6 ms·
Spyware app turns the privacy tables on Google Glass wearers
- euank 13y agoIt would be nice if glass came with a physical cover attached that can be slid over the camera lens. Thus, you could have the lens normally covered and still use the glass without others being uncomfortable. As long as the cover became a widely recognized symbol, it could allow for social cues to develop separately around wearing "blind" glass vs regular glass. The physical cover would of course also prevent this type of malware.
- phoen 13y agoHow would anyone other than the Glass user know that the cover is actually obstructing? I mean, a person could fashion a "cover" that functions as a one-way mirror does, no?
- r00fus 13y agoIt would a) have to be a first-party cover (preferably by Google) b) have some symbols that indicate 'not recording', c) easy to demonstrate to nearby folks what it's function is (i.e., by removing it and putting it back on). If Google pushed this and marketed it, it'd really take the edge off the privacy concerns about Glass (I'd still not buy one but I wouldn't necessarily force a wearer to put them away before entering my house). Relying on your userbase to "not be glass holes" is a recipe for backlash, even against those who "use responsibly".
- PhasmaFelis 13y agoAt some point you just have to go out on a limb and hope that everyone you know or meet isn't actively trying to invade your privacy.
- cinquemb 13y agoBut with the tech available today mixed with the behaviors of people online/offline, we can and have been passively invading others (perceived) privacy, even our own.
- Houshalter 13y agoYou must be new to the internet.
- PhasmaFelis 13y agoInternet != Real Life. If you operate in Real Life under the assumption that everyone you pass on the street or give money to at the coffee shop is desperate to invade your privacy, you're gonna have a hard time.
- fphhotchips 13y agoYes, but that's still about as much effort as it would take me to hide a spy-cam on my person.
- mlady 13y agoThe comprehensive solution to this issue (as we, the researchers mentioned in the article, see it) should be a combination of API safeguards and to have a hardwired "recording" light on Glass. The API checks would prevent what we were able to do in Malnotes, and the "recording" light would work much like webcams currently do. A more technical discussion of what we were able to exploit is on Ars Technica in the comments (skip past the trolls). http://arstechnica.com/security/2014/03/google-glass-spyware-app-is-cute-but-not-the-end-of-the-world/ http://arstechnica.com/security/2014/03/google-glass-spyware...
- eridius 13y agoI agree that a "recording" light would be a great idea, but that will really only protect against malware, not against people who are intentionally trying to surreptitiously take pictures. The reason being that anyone with direct hardware access to the device can find a way to disable the light.
- ridgeguy 13y agoI think a recording light could be defeated by a tiny dot of suitably-colored opaque pigment dabbed onto the recording light. I prefer the earlier poster's thought of a sliding, readily visible lens cover.
- chinpokomon 13y agoThe lens cover would defeat the whole purpose of having an at an instant camera. You may as well pull your cell phone out of your pocket if you have to fumble with removing a lens cover while you're wearing Glass. I understand why people are concerned, but I still believe through my own experience, that the issue is gratefully overblown.
- jack-r-abbit 13y ago> the app takes a photo every 10 seconds when the display is off > The app can also access the internet from the user's Glass connection to upload the images to a server. Isn't that basically what lifeloggers want?
- userbinator 13y agoDon't forget the voyeurs... With the changing attitudes toward privacy, I wouldn't be surprised if in a few decades you would be considered stupid/crazy/insane to not have a Glass-like device recording your life. with which you could easily find out e.g. what you did, where you put something, etc. Reviewing what you did during the past few days could definitely be a beneficial thing. (And personally, I don't have a problem with being recorded in public. I value privacy, but that's privacy in private places, not out in public.)
- orthecreedence 13y agoI think my preferred solution is to not hang out with anyone who uses google glass, ever. Come to think of it, this was my attitude before any spyware came out for it.
- bashinator 13y agoYou can also disable the camera light on the glass with about $0.10 worth of black paint.
- stronglikedan 13y agoThat is some very expensive paint.
- sukuriant 13y agoYou're really paying for the packaging
- thealbatross 13y agoThere's no light on Glass, just the display
- PhasmaFelis 13y agoThis whole paranoia about Glass reminds me of those people who act like smartphones are only for calling/texting. "Why are you bringing your phone? Who are you going to need to call today?" Nobody, but I might want to get directions, or research something on Wikipedia, or check my to-do list, or listen to music, or... The camera is the least interesting thing about Glass. Stop acting like it's a single-purpose surveillance machine.
- fernandotakai 13y agoWhen phones started having cameras, it was basically the same thing "oh my god now people are going to take pictures of everyone everywhere! good bye privacy!"
- quasque 13y agoThe difference is that a phone has to be taken out of one's pocket or bag and quite visibly pointed at something, whereas Glass is always looking wherever the wearer is.
- userbinator 13y agoThinking of http://xkcd.com/1235/ http://xkcd.com/1235/ , this will be an interesting future for sure...
- chinpokomon 13y agoIt is and it isn't. Glass is always available, but unlike using a cellphone it isn't necessarily as discrete. If I'm taking a picture of a subject with Glass, there is a body language with how you position your head that you are taking a picture or recording. Plus, you are wearing this apparatus on your head that already draws some attention. You really can't be discrete. Furthermore, because you can't easily frame your shot as you can with a cell phone or conventional camera, the field of vision is significantly wider. It really makes for a crummy spy cam. I really do understand why people are concerned, but I believe that if there were more Explorers, it would diffuse the perceived problem. I just finished shooting pool in an APA match and I recorded each of my shots. This has been a fantastic way for me to use the camera in Glass. I also demonstrated lots of other features to those that asked, and the camera faded to the background as a nice to have capability, but it isn't what defines Glass for most of the people I talk with. I think my experience with taking photos with Glass closely follows how frequently I use the camera on my phone. I take photos, but the camera capability isn't why I choose a particular phone. I now take significantly more photos with Glass, but they are usually at the pool hall during my match. If you ignore that outlier, my photo taking frequency is probably about the same, but I enjoy the experience more because Glass is out of the way and secondary to what is going on around me. I honestly believe that how you use Glass is a reflection on who you are already. If you want to secretly take pictures using your sunglasses, there are plenty of sources online to buy a pair that are cheaper and less obvious. If you are getting Glass only for the camera, the novelty will wear off quickly.
- xanderstrike 13y ago> Malnotes Clever.
- thealbatross 13y agoWe have so much regret about that name...
- a3n 13y agoI was instantly delighted with the name, it strikes me as open and responsible, which is exactly how security researchers should appear.
- segmondy 13y ago"Google's initial response to hearing of Lady and Paterson's app was to threaten the researchers for violating the Glass developer terms." To think I use to root heavily for Google. :(
- thealbatross 13y agoThey contacted us later and were very conciliatory about the person who was a bit heavy-handed in his communications. They really haven't been aggressive beyond that one guy who probably didn't have the authority to speak for Google. I was worried at first too, but they are handling the situation a lo t better.
- lern_too_spel 13y agoAt the time of the first contact, did they understand you were researchers? I would certainly hope they went after malware authors in general with guns blazing to protect users in their ecosystem, but threatening legal action against legitimate researchers has a chilling effect.
- thealbatross 13y agoI'm not entirely sure (because it was our professor who had the initial contact over Twitter) if it was clear that it was for research even though our prof. said "two of my students" in his original tweet. Once he cleared that up, someone hirer up got back to us with an apology for whoever wrote to my prof. initially. Still pretty crappy, but I think the person from the initial contact wasn't representative of Google's attitude about it.
- thealbatross 13y agoThanks for the shout-out, OP. Great to see our work starting a conversation!
- atmosx 13y agoTo give a more specific view on how bad this could evolve, please take a look at Episode 3 of Season 1 of the amazing mini-series "Black Mirror"[1]. That said. I expect computer security and privacy to be taken extremely seriously in the years as we proceed in the internet of things where our lives will be televised. Really, escaping will be virtually impossible, so we need to make sure that some breaches are severely punishable. Technology is tool, the more powerful the tool the more good or damage can do. [1] http://en.wikipedia.org/wiki/List_of_Black_Mirror_episodes#Series_1 http://en.wikipedia.org/wiki/List_of_Black_Mirror_episodes#S...