Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secret app on millions of phones logs key taps

theregister.co.uk

Post reply on HN
Print view View original

111–120 of 193 posts

Re: Secret app on millions of phones logs key taps

#111

Post by Natsu »

tptacek wrote: post #79
marcf wrote: post #71

Earlier quoted context omitted.

At 160 bytes per text and 2T texts per year, there are 800 gigabytes of texts per day. Thus Carrier IQ is monitoring the equivalent of 1% of all texts across all phones. That is still quite significant.

The point isn't how many texts they're getting --- one would be too many. The point is "10 gigabytes per day of metrics" doesn't itself imply that they're getting message contents.

I sincerely doubt that CarrierIQ, or the phone carriers, even care about our text messages. That said, there are other people who do

http://www.schneier.com/blog/archives/2009/11/leaked_911_tex...

Even so, I wouldn't put it past them to do keyword mining for mobile ads. That just seems like such an obvious potential use.

Re: Secret app on millions of phones logs key taps

#112

Post by miles »

DevX101 wrote: post #105
tptacek wrote: post #97

Earlier quoted context omitted.

All this comment does is moralize. It adds no new information and provides no useful analysis. The only analysis you've provided to date appears flawed; for instance, it asserts that "10 gigabytes a day" of "raw metrics" implies "message contents". As 'potatolicious seems fond of saying, "that's not even wrong". Everyone agrees with you already. I always forget, is it light or heat that's the one you don't want? You'…

A ${NERD_FREAKOUT} is what led to the enormous backlash against SOPA which very well may play an instrumental part in defeating the bill. Principles matter, meta discussions like these matter. The technology we work on don't operate in a social vacuum.

@DevX101 - don't let the grumpy guy get you down. Your comments are spot on.

Re: Secret app on millions of phones logs key taps

#114

Post by tptacek »

Natsu wrote: post #111
tptacek wrote: post #79

Earlier quoted context omitted.

The point isn't how many texts they're getting --- one would be too many. The point is "10 gigabytes per day of metrics" doesn't itself imply that they're getting message contents.

I sincerely doubt that CarrierIQ, or the phone carriers, even care about our text messages. That said, there are other people who do http://www.schneier.com/blog/archives/2009/11/leaked_911_tex... Even so, I wouldn't put it past them to do keyword mining for mobile ads. That just seems like such an obvious potential use.

If Sprint wanted to do that, it doesn't need agent software to get the messages.

Re: Secret app on millions of phones logs key taps

#115

Post by cookiecaper »

I think this is a good case study in support of "never trust an internet-connected electronic device directly from a vendor". There should be a universal policy to unlock, root, or blow away any software that exists and replace it with "known good" software, like CyanogenMod, Ubuntu, or a new copy of Windows.

Re: Secret app on millions of phones logs key taps

#116

Post by masklinn »

gcb wrote: post #90
masklinn wrote: post #58

Earlier quoted context omitted.

> Ios also collects all that. Do you have the slightest evidence for your claim? > It's just more difficult to see inside a safe. Anything can be seen on a jailbroken iphone. > Remember the js code that showed all the places the phone have been using a mere phone backup data? This was (explained as) a location cache the developer forgot to clean (most phones will cache the last few locations so it does not have to bo…

you assume too much of rooting. getting root access is NOT the same as looking at source code. and i don't know anyone reversed the code for IOS besides the small activation parts. loggers could pretty much do nothing if device is not stock. what else could be have 'too greedy logging' 'by mistake'? you and me will never know. may be nothing.

> you assume too much of rooting.

No.

> getting root access is NOT the same as looking at source code.

Er... duh? That doesn't matter, the kind of issues we're talking about here is usually discovered via blackbox testing (not whitebox), by tracing syscalls or core API calls (no need for source access for that) as well as network communications (no need for sources either).

> loggers could pretty much do nothing if device is not stock.

And the vast majority of devices are stock.

> what else could be have 'too greedy logging' 'by mistake'? you and me will never know.

Logging has to go somewhere, logging that goes nowhere is pointless. As soon as logging goes somewhere, it can be seen and traced.

Re: Secret app on millions of phones logs key taps

#117

Post by GigabyteCoin »

jgrahamc wrote: post #26
DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

They say they are installed on > 148.3M phones. If we imagine that they are gathering 10GB per day then that's about 76 bytes per phone, if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes) then it's 680 bytes. It's more likely to be in the middle (because otherwise the recruiter would have rounded up) so you are talking 100s of bytes per phone per day. I don't think it's reali…

For the amount many people who heavily use their phones, I think the numbers are sound. 1% of the users probably consume 99% of the resources. You being that in top 1%.

Re: Secret app on millions of phones logs key taps

#118

Post by Steko »

tptacek wrote: post #79
marcf wrote: post #71

Earlier quoted context omitted.

At 160 bytes per text and 2T texts per year, there are 800 gigabytes of texts per day. Thus Carrier IQ is monitoring the equivalent of 1% of all texts across all phones. That is still quite significant.

The point isn't how many texts they're getting --- one would be too many. The point is "10 gigabytes per day of metrics" doesn't itself imply that they're getting message contents.

"The point isn't how many texts they're getting ... "

You, earlier:

"What percentage of all the SMS messages ... do you think 10 gigabytes is?"

Stop moving the goalposts and maybe we'll get somewhere.

Re: Secret app on millions of phones logs key taps

#119

Post by tptacek »

Steko wrote: post #118
tptacek wrote: post #79

Earlier quoted context omitted.

The point isn't how many texts they're getting --- one would be too many. The point is "10 gigabytes per day of metrics" doesn't itself imply that they're getting message contents.

"The point isn't how many texts they're getting ... " You, earlier: "What percentage of all the SMS messages ... do you think 10 gigabytes is?" Stop moving the goalposts and maybe we'll get somewhere.

You are militantly missing my point. There is no evidence that they are seeing message contents. All we are going on in this thread is the supposition that because they're getting "10 gigabytes a day", it must be message contents.

Re: Secret app on millions of phones logs key taps

#120

Post by gergles »

tptacek wrote: post #100
DanBC wrote: post #94

Earlier quoted context omitted.

How do you feel about the supposed MITM "feature" of CarrierIQ's product?

I think that the facts matter. I think that there are zero people on HN that think CarrierIQ is a good idea. So if all we're doing here is condemning CarrierIQ, let's just replace this whole thread with "CARRIERIQ BAD", followed by a bulleted list of bad things, vote it up to 1000, and then get back to talking about building things.

Or how about if you don't think that this thread is contributing anything to what you think HN should be, you stop yelling at everyone posting in it and go back to "building things"?

We get it, you don't like this thread. You don't need to respond to every comment with a pedantic "fuck you, shut up, and get off my lawn, I have a billion comment karma because people upvote snark so now I'm going to act like a dick " comment of your own.

Post reply on HN