Secret app on millions of phones logs key taps • Hacker News Board

Re: Secret app on millions of phones logs key taps

#131

Post by mog_man » Wed, Nov 30, 2011, 9:32 PM UTC

artursapek wrote: post #40

drivebyacct2 wrote: post #35

Earlier quoted context omitted.

Did you read any of the articles or watch the video? The guy shows `adb logcat` running and showing CarrierIQ logging keystrokes with their ASCII codes. (edit: I make no claims about the transmission of data. I merely took "collection" and assumed that if the app was recording (even if not persistently) keystrokes on my phone that it counted as collection. Further, the fact that it can is enough to piss me off, espec…

Right, the argument is logged keystrokes never leave your phone because that amount of data from each Android/Blackberry phone would be a lot more thn 10 GB a day. I agree though, why are they logging it at all if the app isn't sending it to them? Very suspicious.

First, don't trust a recruiter's technical information.

Second, maybe they are selling the information to other parties by letting the other parties grab the information themselves.

Re: Secret app on millions of phones logs key taps

#132

Post by mog_man » Wed, Nov 30, 2011, 9:37 PM UTC

jgrahamc wrote: post #26

DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

They say they are installed on > 148.3M phones. If we imagine that they are gathering 10GB per day then that's about 76 bytes per phone, if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes) then it's 680 bytes. It's more likely to be in the middle (because otherwise the recruiter would have rounded up) so you are talking 100s of bytes per phone per day. I don't think it's reali…

A smart drug dealer never brings the drug home. He uses drop off locations. In this case, your phone maybe the drop off location.

Re: Secret app on millions of phones logs key taps

#133

Post by unreal37 » Wed, Nov 30, 2011, 9:38 PM UTC

jgrahamc wrote: post #12

Does it really? http://blog.jgc.org/2011/11/getting-little-tired-of-security... There's no evidence that it sends this information to the company and no evidence that it actually logs it. Only that APIs are called containing it.

Finally some sanity. Thanks John for this reasoned analysis.

Re: Secret app on millions of phones logs key taps

#134

Post by unreal37 » Wed, Nov 30, 2011, 9:40 PM UTC

killnine wrote: post #96

Why is this whole company and all of it's employees not indicted for trespassing, breaking and entering, burglary, etc????? How is stealing the most sensitive of data off my phone without my knowledge/consent ANY different then walking into my house and taking my passport??

Because there is no evidence of any data leaving your phone. It's not stealing. It's just a debugger/logger.

Re: Secret app on millions of phones logs key taps

#135

Post by tptacek » Wed, Nov 30, 2011, 9:53 PM UTC

DanBC wrote: post #128

tptacek wrote: post #100

Earlier quoted context omitted.

I think that the facts matter. I think that there are zero people on HN that think CarrierIQ is a good idea. So if all we're doing here is condemning CarrierIQ, let's just replace this whole thread with "CARRIERIQ BAD", followed by a bulleted list of bad things, vote it up to 1000, and then get back to talking about building things.

> So if all we're doing here is condemning CarrierIQ I asked someone who is quite good with crypto a question about a possible MITM attack on 141 million phones. I didn't condemn CarrierIQ, I avoided dramatic language, I even added qualifiers to avoid stating something as fact if it wasn't yet confirmed.

Sorry. You're right. I let the ultra dumbness of this whole thread bring me down a bit.

Doing an SSL MITM from agent software installed by the carrier on a phone seems pretty silly, since the carrier is in a position to see anything you're typing into your phone anyways (in the sense that it controls the OS).

I'm not sure I buy any analysis that suggests CarrierIQ is really "MITM'ing" SSL --- though that's trivial for a software agent to do --- because the same people saying that are also saying that it's obvious that CarrierIQ is capturing and remote-logging message contents.

Re: Secret app on millions of phones logs key taps

#136

Post by lwat » Wed, Nov 30, 2011, 9:56 PM UTC

DevX101 wrote: post #130

ehthere wrote: post #124

Earlier quoted context omitted.

Where did you get 10GB per day from? They boasted about PETABYTES of data they've collected. "Carrier IQ, which in the second quarter of 2011 passed the petabyte milestone in processed analytics data" -- http://www.carrieriq.com/company/PR.LarryLenhartCEO.pdf

Great point. The 10s of GB was anecdotal data from a CarrierIQ recruiter. If we go by the official letter you've posted and assume conservatively CarrierIQ has only 1 Petabyte of data, and that they've been collecting since 2006 (when they received their Series A), they've been collecting 456 GBs of data per day. Its probably more than that today since the data collection rate has surely accelerated over time. That's…

Well realistically they would not have been collecting 456GB per day from day 1. They would have grown from almost nothing, which means that today they're probably collecting around a terabyte per day. That's two orders of magnitude, 7KB per user per day - and could definitely include all keystrokes of all users.

Re: Secret app on millions of phones logs key taps

#137

Post by throwaway30 » Wed, Nov 30, 2011, 10:01 PM UTC

There are one disturbing thing here:

A handful of comments are saying that is ok because CarrierIQ is probably not sending all data (probably not in Europe, but probably they do in Saudi Arabia). This is disturbing because people making these kind of comments are entrepreneurs and in general great people. It seems like we are loosing our moral compas in Silly Valley. Fuck. Please please don't do things like this.

Re: Secret app on millions of phones logs key taps

#138

Post by vm » Wed, Nov 30, 2011, 10:02 PM UTC

CarrierIQ provides a valuable service for all us. They relay data that optimizes carrier networks, so that we can call, text, get data, etc more reliably.

The problem this thread highlights is poor marketing and transparency. No one at CarrierIQ gives a damn what we text. Breaking those basic privacy tenants would destroy their business, which seems to be going nicely if their software is on >100M devices.

The company just does a crappy job explaining what their technology does and how it helps consumers. Uncertainty around our private information spooks people, which leads to distrust and conspiracy theories. Let this be a valuable lesson for entrepreneurs who touch consumer data, even B2B solutions.

Gmail and Bluekai provide excellent counter-examples of ways to squash these concerns: -Gmail -remember the ruckus about Google reading your email for ads? Google publicly explained this and now no one cares. -Bluekai -the company tracks data for online ads. Touch subject. But they're transparent and lay everything out on their website, including an opt-out: http://bluekai.com/consumers.php

CarrierIQ clearly needs to address these issues. Let's call on them to do that. In the meantime, take a moment to imagine how much more we'd hate carriers if reception was even spottier (cough...AT&T iphone...)

Re: Secret app on millions of phones logs key taps

#139

Post by tedunangst » Wed, Nov 30, 2011, 10:03 PM UTC

billybob wrote: post #123

recoiledsnake wrote: post #39

Earlier quoted context omitted.

Logging is not the same as sending over the network. What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes? Not saying it doesn't send keystrokes, but the video is definitely not proof of that and it bears further investigation, not knee jerk reactions.

What useful metric would keystrokes be part of? "Users tend to press the T key a lot..."

I would love it if somebody noticed that I hit the "return, backspace, space" combo over and over and made the return key slightly smaller.

Re: Secret app on millions of phones logs key taps

#140

Post by Periodic » Wed, Nov 30, 2011, 10:10 PM UTC

tnorthcutt wrote: post #68

jgrahamc wrote: post #26

Earlier quoted context omitted.

They say they are installed on > 148.3M phones. If we imagine that they are gathering 10GB per day then that's about 76 bytes per phone, if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes) then it's 680 bytes. It's more likely to be in the middle (because otherwise the recruiter would have rounded up) so you are talking 100s of bytes per phone per day. I don't think it's reali…

...if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes)... A terabyte is 1000GB. Why would they be shouting about terabytes if it were anything over .09 terabytes?

Because that's how recruiter math works. They round to the nearest buzz word.