Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secret app on millions of phones logs key taps

theregister.co.uk

Post reply on HN
Print view View original

61–70 of 193 posts

Re: Secret app on millions of phones logs key taps

#61

Post by masklinn »

nicwest wrote: post #46
mcritz wrote: post #2

Remember when people were up in arms about how much location data iPhones stored locally? This is 1000 times worse.

I have a horribly naive and defiantly uninformed question: this was detected on an android device which is a fairly open platform when compared to the iPhone/Windows phones in terms of software transparency, correct? Is there any way to know for certain that Apple/MS aren't doing this exact same/similar sort of thing?

> Is there any way to know for certain that Apple/MS aren't doing this exact same/similar sort of thing?

You can't really ever know things "for certain", but considering the number of jailbroken iOS devices in researcher hands it's likely this would have been discovered.

Re: Secret app on millions of phones logs key taps

#62

Post by recoiledsnake »

Fliko wrote: post #57
recoiledsnake wrote: post #39

Earlier quoted context omitted.

Logging is not the same as sending over the network. What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes? Not saying it doesn't send keystrokes, but the video is definitely not proof of that and it bears further investigation, not knee jerk reactions.

It's still pretty dangerous even if it doesn't send keystrokes.

No one is disputing that. But it's wrong to claim that there is clear evidence that keystrokes are being sent just because they're being logged.

Re: Secret app on millions of phones logs key taps

#63

Post by EwanToo »

jff wrote: post #45
artursapek wrote: post #40

Earlier quoted context omitted.

Right, the argument is logged keystrokes never leave your phone because that amount of data from each Android/Blackberry phone would be a lot more thn 10 GB a day. I agree though, why are they logging it at all if the app isn't sending it to them? Very suspicious.

You, uh... you can enter 10 GB of text on your phone per day? I think maybe if you recorded all of the touch events, you'd end up with many megabytes worth, but I doubt the average user will enter more than a few kilobytes worth of text in a day.

There's 144 million phones with it deployed, the figure is the total for them all.

Re: Secret app on millions of phones logs key taps

#64

Post by mbell »

jgrahamc wrote: post #26
DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

They say they are installed on > 148.3M phones. If we imagine that they are gathering 10GB per day then that's about 76 bytes per phone, if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes) then it's 680 bytes. It's more likely to be in the middle (because otherwise the recruiter would have rounded up) so you are talking 100s of bytes per phone per day. I don't think it's reali…

Its a few hundred bytes on average, that doesn't mean every phone reports every day nor does it take into account the number of phones with this installed whom rarely use the device. This probably lives on both my parents handsets and they make 4-5 calls and 1-2 text messages a week between them. I think that type of minimal usage is actually quite wide-spread which easily offsets higher usage users, and with presumably higher outbound data to CarrierIQ.

An average across 145M users crossing various demographics and phones types is not a good metric to use to determine the possible danger of the data being sent.

Re: Secret app on millions of phones logs key taps

#65

Post by samstave »

artursapek wrote: post #51
jff wrote: post #45

Earlier quoted context omitted.

You, uh... you can enter 10 GB of text on your phone per day? I think maybe if you recorded all of the touch events, you'd end up with many megabytes worth, but I doubt the average user will enter more than a few kilobytes worth of text in a day.

That's a figure for all phones, not each phone. Read EwanToo's comment towards the top.

Text can be significantly compressed.

Re: Secret app on millions of phones logs key taps

#66

Post by tptacek »

DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

What percentage of all the SMS messages send by Sprint Android phones in a day do you think 10 gigabytes is? Start here: the US generates about 2 trillion SMS messages in a year across all phones.

There are multiple YC startups that could write the (bad) marketing sentence "we receive raw data (known as metrics) from X and convert them into reliable, repeatable Measures which feed into analytic applications". Personally, I'm inclined to think that when someone writes "we receive raw metrics", they mean "they receive raw metrics". You seem to premise your entire comment on the idea that "raw metrics" means "tremendous opportunities for abuse, damage to national security, corporate espionage".

Those two points --- 10 gigabytes, and "raw metrics" --- seem literally to be the entire basis of your (currently top ranked) comment.

I wish I could be more strident in disagreeing with you (because your tone makes me want to be), but I have to admit that I have no clue what this company is taking off Sprint phones. I'm inclined to believe that nobody could be dumb enough to take the contents of SMS messages from phones --- Sprint doesn't want that data --- but who knows?

I wrote a similarly negative comment yesterday when this story hit HN the first time. Then I read downthread and found John Graham-Cumming thoughtfully picking apart the story. I read his comment, re-read mine, and deleted mine. 'jgc's comments on this story are interesting; ours are less so; his is buried under yours now. Perhaps you could follow my lead.

Re: Secret app on millions of phones logs key taps

#67

Post by AJ007 »

recoiledsnake wrote: post #39
drivebyacct2 wrote: post #35

Earlier quoted context omitted.

Did you read any of the articles or watch the video? The guy shows `adb logcat` running and showing CarrierIQ logging keystrokes with their ASCII codes. (edit: I make no claims about the transmission of data. I merely took "collection" and assumed that if the app was recording (even if not persistently) keystrokes on my phone that it counted as collection. Further, the fact that it can is enough to piss me off, espec…

Logging is not the same as sending over the network. What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes? Not saying it doesn't send keystrokes, but the video is definitely not proof of that and it bears further investigation, not knee jerk reactions.

There is a video camera in your bathroom secretly recording you. If the perpetrator never stops by to pick up the tape, is a crime committed?

Re: Secret app on millions of phones logs key taps

#68

Post by tnorthcutt »

jgrahamc wrote: post #26
DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

They say they are installed on > 148.3M phones. If we imagine that they are gathering 10GB per day then that's about 76 bytes per phone, if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes) then it's 680 bytes. It's more likely to be in the middle (because otherwise the recruiter would have rounded up) so you are talking 100s of bytes per phone per day. I don't think it's reali…

...if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes)...

A terabyte is 1000GB. Why would they be shouting about terabytes if it were anything over .09 terabytes?

Re: Secret app on millions of phones logs key taps

#69

Post by roc »

jgrahamc wrote: post #26
DevX101 wrote: post #24

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for…

They say they are installed on > 148.3M phones. If we imagine that they are gathering 10GB per day then that's about 76 bytes per phone, if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes) then it's 680 bytes. It's more likely to be in the middle (because otherwise the recruiter would have rounded up) so you are talking 100s of bytes per phone per day. I don't think it's reali…

But simple zip on raw text is what? 3 or 4 to 1? Particularly when you're talking about urls. So now you're talking about at least a couple kbytes of raw data.

So logging all of everyone's texts is probably still out.

But easily logging their browsing patterns. Probably app installation and use. And certainly they retain the capability to log texts containing keywords without going too far outside that aggregate range of data. Or doing targeted logging of all of selected individuals usage.

Re: Secret app on millions of phones logs key taps

#70

Post by gyardley »

dangerboysteve wrote: post #34

three words. MASSIVE CLASS ACTION Lawyers fire up your infomercials.

The usual suspects are almost certainly going to file a class-action lawsuit or two over this, but it won't be 'massive' since this isn't a clear and easy win. (The hardest part about this type of suit is showing real, concrete harm to actual people - and not just hypothetical potential harm. So Carrier IQ knows you play Angry Birds - so what? How'd that demonstrably hurt you?)

No, instead the lawyers responsible for offering the class action will be willing to settle for a) a rather nice profit for them, b) a pittance for the handful of individuals they round up to be plaintiffs, and c) some symbolic genuflecting in the direction of privacy, maybe in the form of a charitable donation to a non-profit.

The sum total cost of a) through c) will be carefully calculated - high, but not too high, or Carrier IQ (and their clients, who will also get sued) will decide to fight back and possibly win. Certainly nothing infomerical-worthy - that's reserved for cases where winning is pretty much guaranteed.

Post reply on HN