Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secret app on millions of phones logs key taps

theregister.co.uk

Post reply on HN
Print view View original

121–130 of 193 posts

Re: Secret app on millions of phones logs key taps

#121

Post by CoughlinJ »

jgrahamc wrote: post #26
DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

They say they are installed on > 148.3M phones. If we imagine that they are gathering 10GB per day then that's about 76 bytes per phone, if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes) then it's 680 bytes. It's more likely to be in the middle (because otherwise the recruiter would have rounded up) so you are talking 100s of bytes per phone per day. I don't think it's reali…

If they're only saving, say, online searches and the resulting ip address from each visit, that might be doable, and it seems like the best way to get info passively, and in small sizes.

Re: Secret app on millions of phones logs key taps

#122

Post by scott_s »

tptacek wrote: post #114
Natsu wrote: post #111

Earlier quoted context omitted.

I sincerely doubt that CarrierIQ, or the phone carriers, even care about our text messages. That said, there are other people who do http://www.schneier.com/blog/archives/2009/11/leaked_911_tex... Even so, I wouldn't put it past them to do keyword mining for mobile ads. That just seems like such an obvious potential use.

If Sprint wanted to do that, it doesn't need agent software to get the messages.

This is an important point that I think some people are forgetting. I use Verizon. They already have access to all of my text messages. I send my text messages to Verizon, who then forwards them on to the person I'm talking to. Just as Google first gets my email.

Re: Secret app on millions of phones logs key taps

#123

Post by billybob »

recoiledsnake wrote: post #39
drivebyacct2 wrote: post #35

Earlier quoted context omitted.

Did you read any of the articles or watch the video? The guy shows `adb logcat` running and showing CarrierIQ logging keystrokes with their ASCII codes. (edit: I make no claims about the transmission of data. I merely took "collection" and assumed that if the app was recording (even if not persistently) keystrokes on my phone that it counted as collection. Further, the fact that it can is enough to piss me off, espec…

Logging is not the same as sending over the network. What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes? Not saying it doesn't send keystrokes, but the video is definitely not proof of that and it bears further investigation, not knee jerk reactions.

What useful metric would keystrokes be part of? "Users tend to press the T key a lot..."

Re: Secret app on millions of phones logs key taps

#124

Post by ehthere »

jgrahamc wrote: post #26
DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

They say they are installed on > 148.3M phones. If we imagine that they are gathering 10GB per day then that's about 76 bytes per phone, if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes) then it's 680 bytes. It's more likely to be in the middle (because otherwise the recruiter would have rounded up) so you are talking 100s of bytes per phone per day. I don't think it's reali…

Where did you get 10GB per day from? They boasted about PETABYTES of data they've collected.

"Carrier IQ, which in the second quarter of 2011 passed the petabyte milestone in processed analytics data"

-- http://www.carrieriq.com/company/PR.LarryLenhartCEO.pdf

Re: Secret app on millions of phones logs key taps

#125

Post by scott_s »

revscat wrote: post #74
EwanToo wrote: post #15

There is no evidence the data is being logged and sent. Accessed yes, logged, well nobody has found the log yet, and sent, nobody has found any network traffic. It's still bad, but the reports seem to be over-hyped by journalists looking for a scoop.

Irrelevant. The issues are: (1) That a vector is there for an untrusted third party to record and report all keystrokes (2) It was put there at the insistence of the carriers, and (3) That there is no way for a user to turn it off without voiding their warranty. edit: (4) This has serious implications for the trustworthiness of Android-based platforms as we attempt to move towards using NFC for financial transactions…

JwanToo, jgrahamc and tptacek are questioning point 1. That is, they're pointing out reasons why it may not be a vector. We don't have enough information to know.

Re: Secret app on millions of phones logs key taps

#126

Post by epo »

recoiledsnake wrote: post #41
mcritz wrote: post #2

Remember when people were up in arms about how much location data iPhones stored locally? This is 1000 times worse.

Why does this have to be made into an iPhone vs. Android oneupmanship game? This has been alarmingly on the rise here on HN these days.

Well, for one, because the legion of fandroids would be here raving about the "evil Apple empire" if this story were about Apple, as it is about Android these same fandroids are saying that Apple are just as bad, if not worse.

Re: Secret app on millions of phones logs key taps

#127

Post by jff »

EwanToo wrote: post #63
jff wrote: post #45

Earlier quoted context omitted.

You, uh... you can enter 10 GB of text on your phone per day? I think maybe if you recorded all of the touch events, you'd end up with many megabytes worth, but I doubt the average user will enter more than a few kilobytes worth of text in a day.

There's 144 million phones with it deployed, the figure is the total for them all.

I read "that amount of data from each Android/Blackberry phone would be a lot more thn 10 GB a day." as "each device is generating over 10 GB a day." It makes more sense as a total, and really, 10 GB a day is NOTHING. In scientific computing, terabytes a day isn't too unusual, so it's certainly no big deal to store and process 10 GB a day.

Re: Secret app on millions of phones logs key taps

#128

Post by DanBC »

tptacek wrote: post #100
DanBC wrote: post #94

Earlier quoted context omitted.

How do you feel about the supposed MITM "feature" of CarrierIQ's product?

I think that the facts matter. I think that there are zero people on HN that think CarrierIQ is a good idea. So if all we're doing here is condemning CarrierIQ, let's just replace this whole thread with "CARRIERIQ BAD", followed by a bulleted list of bad things, vote it up to 1000, and then get back to talking about building things.

> So if all we're doing here is condemning CarrierIQ

I asked someone who is quite good with crypto a question about a possible MITM attack on 141 million phones. I didn't condemn CarrierIQ, I avoided dramatic language, I even added qualifiers to avoid stating something as fact if it wasn't yet confirmed.

Re: Secret app on millions of phones logs key taps

#129

Post by mog_man »

billybob wrote: post #123
recoiledsnake wrote: post #39

Earlier quoted context omitted.

Logging is not the same as sending over the network. What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes? Not saying it doesn't send keystrokes, but the video is definitely not proof of that and it bears further investigation, not knee jerk reactions.

What useful metric would keystrokes be part of? "Users tend to press the T key a lot..."

they can keep track of everything that you type, credit card info, wifi passwords, other passwords, sexting... so i guess nothing important, eh?

Re: Secret app on millions of phones logs key taps

#130

Post by DevX101 »

ehthere wrote: post #124
jgrahamc wrote: post #26

Earlier quoted context omitted.

They say they are installed on > 148.3M phones. If we imagine that they are gathering 10GB per day then that's about 76 bytes per phone, if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes) then it's 680 bytes. It's more likely to be in the middle (because otherwise the recruiter would have rounded up) so you are talking 100s of bytes per phone per day. I don't think it's reali…

Where did you get 10GB per day from? They boasted about PETABYTES of data they've collected. "Carrier IQ, which in the second quarter of 2011 passed the petabyte milestone in processed analytics data" -- http://www.carrieriq.com/company/PR.LarryLenhartCEO.pdf

Great point. The 10s of GB was anecdotal data from a CarrierIQ recruiter.

If we go by the official letter you've posted and assume conservatively CarrierIQ has only 1 Petabyte of data, and that they've been collecting since 2006 (when they received their Series A), they've been collecting 456 GBs of data per day. Its probably more than that today since the data collection rate has surely accelerated over time.

That's an order of magnitude beyond 10s of GB per day.

Post reply on HN