6 ms·

At 160 bytes per text and 2T texts per year, there are 800 gigabytes of texts per day. Thus Carrier IQ is monitoring the equivalent of 1% of all texts across a

by marcf 15y ago

At 160 bytes per text and 2T texts per year, there are 800 gigabytes of texts per day. Thus Carrier IQ is monitoring the equivalent of 1% of all texts across all phones. That is still quite significant.

tptacek 15y ago
The point isn't how many texts they're getting --- one would be too many. The point is "10 gigabytes per day of metrics" doesn't itself imply that they're getting message contents.
- Natsu 15y ago
  I sincerely doubt that CarrierIQ, or the phone carriers, even care about our text messages. That said, there are other people who do http://www.schneier.com/blog/archives/2009/11/leaked_911_text.html http://www.schneier.com/blog/archives/2009/11/leaked_911_tex... Even so, I wouldn't put it past them to do keyword mining for mobile ads. That just seems like such an obvious potential use.
  - tptacek 15y ago
    If Sprint wanted to do that, it doesn't need agent software to get the messages.
    - scott_s 15y ago
      This is an important point that I think some people are forgetting. I use Verizon. They already have access to all of my text messages. I send my text messages to Verizon, who then forwards them on to the person I'm talking to. Just as Google first gets my email.
      - tptacek 15y ago
        It is unfortunately a point that the contradicts the thread narrative that casts a hapless, poorly-marketed analytics company as Big Brother incarnate, so nobody's going to pay attention to it.
        Natsu 15y ago
        They put backdoors on basically every phone in secret, threatened the guy who outed them with a lawsuit and are perfectly capable of snooping on everything, whether they do so or not. What do you know about them that makes you trust them?
        tptacek 15y ago
        Nothing. There's just a likely innocent explanation for all three of those things: 1. CarrierIQ is a "secret" in the same sense as the network management software that Sprint uses that can also see all your SMS messages is a "secret": (a) nobody at Sprint thinks its relevant to you, and (b) nobody at Sprint thinks its any of your business. Which, if you take a breath, strictly speaking about the performance metrics they're collecting, it isn't your business. 2. CarrierIQ was dumb about threatening this guy like lots of other companies have been identically dumb. Companies have threatened to sue me. I remain cordial with the owners of some of those companies. Welcome to security research; we don't have jackets, but we sure get a lot of press. Incidentally, put yourself in CarrierIQ's position and assume that this particular researcher is full of shit, meaning, no, CarrierIQ is not snooping on people's keystrokes. What would you do? There's a guy out there claiming that their performance agent is a "rootkit". They got pissed. Surprised? 3. Any piece of systems software the carrier agrees to stick on the phone is capable of snooping. Sprint itself could just backdoor their Android distro.
        Natsu 15y ago
        In their shoes, I would have contacted the researcher and explained myself. While unsurprising, that move was unwise, and I would imagine that you agree on that point at least. I think someone once said that sufficiently advanced incompetence is indistinguishable from malice. Whether they're dumb or malicious, I'm just glad their crap isn't on my phone.
        tptacek 15y ago
        Even they seem to agree with it; rather than just shutting up about their C&D, they actually issued a formal apology to Trevor. That's an uncommon move. I don't know whether some other shoe is about to drop; for instance, someone could actually show that they're transmitting real keycodes and not just metrics data. But in the absence of that shoe dropping, especially given how many people have jumped to a conclusion about CarrierIQ, I'm inclined to believe that what they do is actually benign. If you want to get upset at someone, get upset at the carriers themselves. When you do, remember, they're already recording all your messages without CarrierIQ.
- Steko 15y ago
  "The point isn't how many texts they're getting ... " You, earlier: "What percentage of all the SMS messages ... do you think 10 gigabytes is?" Stop moving the goalposts and maybe we'll get somewhere.
  - tptacek 15y ago
    You are militantly missing my point. There is no evidence that they are seeing message contents. All we are going on in this thread is the supposition that because they're getting "10 gigabytes a day", it must be message contents.
    - rhizome 15y ago
      They themselves use the phrase "raw data" to describe what they collect (as "metrics"). Metrics are not comprised of raw data, but of measurements, so unless they're being hinky with word choice, a plain reading of their own materials would suggest that they do indeed receive user content.
      - tptacek 15y ago
        They've said repeatedly that they do not collect that data. This is a common attitude on HN threads: the idea that the only facts for us to discuss are the ones in the article itself or in other comments on the thread. There are more facts just a Google search away for you. Their own words are not dispositive; I'm not suggesting that they are. But here you're trying to interpret their words in a way that contradicts their own direct statement. Your interpretation is possibly accurate, but implausible.
        rhizome 15y ago
        Fair enough. Given what you've read, where do you think the line is between "user content" and the data they received?
        rhizome 15y ago
        An update: http://daringfireball.net/2011/12/rootkit_eh http://daringfireball.net/2011/12/rootkit_eh
samstave 15y ago
But they are monitoring on the client side, correct? Who is to say the carriers are not processing on the upstream? We certainly know that Carnivore was designed to do just this. Let's just say; there is NO privacy on ANY digital communications. Period. If you think otherwise, it is likely just being naive. We know that the US and China have been in an extended cyber war fro more that 10 years now.
- artursapek 15y ago
  To say that is to give up trying
artursapek 15y ago
You're thinking quantitative when you should be thinking qualitative. The worrisome thing is that, as the screenshots show, they seem have access to location-based information. http://www.carrieriq.com/overview/IQInsightServiceAnalyzer/image001.jpg http://www.carrieriq.com/overview/IQInsightServiceAnalyzer/i... I wouldn't care if they were logging non-identifying info, such as the amount of time my phone display is on to analyze battery performance, for instance, or perhaps even the general settings I have on my phone to help HTC deliver more desirable "factory settings." Any of this could add up to that 1% you mention. Speaking personally though I use a 5 or 6-year-old Blackberry model with no data plan and will happily continue to do so.
chc 15y ago
160 bytes per text seems like a very generous estimate. Casual observation would suggest the average is less than half that. I just got a text that seemed pretty long to me, so I went back and measured it. It was 90 bytes (104 characters * 7 bits per character / 8 bits per byte).

by marcf 15y ago

tptacek 15y ago

The point isn't how many texts they're getting --- one would be too many. The point is "10 gigabytes per day of metrics" doesn't itself imply that they're getting message contents.

Natsu 15y ago
I sincerely doubt that CarrierIQ, or the phone carriers, even care about our text messages. That said, there are other people who do http://www.schneier.com/blog/archives/2009/11/leaked_911_text.html http://www.schneier.com/blog/archives/2009/11/leaked_911_tex... Even so, I wouldn't put it past them to do keyword mining for mobile ads. That just seems like such an obvious potential use.
- tptacek 15y ago
  If Sprint wanted to do that, it doesn't need agent software to get the messages.
  - scott_s 15y ago
    This is an important point that I think some people are forgetting. I use Verizon. They already have access to all of my text messages. I send my text messages to Verizon, who then forwards them on to the person I'm talking to. Just as Google first gets my email.
    - tptacek 15y ago
      It is unfortunately a point that the contradicts the thread narrative that casts a hapless, poorly-marketed analytics company as Big Brother incarnate, so nobody's going to pay attention to it.
      - Natsu 15y ago
        They put backdoors on basically every phone in secret, threatened the guy who outed them with a lawsuit and are perfectly capable of snooping on everything, whether they do so or not. What do you know about them that makes you trust them?
        tptacek 15y ago
        Nothing. There's just a likely innocent explanation for all three of those things: 1. CarrierIQ is a "secret" in the same sense as the network management software that Sprint uses that can also see all your SMS messages is a "secret": (a) nobody at Sprint thinks its relevant to you, and (b) nobody at Sprint thinks its any of your business. Which, if you take a breath, strictly speaking about the performance metrics they're collecting, it isn't your business. 2. CarrierIQ was dumb about threatening this guy like lots of other companies have been identically dumb. Companies have threatened to sue me. I remain cordial with the owners of some of those companies. Welcome to security research; we don't have jackets, but we sure get a lot of press. Incidentally, put yourself in CarrierIQ's position and assume that this particular researcher is full of shit, meaning, no, CarrierIQ is not snooping on people's keystrokes. What would you do? There's a guy out there claiming that their performance agent is a "rootkit". They got pissed. Surprised? 3. Any piece of systems software the carrier agrees to stick on the phone is capable of snooping. Sprint itself could just backdoor their Android distro.
        Natsu 15y ago
        In their shoes, I would have contacted the researcher and explained myself. While unsurprising, that move was unwise, and I would imagine that you agree on that point at least. I think someone once said that sufficiently advanced incompetence is indistinguishable from malice. Whether they're dumb or malicious, I'm just glad their crap isn't on my phone.
        tptacek 15y ago
        Even they seem to agree with it; rather than just shutting up about their C&D, they actually issued a formal apology to Trevor. That's an uncommon move. I don't know whether some other shoe is about to drop; for instance, someone could actually show that they're transmitting real keycodes and not just metrics data. But in the absence of that shoe dropping, especially given how many people have jumped to a conclusion about CarrierIQ, I'm inclined to believe that what they do is actually benign. If you want to get upset at someone, get upset at the carriers themselves. When you do, remember, they're already recording all your messages without CarrierIQ.
Steko 15y ago
"The point isn't how many texts they're getting ... " You, earlier: "What percentage of all the SMS messages ... do you think 10 gigabytes is?" Stop moving the goalposts and maybe we'll get somewhere.
- tptacek 15y ago
  You are militantly missing my point. There is no evidence that they are seeing message contents. All we are going on in this thread is the supposition that because they're getting "10 gigabytes a day", it must be message contents.
  - rhizome 15y ago
    They themselves use the phrase "raw data" to describe what they collect (as "metrics"). Metrics are not comprised of raw data, but of measurements, so unless they're being hinky with word choice, a plain reading of their own materials would suggest that they do indeed receive user content.
    - tptacek 15y ago
      They've said repeatedly that they do not collect that data. This is a common attitude on HN threads: the idea that the only facts for us to discuss are the ones in the article itself or in other comments on the thread. There are more facts just a Google search away for you. Their own words are not dispositive; I'm not suggesting that they are. But here you're trying to interpret their words in a way that contradicts their own direct statement. Your interpretation is possibly accurate, but implausible.
      - rhizome 15y ago
        Fair enough. Given what you've read, where do you think the line is between "user content" and the data they received?
      - rhizome 15y ago
        An update: http://daringfireball.net/2011/12/rootkit_eh http://daringfireball.net/2011/12/rootkit_eh

samstave 15y ago

But they are monitoring on the client side, correct? Who is to say the carriers are not processing on the upstream? We certainly know that Carnivore was designed to do just this. Let's just say; there is NO privacy on ANY digital communications. Period. If you think otherwise, it is likely just being naive. We know that the US and China have been in an extended cyber war fro more that 10 years now.

artursapek 15y ago
To say that is to give up trying

artursapek 15y ago

You're thinking quantitative when you should be thinking qualitative. The worrisome thing is that, as the screenshots show, they seem have access to location-based information. http://www.carrieriq.com/overview/IQInsightServiceAnalyzer/image001.jpg http://www.carrieriq.com/overview/IQInsightServiceAnalyzer/i... I wouldn't care if they were logging non-identifying info, such as the amount of time my phone display is on to analyze battery performance, for instance, or perhaps even the general settings I have on my phone to help HTC deliver more desirable "factory settings." Any of this could add up to that 1% you mention. Speaking personally though I use a 5 or 6-year-old Blackberry model with no data plan and will happily continue to do so.

chc 15y ago

160 bytes per text seems like a very generous estimate. Casual observation would suggest the average is less than half that. I just got a text that seemed pretty long to me, so I went back and measured it. It was 90 bytes (104 characters * 7 bits per character / 8 bits per byte).