Secret app on millions of phones logs key taps

Re:Secret app on millions of phones logs key taps by DanBC on Wednesday November 30, 2011 @04:26PM (#3296973)

> So if all we're doing here is condemning CarrierIQ

I asked someone who is quite good with crypto a question about a possible MITM attack on 141 million phones. I didn't condemn CarrierIQ, I avoided dramatic language, I even added qualifiers to avoid stating something as fact if it wasn't yet confirmed.

[ Parent | on HN ]

Re:Secret app on millions of phones logs key taps by tptacek on Wednesday November 30, 2011 @04:53PM (#3297064)

Sorry. You're right. I let the ultra dumbness of this whole thread bring me down a bit.

Doing an SSL MITM from agent software installed by the carrier on a phone seems pretty silly, since the carrier is in a position to see anything you're typing into your phone anyways (in the sense that it controls the OS).

I'm not sure I buy any analysis that suggests CarrierIQ is really "MITM'ing" SSL --- though that's trivial for a software agent to do --- because the same people saying that are also saying that it's obvious that CarrierIQ is capturing and remote-logging message contents.

[ Parent | on HN ]

Re:Secret app on millions of phones logs key taps by seigenblues on Thursday December 01, 2011 @10:11AM (#3299968)

real question here: Should it be obvious that the carrier controls the OS? Second question: is that acceptable? I mean, that assumption underpins your dismissal of an MITM as "pretty silly", which also seems totally correct.

I'm just curious if that's the way phones will be forever: with the OS controlled by the carrier and with no right to tinker/hack/modify the device you buy & pay huge monthly fees to use.

[ Parent | on HN ]

Re:Secret app on millions of phones logs key taps by tptacek on Thursday December 01, 2011 @01:32PM (#3300839)

I very much wish it wasn't the case that carriers had influence over phone OS's.

[ Parent | on HN ]