5 ms·

No. Trevor Eckhart's video showed him capturing and recording the Android event log. This only demonstrates that the CarrierIQ agent running on the phone attach

No. Trevor Eckhart's video showed him capturing and recording the Android event log. This only demonstrates that the CarrierIQ agent running on the phone attached an event listener to keyboard events. While that behavior is consistent with a key logger, it's also consistent with lots of totally harmless software doing totally normal things.

drivebyacct2 15y ago
>it's also consistent with lots of totally harmless software doing totally normal things. lol. What "totally harmless software" or "normal things" require userland software to monitor every keystroke. And not just monitor them, but echo them so that they appear in the logcat?
- rictic 15y ago
  I don't think that they've earned the benefit of the doubt here, but I think it goes too far to say that there's no reason why benign diagnostic software might pay attention to key presses. For example, a particular button combination could bring up a diagnostics screen or send additional information. The logging, likewise could be just some debug code accidentally left in.
  - marshray 15y ago
    How about the https urls being intercepted? Those were for a diagnostic command sequence or debug code too?
- scott_s 15y ago
  To be clear, they are monitoring the physical keys on the phone, not key presses on the virtual keyboard. The physical keys are the buttons for things like "Home" and "Back." Why you would monitor the physical key presses seems obvious to me: in the case of a phone or application crash, you want to know which keys were pressed at the time. In order to know that, you need to log it. It's possible that they are monitoring the key presses of the virtual keyboard, but I have seen no evidence of that. From what I can see, they're recording the same kind of information that, say, Chrome or Firefox record for crash reports.
  - cbs 15y ago
    To be clear, many android phones have physical keyboards. >Why you would monitor the physical key presses seems obvious to me: in the case of a phone or application crash, you want to know which keys were pressed at the time. What good is that really going to do to diagnose a crash when 90+% of interaction with the UI is with soft controls?
    - scott_s 15y ago
      For the small percentage of crashes related to the physical key presses. Does the software log physical keyboard presses (that is, the letters, not navigation buttons)? It should be easy to test. (I'm not saying you should, but if people are this concerned, then that should be the kind of information we have.)

drivebyacct2 15y ago

>it's also consistent with lots of totally harmless software doing totally normal things. lol. What "totally harmless software" or "normal things" require userland software to monitor every keystroke. And not just monitor them, but echo them so that they appear in the logcat?

rictic 15y ago
I don't think that they've earned the benefit of the doubt here, but I think it goes too far to say that there's no reason why benign diagnostic software might pay attention to key presses. For example, a particular button combination could bring up a diagnostics screen or send additional information. The logging, likewise could be just some debug code accidentally left in.
- marshray 15y ago
  How about the https urls being intercepted? Those were for a diagnostic command sequence or debug code too?
scott_s 15y ago
To be clear, they are monitoring the physical keys on the phone, not key presses on the virtual keyboard. The physical keys are the buttons for things like "Home" and "Back." Why you would monitor the physical key presses seems obvious to me: in the case of a phone or application crash, you want to know which keys were pressed at the time. In order to know that, you need to log it. It's possible that they are monitoring the key presses of the virtual keyboard, but I have seen no evidence of that. From what I can see, they're recording the same kind of information that, say, Chrome or Firefox record for crash reports.
- cbs 15y ago
  To be clear, many android phones have physical keyboards. >Why you would monitor the physical key presses seems obvious to me: in the case of a phone or application crash, you want to know which keys were pressed at the time. What good is that really going to do to diagnose a crash when 90+% of interaction with the UI is with soft controls?
  - scott_s 15y ago
    For the small percentage of crashes related to the physical key presses. Does the software log physical keyboard presses (that is, the letters, not navigation buttons)? It should be easy to test. (I'm not saying you should, but if people are this concerned, then that should be the kind of information we have.)