Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secret app on millions of phones logs key taps

theregister.co.uk

Post reply on HN
Print view View original

91–100 of 193 posts

Re: Secret app on millions of phones logs key taps

#91

Post by artursapek »

samstave wrote: post #82
marcf wrote: post #71

Earlier quoted context omitted.

At 160 bytes per text and 2T texts per year, there are 800 gigabytes of texts per day. Thus Carrier IQ is monitoring the equivalent of 1% of all texts across all phones. That is still quite significant.

But they are monitoring on the client side, correct? Who is to say the carriers are not processing on the upstream? We certainly know that Carnivore was designed to do just this. Let's just say; there is NO privacy on ANY digital communications. Period. If you think otherwise, it is likely just being naive. We know that the US and China have been in an extended cyber war fro more that 10 years now.

To say that is to give up trying

Re: Secret app on millions of phones logs key taps

#92

Post by babebridou »

adolph wrote: post #32
babebridou wrote: post #30

I just checked on my Motorola Atrix. I didn't see any CarrierIQ process, but the Blur framework is logging tons of stuff on ADB, such as all key inputs for the autocompletion software or every swipe movement on the home screen, but no https query appear to be logged at first glance. "Search Intent" terms on the other hand are logged. I never really trusted Blur because until the latest few versions of the ADT the Log…

I think in this instance the application Charles would be more helpful than Wireshark. See the below article for how someone analyzed wifi traffic from iPad: http://waxy.org/2011/02/how_i_indexed_the_daily/

Thanks for the useful link. Now to enable proxy settings on the Atrix...

Alright. So for now I don't see much "phone-home trouble" but I'm far from the security expert around here. There are a few http queries (both GET and POST) made using some plain text OAUTH tokens to the MotoBLUR servers, but as far as I could notice nothing was really sending much information. Then again, the first thing you do when you launch blur for the first time is giving it your twitter/facebook/gmail account login&passwords, so... I'll get what I deserve here :P

The only "tracking/keylogging" queries I could find were done to data.flurry.com, and were only tracking (in plain text) my inputs on the Winamp App, so I call it fair play.

I'm a bit relieved here, thanks again for the tip with Charles. Let's hope someone with a better expertise than me will definitely rule Motorola out of that CarrierIQ logging thing, but so far, so good.

Re: Secret app on millions of phones logs key taps

#93

Post by gcb »

artursapek wrote: post #81
masklinn wrote: post #58

Earlier quoted context omitted.

> Ios also collects all that. Do you have the slightest evidence for your claim? > It's just more difficult to see inside a safe. Anything can be seen on a jailbroken iphone. > Remember the js code that showed all the places the phone have been using a mere phone backup data? This was (explained as) a location cache the developer forgot to clean (most phones will cache the last few locations so it does not have to bo…

You made me wonder- is jailbreaking an iPhone the equivalent of rooting an Android phone? It's just about becoming the root user in the Unix system right? I've never played with either.

rooting both is the same conceptually, your guess is right.

Then there's also the privilege of the apps. which i have no idea how it works on ios.

Re: Secret app on millions of phones logs key taps

#94

Post by DanBC »

tptacek wrote: post #66
DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

What percentage of all the SMS messages send by Sprint Android phones in a day do you think 10 gigabytes is? Start here: the US generates about 2 trillion SMS messages in a year across all phones. There are multiple YC startups that could write the (bad) marketing sentence "we receive raw data (known as metrics) from X and convert them into reliable, repeatable Measures which feed into analytic applications". Persona…

How do you feel about the supposed MITM "feature" of CarrierIQ's product?

Re: Secret app on millions of phones logs key taps

#95

Post by salimmadjd »

The issue is not how many bit or bytes this is sending. The fact that you have never given permission to this and you can't switch it off tells me something about Google and their priorities. Steve Jobs fought hard to prevent any carrier pre-install apps on the iPhone. No such a leadership from google!

Re: Secret app on millions of phones logs key taps

#96

Post by killnine »

Why is this whole company and all of it's employees not indicted for trespassing, breaking and entering, burglary, etc?????

How is stealing the most sensitive of data off my phone without my knowledge/consent ANY different then walking into my house and taking my passport??

Re: Secret app on millions of phones logs key taps

#97

Post by tptacek »

DevX101 wrote: post #89
tptacek wrote: post #66

Earlier quoted context omitted.

What percentage of all the SMS messages send by Sprint Android phones in a day do you think 10 gigabytes is? Start here: the US generates about 2 trillion SMS messages in a year across all phones. There are multiple YC startups that could write the (bad) marketing sentence "we receive raw data (known as metrics) from X and convert them into reliable, repeatable Measures which feed into analytic applications". Persona…

Myself and almost every other mobile phone user have the reasonable expectation that third parties should not have the ABILITY to read or modify my private and personal information unless I explicitly give you permission to do so. This fundamental principle is embedded in all the software I use. I consider any software that doesn't adhere to this principle malware. When my PC crashes, Microsoft asks me if I want to s…

All this comment does is moralize. It adds no new information and provides no useful analysis. The only analysis you've provided to date appears flawed; for instance, it asserts that "10 gigabytes a day" of "raw metrics" implies "message contents".

As 'potatolicious seems fond of saying, "that's not even wrong".

Everyone agrees with you already.

I always forget, is it light or heat that's the one you don't want? You're adding more of the bad one, and none of the good one.

Apart from rebutting your analysis earlier, I'm under no illusion that my comment is helping clear up this ${INSERT_NERD_FREAKOUT_HERE} either, but I'm at least happy to speak up and raise the meta point that we shouldn't be rewarding comments like yours. Also, for obvious reasons, I'm past giving a shit about comment karma, so I can just say what I think.

Re: Secret app on millions of phones logs key taps

#99

Post by ck2 »

This guy needs prison time for lies like these - or at least hauled before congress:

  Carrier IQ VP of Marketing Andrew Coward rejected claims the 
  software posed a privacy threat because it never captured key presses.

  “Our technology is not real time,” he said at the time. "It's not constantly reporting back. 
  It's gathering information up and is usually transmitted in small doses.”

  Coward say[s] that Carrier IQ was a diagnostic tool designed to give network carriers and device manufacturers 
  detailed information about the causes of dropped calls and other performance issues.

Re: Secret app on millions of phones logs key taps

#100

Post by tptacek »

DanBC wrote: post #94
tptacek wrote: post #66

Earlier quoted context omitted.

What percentage of all the SMS messages send by Sprint Android phones in a day do you think 10 gigabytes is? Start here: the US generates about 2 trillion SMS messages in a year across all phones. There are multiple YC startups that could write the (bad) marketing sentence "we receive raw data (known as metrics) from X and convert them into reliable, repeatable Measures which feed into analytic applications". Persona…

How do you feel about the supposed MITM "feature" of CarrierIQ's product?

I think that the facts matter.

I think that there are zero people on HN that think CarrierIQ is a good idea.

So if all we're doing here is condemning CarrierIQ, let's just replace this whole thread with "CARRIERIQ BAD", followed by a bulleted list of bad things, vote it up to 1000, and then get back to talking about building things.

Post reply on HN