Hacker News Reader

Comment by ghshephard | Hacker News Reader

"There's zero evidence that Carrier IQ captured, recorded, or transmitted any keystrokes"

...except the 17 minute Youtube Video that showed Carrier IQ capturing, and recording keystrokes.

No. Trevor Eckhart's video showed him capturing and recording the Android event log. This only demonstrates that the CarrierIQ agent running on the phone attached an event listener to keyboard events. While that behavior is consistent with a key logger, it's also consistent with lots of totally harmless software doing totally normal things.

>it's also consistent with lots of totally harmless software doing totally normal things.

lol. What "totally harmless software" or "normal things" require userland software to monitor every keystroke. And not just monitor them, but echo them so that they appear in the logcat?

I don't think that they've earned the benefit of the doubt here, but I think it goes too far to say that there's no reason why benign diagnostic software might pay attention to key presses. For example, a particular button combination could bring up a diagnostics screen or send additional information.

The logging, likewise could be just some debug code accidentally left in.

How about the https urls being intercepted?

Those were for a diagnostic command sequence or debug code too?

To be clear, they are monitoring the physical keys on the phone, not key presses on the virtual keyboard. The physical keys are the buttons for things like "Home" and "Back." Why you would monitor the physical key presses seems obvious to me: in the case of a phone or application crash, you want to know which keys were pressed at the time. In order to know that, you need to log it.

It's possible that they are monitoring the key presses of the virtual keyboard, but I have seen no evidence of that. From what I can see, they're recording the same kind of information that, say, Chrome or Firefox record for crash reports.

To be clear, many android phones have physical keyboards.

>Why you would monitor the physical key presses seems obvious to me: in the case of a phone or application crash, you want to know which keys were pressed at the time.

What good is that really going to do to diagnose a crash when 90+% of interaction with the UI is with soft controls?

For the small percentage of crashes related to the physical key presses.

Does the software log physical keyboard presses (that is, the letters, not navigation buttons)? It should be easy to test. (I'm not saying you should, but if people are this concerned, then that should be the kind of information we have.)

If you actually test it yourself you see that they only capture phone keypad presses, and the bottom hardware keys. They don't capture the actual screen keyboard at all, that's why Trevor's video does not show the actual keyboard being captured -- just like we found: http://blog.lastpass.com/2011/12/carrier-iq-verifying-your-l...

I'm not defending them, many of their practices are loathsome, but crucify them for what they've actually done.

And what about the hard keys on my slide-out keyboard?

Reply on news.ycombinator.com