Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secret app on millions of phones logs key taps

theregister.co.uk

Post reply on HN
Print view View original

101–110 of 193 posts

Re: Secret app on millions of phones logs key taps

#101

Post by chc »

marcf wrote: post #71
tptacek wrote: post #66

Earlier quoted context omitted.

What percentage of all the SMS messages send by Sprint Android phones in a day do you think 10 gigabytes is? Start here: the US generates about 2 trillion SMS messages in a year across all phones. There are multiple YC startups that could write the (bad) marketing sentence "we receive raw data (known as metrics) from X and convert them into reliable, repeatable Measures which feed into analytic applications". Persona…

At 160 bytes per text and 2T texts per year, there are 800 gigabytes of texts per day. Thus Carrier IQ is monitoring the equivalent of 1% of all texts across all phones. That is still quite significant.

160 bytes per text seems like a very generous estimate. Casual observation would suggest the average is less than half that. I just got a text that seemed pretty long to me, so I went back and measured it. It was 90 bytes (104 characters * 7 bits per character / 8 bits per byte).

Re: Secret app on millions of phones logs key taps

#102

Post by 1010100101 »

Is it unreasonable for a consumer to want complete control over a device from the moment she powers on?

Is there a certain level beneath which it is not reasonable to give consumers (optional) access? (Should consumers be prevented from "rooting" devices? Should we allow companies to maintain control over devices, e.g. having them "phone home", after they sell them?)

If yes, why?

Maybe a rootkit should just be viewed just like the crapware that comes pre-installed on a PC. Sure it will help some company and perhaps the consumer herself, if she decides to use it. But it's _optional_.

Maybe they could give consumers an easy way to opt-out.

Re: Secret app on millions of phones logs key taps

#104

Post by moderation »

jgrahamc wrote: post #12

Does it really? http://blog.jgc.org/2011/11/getting-little-tired-of-security... There's no evidence that it sends this information to the company and no evidence that it actually logs it. Only that APIs are called containing it.

This would explain why I haven't seen a reference to a host or URL that I could at least block by proxy on a Wi-Fi network.

Re: Secret app on millions of phones logs key taps

#105

Post by DevX101 »

tptacek wrote: post #97
DevX101 wrote: post #89

Earlier quoted context omitted.

Myself and almost every other mobile phone user have the reasonable expectation that third parties should not have the ABILITY to read or modify my private and personal information unless I explicitly give you permission to do so. This fundamental principle is embedded in all the software I use. I consider any software that doesn't adhere to this principle malware. When my PC crashes, Microsoft asks me if I want to s…

All this comment does is moralize. It adds no new information and provides no useful analysis. The only analysis you've provided to date appears flawed; for instance, it asserts that "10 gigabytes a day" of "raw metrics" implies "message contents". As 'potatolicious seems fond of saying, "that's not even wrong". Everyone agrees with you already. I always forget, is it light or heat that's the one you don't want? You'…

A ${NERD_FREAKOUT} is what led to the enormous backlash against SOPA which very well may play an instrumental part in defeating the bill.

Principles matter, meta discussions like these matter. The technology we work on don't operate in a social vacuum.

Re: Secret app on millions of phones logs key taps

#106

Post by Fluxx »

law wrote: post #27
jgrahamc wrote: post #12

Does it really? http://blog.jgc.org/2011/11/getting-little-tired-of-security... There's no evidence that it sends this information to the company and no evidence that it actually logs it. Only that APIs are called containing it.

The part about logging/transmitting personal info is a red herring. The real issue is failing to provide an opportunity for users to assent to the installation of this software on their device. It makes no difference to me whether data is being logged or transmitted over a network. However, I'm terrified that a phone manufacturer would install a very hidden program with root-like privileges, offering a single point o…

IMO, this is a slippery slope argument. The actual phone OS, which is certainly "logging key presses" is also an opportunity for exploitation via vulnerabilities. I fail to see how software is a special case? Additionally, the carriers are certainly storing and tracking your movement and location, and storing your SMS (how else do you suddenly get them when you turn your phone on after your plane lands?)

I think the subtle difference here is that we as consumers have a implicit understanding that the OS and the carriers must store and handle our data in order to provide the services to us that they do. We must trust them if we use their devices and networks.

That trust is given because the data sensitivity is proportional to the disclosure and scrutiny of the providers. The phone, its OS and who provides the network inherently have access to all your data, a huge responsibility, so no attempts are made to hide or obfuscate who those companies are and what they're doing. You know Samsung makes your phone, it runs on android and you use the Verizon network. CarrierIQ seems to have access to all the same data your OS and carrier has, yet their presence is not made transparent/known to the user of the phone.

That said, it's not clear to me what CarrierIQ's integration is like? Is it purely a software framework Android uses to log and store metrics for the carriers? Is it a 3rd party app installed by the carrier to help them store user metrics? How antonymous is CarrierIQ with the data? Do CarrierIQ engineers see your data or is it just for the carriers? Until that's clear, it's anyone's guess.

Re: Secret app on millions of phones logs key taps

#108

Post by tptacek »

DevX101 wrote: post #105
tptacek wrote: post #97

Earlier quoted context omitted.

All this comment does is moralize. It adds no new information and provides no useful analysis. The only analysis you've provided to date appears flawed; for instance, it asserts that "10 gigabytes a day" of "raw metrics" implies "message contents". As 'potatolicious seems fond of saying, "that's not even wrong". Everyone agrees with you already. I always forget, is it light or heat that's the one you don't want? You'…

A ${NERD_FREAKOUT} is what led to the enormous backlash against SOPA which very well may play an instrumental part in defeating the bill. Principles matter, meta discussions like these matter. The technology we work on don't operate in a social vacuum.

No amount of principle excuses lazy, broken analysis.

Re: Secret app on millions of phones logs key taps

#109

Post by runjake »

mitchty wrote: post #72
runjake wrote: post #36

Earlier quoted context omitted.

What does it matter if it's real time or not? It's still creepy, and it's still my privacy.

The fact that it has hooks to even know of the keystrokes is the real issue here. Even without recording or logging them afterwards, the fact that it has the ability means its a possible attack vector for things like worms/etc... Even if they never do anything with keystroke data, just the fact that they can is the dangerous part. What is to prevent some switch to start sending the keystrokes in the future? I'll be b…

I don't think you read my comment correctly -- or you meant to reply to someone else.
Post reply on HN