4 ms·
It should be noted that (having finally watched the video) what he is accusing Carrier IQ of is key logging, but he does not demonstrate key logging of the keyb
by podperson 15y ago
It should be noted that (having finally watched the video) what he is accusing Carrier IQ of is key logging, but he does not demonstrate key logging of the keyboard (he demonstrates key logging of two of the hardware keys and the numeric phone dialer, but never demonstrates the same behavior when using the virtual keyboard -- he does show that the unencrypted url is being sent (which means that the Carrier IQ software has hooks into the browser where it shouldn't) but does not demonstrate key logging of, say, a password typed into a web page on an encrypted connection.
If the article made this point it might have some credibility. As it is, it simply looks like Carrier IQ's PR department working overtime.
- drivebyacct2 15y agoIt's the same thing. The way virtual keypads work in Android and the same as the hardware keyboard. Also, it's already been noted that it is aware of HTTPS urls and reports those just as meerily (at least to the adb logcat, I can't make other claims). Further, the keyboard doesn't magically work differently when it's entering text into one page other the other... not sure what track you're thinking on there.
- podperson 15y agoYes, I agree that it's definitely tracking the url (and not the domain) but thet is not the same as key logging (which would capture things like passwords entered into a web page). I'll take your word for it that the text keypad is just as compromised as the numeric, but it would have been a lot more compelling to show a username / password (for example) being captured on a banking website before the user even pressed "submit" (or whatever).