5 ms·

this blog post was so awful it made me cringe. "The application incorporates pieces of various analytics packages, including those from Fiksu, Facebook, and so

this blog post was so awful it made me cringe. "The application incorporates pieces of various analytics packages, including those from Fiksu, Facebook, and some proprietary logging. As a result, it is likely possible that all activity within the application can be collected, including user taps, application activity time, hours of use, and even potentially unsent content typed in by the user. I have not made any attempt to specifically identify what analytics are active in the app; I am speaking of the capabilities of most analytics packages in general." This app includes third party libraries. Therefore it could do anything. I didn't check. Shameful.

objclxt 12y ago
I guess you either didn't read the post fully, or you misunderstood it. For what it's worth, Jonathan Zdziarski literally wrote the book on iOS security and hacking (and a good book it is, too).
- felixgallo 12y ago
  no, I read the post fully, and understood it. And it doesn't matter what books Jonathan Zdziarski has written. The paragraph as it stands is shameful -- speculation and fearmongering without factual backup.
me_again 12y ago
The app contains third party libraries specifically designed for user analytics. Therefore, maybe it might be using them to gather information about how users use the app. Why else deploy them - for fun? In the context of an app which is "committed to being a safe place for our users to anonymously share their innermost thoughts" (http://whisper.sh/privacy http://whisper.sh/privacy) that is interesting, if not conclusive. I don't see anything disgraceful about publishing that information. A full security investigation of an app from a security firm costs $'000s - you can't expect a definitive rundown for free.
- felixgallo 12y ago
  specifically designed for analytics. Not necessarily user-level, human-level analytics. The chinstroking that follows was risible consultancy-baiting.

objclxt 12y ago

I guess you either didn't read the post fully, or you misunderstood it. For what it's worth, Jonathan Zdziarski literally wrote the book on iOS security and hacking (and a good book it is, too).

felixgallo 12y ago
no, I read the post fully, and understood it. And it doesn't matter what books Jonathan Zdziarski has written. The paragraph as it stands is shameful -- speculation and fearmongering without factual backup.

me_again 12y ago

The app contains third party libraries specifically designed for user analytics. Therefore, maybe it might be using them to gather information about how users use the app. Why else deploy them - for fun? In the context of an app which is "committed to being a safe place for our users to anonymously share their innermost thoughts" (http://whisper.sh/privacy http://whisper.sh/privacy) that is interesting, if not conclusive. I don't see anything disgraceful about publishing that information. A full security investigation of an app from a security firm costs $'000s - you can't expect a definitive rundown for free.

felixgallo 12y ago
specifically designed for analytics. Not necessarily user-level, human-level analytics. The chinstroking that follows was risible consultancy-baiting.