5 ms·
Logging is not the same as sending over the network. What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes
by recoiledsnake 15y ago
Logging is not the same as sending over the network.
What if the program just collects the aggregate metrics, sends them and then deletes the actual keystrokes?
Not saying it doesn't send keystrokes, but the video is definitely not proof of that and it bears further investigation, not knee jerk reactions.
- Fliko 15y agoIt's still pretty dangerous even if it doesn't send keystrokes.
- recoiledsnake 15y agoNo one is disputing that. But it's wrong to claim that there is clear evidence that keystrokes are being sent just because they're being logged.
- AJ007 15y agoThere is a video camera in your bathroom secretly recording you. If the perpetrator never stops by to pick up the tape, is a crime committed?
- recoiledsnake 15y agoIf someone implies that there is proof that the perpetrator picked up the tape when there is no such evidence, are they right?
- sycren 15y agoHow did the perpetrator plant such a device in the first place? Did he have permission? If not, perhaps a different crime was committed.
- seanp2k2 15y agoTo use a situation analogous to the situation with CarrierIQ, he did not have permission and you never even knew he was there or that the camera was there. However, the camera is digital, it is connected to your power outlet with a battery-backed UPS, and it has an active wireless modem attached to it. Maybe he did send data, maybe he didn't. But he's also sent you a CnD notice and threatening to sue you if you tell anyone.
- sycren 15y agoI am a bit lost at all the down votes but he was recording data that breaches privacy acts. If he did send such data without permission it is a rootkit and can be unlawful (data protection act, uk). Because everyone has collectively found out about this at the same time a CnD would not work.
- tptacek 15y agoBy that logic we should all be very angry at our TTY drivers.
- burgerbrain 15y agoI'm not even sure what I should say to explain the difference here. It should be obvious...
- tptacek 15y agoYou're implying the difference is intent. I'm saying, their intent isn't known. Their own statement is that they don't want the raw characters, just the stats. Meanwhile, there are plenty of pieces of code strewn throughout your system that get access to similar bits of sensitive data. For instance, every BSD system has a BPF device and driver that exists solely to tap your network traffic. Luckily, nobody sells a BPF-for-Android product. I'm not saying that this is a clinching argument. I'm simply making a point that is germane to the discussion. Distilled, it is: "just because a piece of systems code deals with your private information does not make a violation of your privacy; sometimes it does, sometimes it doesn't".
- burgerbrain 15y agoThere is a hell of a lot more wrong with your analogy than a mere "difference in intent".
- tptacek 15y agoI'm interested in why you think that. I wrote the comment in good faith. I'm asking you to clarify also in good faith.
- burgerbrain 15y agoHaving reviewed your other comments in this discussion, I must say that I do not see the point in continuing this.
- billybob 15y agoWhat useful metric would keystrokes be part of? "Users tend to press the T key a lot..."
- mog_man 15y agothey can keep track of everything that you type, credit card info, wifi passwords, other passwords, sexting... so i guess nothing important, eh?
- tedunangst 15y agoI would love it if somebody noticed that I hit the "return, backspace, space" combo over and over and made the return key slightly smaller.