3 ms·

I'm not sure that this discovery will have any effect. While there are claims that this software is marketed to businesses, I'm skeptical that it's anything mor

I'm not sure that this discovery will have any effect. While there are claims that this software is marketed to businesses, I'm skeptical that it's anything more than a drop in the bucket compared to use by shady individuals. Non-business users (like nosy parents and controlling spouses) probably won't ever know about this security breach. I have no sympathy for anyone who uses software like this, I strongly feel there is no justification for software like this that outweighs the invasion of privacy and other harms, and I don't think this functionality should even be possible at the phone OS level, nor should it be allowed for sale in application stores. The security failure itself isn't surprising in the least, though. Only bad people write this kind of software. They've already limited their pool of potential hires to people with no ethical or moral standards. Also, look at the image in the article containing the description of SpyFone. They can't even perform basic copy-editing. Poor grammar in commercial products is a solid barometer for overall product quality.

occamrazor 8y ago
BTW every reputable company has server-side auditable logs and relies on phone apps only to wipe mobile devices or bulk install/uninstall apps.
gowld 8y ago
Agreed. The app's intended design purpose was to leak private data. The data breach happened as soon as the software was installed; the exposed S3 bucket is irrelevant.
- anfilt 8y ago
  Doesnot mean the people targeted by software fair any better with such data leaked on the internet.
scarface74 8y ago
I have no sympathy for anyone who uses software like this, I strongly feel there is no justification for software like this that outweighs the invasion of privacy and other harms, and I don't think this functionality should even be possible at the phone OS level, nor should it be allowed for sale in application stores. Most of these features aren’t available on iOS. From what I can tell, you have to know thier iCloud credentials and be in a position to do the 2FA.

occamrazor 8y ago

BTW every reputable company has server-side auditable logs and relies on phone apps only to wipe mobile devices or bulk install/uninstall apps.

gowld 8y ago

Agreed. The app's intended design purpose was to leak private data. The data breach happened as soon as the software was installed; the exposed S3 bucket is irrelevant.

anfilt 8y ago
Doesnot mean the people targeted by software fair any better with such data leaked on the internet.

scarface74 8y ago

I have no sympathy for anyone who uses software like this, I strongly feel there is no justification for software like this that outweighs the invasion of privacy and other harms, and I don't think this functionality should even be possible at the phone OS level, nor should it be allowed for sale in application stores. Most of these features aren’t available on iOS. From what I can tell, you have to know thier iCloud credentials and be in a position to do the 2FA.