4 ms·
Myself and almost every other mobile phone user have the reasonable expectation that third parties should not have the ABILITY to read or modify my private and
by DevX101 15y ago
Myself and almost every other mobile phone user have the reasonable expectation that third parties should not have the ABILITY to read or modify my private and personal information unless I explicitly give you permission to do so.
This fundamental principle is embedded in all the software I use. I consider any software that doesn't adhere to this principle malware. When my PC crashes, Microsoft asks me if I want to share information with them about what led to the crash. I usually say no, but I appreciate them asking. When I use gmail, I do so with the understanding that Google has full access to the contents of my email. They promise me that they won't do any funny stuff and I accept the conditions of this contract in exchange for free email.
I never entered into such an agreement with CarrierIQ. I've never even heard of CarrierIQ until this week. Yet despite this, they are logging everything I type into my phone, and sending some portion of the information that they log.
If I offered you $100 to install a program I wrote that logged every keystroke on your computer and sent some portion of this information to my own server over TCP, without giving you a privacy policy, you know very well you'd never take me up on this offer. So why is it ok with CarrierIQ?
The focus on how much information is in 10GB is beside the point. The point is that CarrierIQ has been demonstrated to have the ability to read and send everything you type into your phone. At this point we're just hoping they're the good guys and won't do anything overtly evil. But what's to stop them from calling the following function on your phone?
if username == 'tptack':
sendStoredData()
- tptacek 15y agoAll this comment does is moralize. It adds no new information and provides no useful analysis. The only analysis you've provided to date appears flawed; for instance, it asserts that "10 gigabytes a day" of "raw metrics" implies "message contents". As 'potatolicious seems fond of saying, "that's not even wrong". Everyone agrees with you already. I always forget, is it light or heat that's the one you don't want? You're adding more of the bad one, and none of the good one. Apart from rebutting your analysis earlier, I'm under no illusion that my comment is helping clear up this ${INSERT_NERD_FREAKOUT_HERE} either, but I'm at least happy to speak up and raise the meta point that we shouldn't be rewarding comments like yours. Also, for obvious reasons, I'm past giving a shit about comment karma, so I can just say what I think.
- DevX101 15y agoA ${NERD_FREAKOUT} is what led to the enormous backlash against SOPA which very well may play an instrumental part in defeating the bill. Principles matter, meta discussions like these matter. The technology we work on don't operate in a social vacuum.
- tptacek 15y agoNo amount of principle excuses lazy, broken analysis.
- CamperBob 15y agoDo you have a dog in this particular fight?
- tptacek 15y agoYes. HN is becoming stupider by the day, and I like HN.
- someone13 15y agoWell, in the interest of keeping the signal/noise ratio high, here's my view on things. When someone uses a mobile phone, they generally have the assumption that, unless they consent to it, third parties do not have access to their data (the government being a different story I won't go into). When I use GMail, I consent to Google reading my email via automated algorithms, and targeting ads at me through that. If I have anything important, I use email that I host myself or, if it's really top-secret, an anonymous throwaway account through Tor. However, from what this video demonstrates, CarrierIQ is violating the basic principle of this by capturing and potentially logging your personal data without your knowledge or consent. Furthermore, it's violating the assumption that most people have that their passwords and such are not captured by applications other than the ones that they are entered into. Now, we don't know for sure whether all this information is sent off to their servers and logged or not. However, in my personal opinion, the fact that this information is CAPTURED AT ALL is a serious problem, when combined with the fact that you are not informed of this!