12 ms·

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the networ

by DevX101 15y ago

There are a handful of comments here giving CarrierIQ the benefit of the doubt, because the video did not show CarrierIQ sending the logged data over the network. If you're still inclined to give them the benefit of the doubt, just read the CarrierIQ website. Their ENTIRE BUSINESS MODEL is based on collecting data about mobile phone users!! Here's a choice excerptI found on their website after browsing their site for 30 seconds[1]: Carrier IQ's Mobile Service Intelligence Platform (MSIP)...receives raw data (known as Metrics) from phones and converts them into reliable, repeatable Measures which feed into analytic applications. Or you can read this comment from a discussion last week where a CarrierIQ recruiter told an HN member that they collect 10s of gigabytes of data PER DAY.[2] These guys are indeed collecting RAW DATA from actions on your phone. There are tremendous opportunities for abuse here, should CarrierIQ decide to do so. CarrierIQ in blatant violation of privacy norms and could do enormous damage to national security of many countries, conduct corporate espionage, or simply violate the citizens' expectation of privacy when using their phone. This is dangerous and should be stopped immediately. 1. http://www.carrieriq.com/overview/mobileservice/index.htm http://www.carrieriq.com/overview/mobileservice/index.htm 2. http://news.ycombinator.com/item?id=3264264 http://news.ycombinator.com/item?id=3264264

EwanToo 15y ago
They are collecting data, but I'm pretty sure it's not keystroke data - that kind of volume would be 10s of TB per day, not GB. From your link to the recruiter: Each handset collects and reports 100's of metrics of device and user behavior in real time. That's data like phone location, applications used, etc. Very bad yes, keylogger reporting your password, no.
- drivebyacct2 15y ago
  Did you read any of the articles or watch the video? The guy shows `adb logcat` running and showing CarrierIQ logging keystrokes with their ASCII codes. (edit: I make no claims about the transmission of data. I merely took "collection" and assumed that if the app was recording (even if not persistently) keystrokes on my phone that it counted as collection. Further, the fact that it can is enough to piss me off, especially since it seems like makers of this type of software have piss-poor track records for their app security)
  - yellowbkpk 15y ago
    Logging to logcat does not mean it's sending those keystrokes anywhere on the internet. Logcat is the local system log and doesn't necessarily get sent anywhere but to a ring buffer on the device.
  - recoiledsnake 15y ago
    Logging is not the same as sending over the network. What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes? Not saying it doesn't send keystrokes, but the video is definitely not proof of that and it bears further investigation, not knee jerk reactions.
    - Fliko 15y ago
      It's still pretty dangerous even if it doesn't send keystrokes.
      - recoiledsnake 15y ago
        No one is disputing that. But it's wrong to claim that there is clear evidence that keystrokes are being sent just because they're being logged.
    - AJ007 15y ago
      There is a video camera in your bathroom secretly recording you. If the perpetrator never stops by to pick up the tape, is a crime committed?
      - recoiledsnake 15y ago
        If someone implies that there is proof that the perpetrator picked up the tape when there is no such evidence, are they right?
      - sycren 15y ago
        How did the perpetrator plant such a device in the first place? Did he have permission? If not, perhaps a different crime was committed.
- jsz0 15y ago
  People aren't writing novels on their SmartPhones. The typed input from a normal volume of text messages, e-mails, and URLs is actually pretty minute when you think about it. Certainly it would be compressed before being uploaded to their servers. IIRC they cite 140 million active devices so if you figure 3kB per day, which is probably on the high side, that's only 400GB before compression. You can compress text down by about 90% these days. That works out to only 44GB of data uploaded per day.
jgrahamc 15y ago
They say they are installed on > 148.3M phones. If we imagine that they are gathering 10GB per day then that's about 76 bytes per phone, if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes) then it's 680 bytes. It's more likely to be in the middle (because otherwise the recruiter would have rounded up) so you are talking 100s of bytes per phone per day. I don't think it's realistic that they are sending all my URLs, all my keystrokes etc. in a few hundred bytes.
- mootothemax 15y ago
  I don't think it's realistic that they are sending all my URLs, all my keystrokes etc. in a few hundred bytes. I tend to agree with you, but at the same time wonder how they're aggregating the data; they could store each day's raw data in however many GB, then crunch it down later. The only other potential issue that jumps out at me is bandwidth; I'd find it strange if the data isn't being compressed, but if it is, you could cram quite a lot of useful information into those few hundred bytes ;)
- DevX101 15y ago
  Whether they are sending a full log report of my actions TODAY is beside the main point. I do however know two things. 1) That their local software processes almost every key stroke made. 2) And that they do send at least some portion of this data back to their servers. At this point it would be trivial for them to send my private information TOMORROW if they decided to do so. I don't know that they don't have a subroutine to begin sending all of my SMS back to their servers if they decide to so for profit or under government coercion. If they have no plans of using my Google searches, they shouldn't process it in the first place.
  - hackoder 15y ago
    This is exactly right. It is the presence of a keylogger, which (at the very least) is echoing keystrokes, that is the problem. Whether they 'send' everything or only parts of it, or whether the data is anonymized, aggregated etc is a whole other discussion.
  - 15y ago
tptacek 15y ago
What percentage of all the SMS messages send by Sprint Android phones in a day do you think 10 gigabytes is? Start here: the US generates about 2 trillion SMS messages in a year across all phones. There are multiple YC startups that could write the (bad) marketing sentence "we receive raw data (known as metrics) from X and convert them into reliable, repeatable Measures which feed into analytic applications". Personally, I'm inclined to think that when someone writes "we receive raw metrics", they mean "they receive raw metrics". You seem to premise your entire comment on the idea that "raw metrics" means "tremendous opportunities for abuse, damage to national security, corporate espionage". Those two points --- 10 gigabytes, and "raw metrics" --- seem literally to be the entire basis of your (currently top ranked) comment. I wish I could be more strident in disagreeing with you (because your tone makes me want to be), but I have to admit that I have no clue what this company is taking off Sprint phones. I'm inclined to believe that nobody could be dumb enough to take the contents of SMS messages from phones --- Sprint doesn't want that data --- but who knows? I wrote a similarly negative comment yesterday when this story hit HN the first time. Then I read downthread and found John Graham-Cumming thoughtfully picking apart the story. I read his comment, re-read mine, and deleted mine. 'jgc's comments on this story are interesting; ours are less so; his is buried under yours now. Perhaps you could follow my lead.
- marcf 15y ago
  At 160 bytes per text and 2T texts per year, there are 800 gigabytes of texts per day. Thus Carrier IQ is monitoring the equivalent of 1% of all texts across all phones. That is still quite significant.
  - tptacek 15y ago
    The point isn't how many texts they're getting --- one would be too many. The point is "10 gigabytes per day of metrics" doesn't itself imply that they're getting message contents.
    - Natsu 15y ago
      I sincerely doubt that CarrierIQ, or the phone carriers, even care about our text messages. That said, there are other people who do http://www.schneier.com/blog/archives/2009/11/leaked_911_text.html http://www.schneier.com/blog/archives/2009/11/leaked_911_tex... Even so, I wouldn't put it past them to do keyword mining for mobile ads. That just seems like such an obvious potential use.

by DevX101 15y ago

EwanToo 15y ago

They are collecting data, but I'm pretty sure it's not keystroke data - that kind of volume would be 10s of TB per day, not GB. From your link to the recruiter: Each handset collects and reports 100's of metrics of device and user behavior in real time. That's data like phone location, applications used, etc. Very bad yes, keylogger reporting your password, no.

drivebyacct2 15y ago
Did you read any of the articles or watch the video? The guy shows `adb logcat` running and showing CarrierIQ logging keystrokes with their ASCII codes. (edit: I make no claims about the transmission of data. I merely took "collection" and assumed that if the app was recording (even if not persistently) keystrokes on my phone that it counted as collection. Further, the fact that it can is enough to piss me off, especially since it seems like makers of this type of software have piss-poor track records for their app security)
- yellowbkpk 15y ago
  Logging to logcat does not mean it's sending those keystrokes anywhere on the internet. Logcat is the local system log and doesn't necessarily get sent anywhere but to a ring buffer on the device.
- recoiledsnake 15y ago
  Logging is not the same as sending over the network. What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes? Not saying it doesn't send keystrokes, but the video is definitely not proof of that and it bears further investigation, not knee jerk reactions.
  - Fliko 15y ago
    It's still pretty dangerous even if it doesn't send keystrokes.
    - recoiledsnake 15y ago
      No one is disputing that. But it's wrong to claim that there is clear evidence that keystrokes are being sent just because they're being logged.
  - AJ007 15y ago
    There is a video camera in your bathroom secretly recording you. If the perpetrator never stops by to pick up the tape, is a crime committed?
    - recoiledsnake 15y ago
      If someone implies that there is proof that the perpetrator picked up the tape when there is no such evidence, are they right?
    - sycren 15y ago
      How did the perpetrator plant such a device in the first place? Did he have permission? If not, perhaps a different crime was committed.
jsz0 15y ago
People aren't writing novels on their SmartPhones. The typed input from a normal volume of text messages, e-mails, and URLs is actually pretty minute when you think about it. Certainly it would be compressed before being uploaded to their servers. IIRC they cite 140 million active devices so if you figure 3kB per day, which is probably on the high side, that's only 400GB before compression. You can compress text down by about 90% these days. That works out to only 44GB of data uploaded per day.

jgrahamc 15y ago

They say they are installed on > 148.3M phones. If we imagine that they are gathering 10GB per day then that's about 76 bytes per phone, if it's 90GB (the upper limit before the recruiter would have been shouting about terabytes) then it's 680 bytes. It's more likely to be in the middle (because otherwise the recruiter would have rounded up) so you are talking 100s of bytes per phone per day. I don't think it's realistic that they are sending all my URLs, all my keystrokes etc. in a few hundred bytes.

mootothemax 15y ago
I don't think it's realistic that they are sending all my URLs, all my keystrokes etc. in a few hundred bytes. I tend to agree with you, but at the same time wonder how they're aggregating the data; they could store each day's raw data in however many GB, then crunch it down later. The only other potential issue that jumps out at me is bandwidth; I'd find it strange if the data isn't being compressed, but if it is, you could cram quite a lot of useful information into those few hundred bytes ;)
DevX101 15y ago
Whether they are sending a full log report of my actions TODAY is beside the main point. I do however know two things. 1) That their local software processes almost every key stroke made. 2) And that they do send at least some portion of this data back to their servers. At this point it would be trivial for them to send my private information TOMORROW if they decided to do so. I don't know that they don't have a subroutine to begin sending all of my SMS back to their servers if they decide to so for profit or under government coercion. If they have no plans of using my Google searches, they shouldn't process it in the first place.
- hackoder 15y ago
  This is exactly right. It is the presence of a keylogger, which (at the very least) is echoing keystrokes, that is the problem. Whether they 'send' everything or only parts of it, or whether the data is anonymized, aggregated etc is a whole other discussion.
- 15y ago

tptacek 15y ago

What percentage of all the SMS messages send by Sprint Android phones in a day do you think 10 gigabytes is? Start here: the US generates about 2 trillion SMS messages in a year across all phones. There are multiple YC startups that could write the (bad) marketing sentence "we receive raw data (known as metrics) from X and convert them into reliable, repeatable Measures which feed into analytic applications". Personally, I'm inclined to think that when someone writes "we receive raw metrics", they mean "they receive raw metrics". You seem to premise your entire comment on the idea that "raw metrics" means "tremendous opportunities for abuse, damage to national security, corporate espionage". Those two points --- 10 gigabytes, and "raw metrics" --- seem literally to be the entire basis of your (currently top ranked) comment. I wish I could be more strident in disagreeing with you (because your tone makes me want to be), but I have to admit that I have no clue what this company is taking off Sprint phones. I'm inclined to believe that nobody could be dumb enough to take the contents of SMS messages from phones --- Sprint doesn't want that data --- but who knows? I wrote a similarly negative comment yesterday when this story hit HN the first time. Then I read downthread and found John Graham-Cumming thoughtfully picking apart the story. I read his comment, re-read mine, and deleted mine. 'jgc's comments on this story are interesting; ours are less so; his is buried under yours now. Perhaps you could follow my lead.

marcf 15y ago
At 160 bytes per text and 2T texts per year, there are 800 gigabytes of texts per day. Thus Carrier IQ is monitoring the equivalent of 1% of all texts across all phones. That is still quite significant.
- tptacek 15y ago
  The point isn't how many texts they're getting --- one would be too many. The point is "10 gigabytes per day of metrics" doesn't itself imply that they're getting message contents.
  - Natsu 15y ago
    I sincerely doubt that CarrierIQ, or the phone carriers, even care about our text messages. That said, there are other people who do http://www.schneier.com/blog/archives/2009/11/leaked_911_text.html http://www.schneier.com/blog/archives/2009/11/leaked_911_tex... Even so, I wouldn't put it past them to do keyword mining for mobile ads. That just seems like such an obvious potential use.