Bose Headphones Spy on Users, Lawsuit Says

Re:Bose Headphones Spy on Users, Lawsuit Says by tomtalks on Wednesday April 19, 2017 @05:07PM (#14151780)

1. From the data I collected, the content of each message of is roughly 1000-2000 bytes. This is not much on it's own but over the course of a day it could end up. It appears as messages are queued and send in bulk when applicable, therefore I can't comment on bandwidth over time as the app may chunk its request. It may not even send messages when the screen is closed.

2. Everything is secured with HTTPS! All the analytics messages, messages to boses servers and firmware checks are all over HTTPS (The firmware file its self is downloaded over HTTP, but the URL is provided over HTTPS and the firmware may well be signed)

3. A good question that needs further investigation :)

4. The anonymous id doesn't have any glaring information at least not immediately from the analytics platforms documentation https://segment.com/docs/spec/identify/ however yes the other meta-data defeat the purpose of an anonymous id.

5. It is definitely sending the data while the app is in focus, and i believe while the app is open but not in focus. I am not 100% sure here as it was a very quick test.

6. Again something else to investigate :)

[ Parent | on HN ]

Re:Bose Headphones Spy on Users, Lawsuit Says by f2prateek on Wednesday April 19, 2017 @07:16PM (#14152631)

Assuming this app uses the Segment SDK, the SDKs are open source and you can see the implementation details yourself, e.g. https://github.com/segmentio/analytics-android. There's a high level overview at https://segment.com/blog/lifecycle-of-a-mobile-message.

[ Parent | on HN ]