts per day. Thus Carrier IQ is monitoring the equivalent of 1% of all texts across all phones. That is still quite significant.

But they are monitoring on the client side, correct?

Who is to say the carriers are not processing on the upstream? We certainly know that Carnivore was designed to do just this.

Let's just say; there is NO privacy on ANY digital communications. Period.

If you think otherwise, it is likely just being naive.

We know that the US and China have been in an extended cyber war fro more that 10 years now.

Re: Secret app on millions of phones logs key taps

#83

Post by rationalbeaver »

CaptainZapp wrote: post #33
revscat wrote: post #16

Earlier quoted context omitted.

To be fair, the response from CarrierIQ implies that this is the case: "In an interview last week, Carrier IQ VP of Marketing Andrew Coward rejected claims the software posed a privacy threat because it never captured key presses. “Our technology is not real time,” he said at the time. "It's not constantly reporting back. It's gathering information up and is usually transmitted in small doses.” Note that last clause…

And why exactly, should I believe Mr. Coward? Besides: Reading weasel words like 'usually' in corporate statements just makes me shudder.

I'm not sure why I would care to defend him, but it seems that his claim that the data is not real time can be verified by the first image in the parent comment's list. In that shot there's a column listing the 'Upload Reason'. The reasons include "Scheduled" and "Archive full", which seems to indicate that the software reports back at set times unless the user was particularly active and the data file hit some size limit.

There's also a third upload reason in that image which has it's own disturbing implications: "SMS_PullRequest_CS".

Re: Secret app on millions of phones logs key taps

#84

Post by artursapek »

samstave wrote: post #65
artursapek wrote: post #51

Earlier quoted context omitted.

That's a figure for all phones, not each phone. Read EwanToo's comment towards the top.

Text can be significantly compressed.

Yes I know. Unless the app sorts out valuable information from noise (passwords, account numbers, etc), I think this conspiracy theory is invalid.

Re: Secret app on millions of phones logs key taps

#85

Post by burgerbrain »

tptacek wrote: post #80
AJ007 wrote: post #67

Earlier quoted context omitted.

There is a video camera in your bathroom secretly recording you. If the perpetrator never stops by to pick up the tape, is a crime committed?

By that logic we should all be very angry at our TTY drivers.

I'm not even sure what I should say to explain the difference here. It should be obvious...

Re: Secret app on millions of phones logs key taps

#87

Post by ugh »

freehunter wrote: post #55
kevin_jacobs wrote: post #29

As a WP7 user, I emailed HTC yesterday asking whether or not this software (or similar products) are used on their WP7 devices. Here's the response I got: "Dear Kevin Jacobs, I understand you would like more information about the Carrier IQ software, or any software of this nature on your device. I understand your concerns about this issue and protecting my privacy is definitely one of my top priorities as well. We h…

>I am sure they did not include any software of this kind. While I am a WP7 owner, I find this to be a little presumptuous. Microsoft may not have included _this specific_ software, but how does HTC know they didn't include anything like it? I don't believe Microsoft gives handset makers the source code for the software. I know they don't allow them to customize it. Perhaps HTC has not installed anything like it or b…

If they knew they wouldn’t be hedging. They don’t know, they just think it’s very unlikely. What this tells you is that HTC (claims they) didn’t do anything with WP7 phones.

Re: Secret app on millions of phones logs key taps

#88

Post by artursapek »

marcf wrote: post #71
tptacek wrote: post #66

Earlier quoted context omitted.

What percentage of all the SMS messages send by Sprint Android phones in a day do you think 10 gigabytes is? Start here: the US generates about 2 trillion SMS messages in a year across all phones. There are multiple YC startups that could write the (bad) marketing sentence "we receive raw data (known as metrics) from X and convert them into reliable, repeatable Measures which feed into analytic applications". Persona…

At 160 bytes per text and 2T texts per year, there are 800 gigabytes of texts per day. Thus Carrier IQ is monitoring the equivalent of 1% of all texts across all phones. That is still quite significant.

You're thinking quantitative when you should be thinking qualitative. The worrisome thing is that, as the screenshots show, they seem have access to location-based information.

http://www.carrieriq.com/overview/IQInsightServiceAnalyzer/i...

I wouldn't care if they were logging non-identifying info, such as the amount of time my phone display is on to analyze battery performance, for instance, or perhaps even the general settings I have on my phone to help HTC deliver more desirable "factory settings." Any of this could add up to that 1% you mention.

Speaking personally though I use a 5 or 6-year-old Blackberry model with no data plan and will happily continue to do so.

Re: Secret app on millions of phones logs key taps

#89

Post by DevX101 »

tptacek wrote: post #66
DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

What percentage of all the SMS messages send by Sprint Android phones in a day do you think 10 gigabytes is? Start here: the US generates about 2 trillion SMS messages in a year across all phones. There are multiple YC startups that could write the (bad) marketing sentence "we receive raw data (known as metrics) from X and convert them into reliable, repeatable Measures which feed into analytic applications". Persona…

Myself and almost every other mobile phone user have the reasonable expectation that third parties should not have the ABILITY to read or modify my private and personal information unless I explicitly give you permission to do so.

This fundamental principle is embedded in all the software I use. I consider any software that doesn't adhere to this principle malware. When my PC crashes, Microsoft asks me if I want to share information with them about what led to the crash. I usually say no, but I appreciate them asking. When I use gmail, I do so with the understanding that Google has full access to the contents of my email. They promise me that they won't do any funny stuff and I accept the conditions of this contract in exchange for free email.

I never entered into such an agreement with CarrierIQ. I've never even heard of CarrierIQ until this week. Yet despite this, they are logging everything I type into my phone, and sending some portion of the information that they log.

If I offered you $100 to install a program I wrote that logged every keystroke on your computer and sent some portion of this information to my own server over TCP, without giving you a privacy policy, you know very well you'd never take me up on this offer. So why is it ok with CarrierIQ?

The focus on how much information is in 10GB is beside the point. The point is that CarrierIQ has been demonstrated to have the ability to read and send everything you type into your phone. At this point we're just hoping they're the good guys and won't do anything overtly evil. But what's to stop them from calling the following function on your phone?

if username == 'tptack': sendStoredData()

Re: Secret app on millions of phones logs key taps

#90

Post by gcb »

masklinn wrote: post #58
gcb wrote: post #54

Earlier quoted context omitted.

Ios also collects all that. It's just more difficult to see inside a safe. Remember the js code that showed all the places the phone have been using a mere phone backup data? ios is already worse then all of this

> Ios also collects all that. Do you have the slightest evidence for your claim? > It's just more difficult to see inside a safe. Anything can be seen on a jailbroken iphone. > Remember the js code that showed all the places the phone have been using a mere phone backup data? This was (explained as) a location cache the developer forgot to clean (most phones will cache the last few locations so it does not have to bo…

you assume too much of rooting.

getting root access is NOT the same as looking at source code. and i don't know anyone reversed the code for IOS besides the small activation parts.

loggers could pretty much do nothing if device is not stock.

what else could be have 'too greedy logging' 'by mistake'? you and me will never know. may be nothing.

Post reply on HN