Security - research

Your smart phone is watching you (2010).

Security experts, consumer advocates and privacy campaigners have sounded the alarm over the hundreds of thousands of free smartphone applications that spy on their users.

Lookout, a smartphone security firm based in San Francisco, scanned nearly 300,000 free applications for Apple's iPhone and phones built around Google's Android software. It found that many of them secretly pull sensitive data off users' phones and ship them off to third parties without notification.

That's a major concern that has been bubbling up in privacy and security circles.

The data can include full details about users' contacts, their pictures, text messages and internet and search histories. The third parties can include advertisers and companies that analyse data on users.

The information is used by companies to target ads and learn more about their users. The danger, though, is that the data can become vulnerable to hacking and used in identity theft if the third party isn't careful about securing the information.

Lookout found that nearly a quarter of the iPhone apps and almost half the Android apps contained software code that contained those capabilities.

The code had been written by the third parties and inserted into the applications by the developers, usually for a specific purpose, such as allowing the applications to run ads. But the code winds up forcing the application to collect more data on users than even the developers may realise, Lookout executives said.

"We found that, not only users, but developers as well, don't know what's happening in their apps, even in their own apps, which is fascinating," said John Hering, chief executive of Lookout.

Part of the problem is that smartphones don't alert users to all the different types of data the applications running on them are collecting. iPhones only alert users when applications want to use their locations.

And, while Android phones offer robust warnings when applications are first installed, many people breeze through the warnings for the gratification of using the apps quickly.

Australian online users' lobby group Electronic Frontiers Australia spokesman Colin Jacobs said the issue of applications spying on their users "was something that everybody needs to be aware of".

Jacobs said that many did not think of their phone as a computer.

"Mobiles contain as much personal information as people’s everyday computers do," he said.

"Ironically, Apple's model of a very locked down app store which has caused a lot of controversy may provide more protection to users because each application is so carefully reviewed, but it has its downsides as well."

Intelligent Business Research Services analyst Joe Sweeney said that many users had installed firewalls on their PCs, but weren't doing so on their mobiles.

In many cases this is because they can't. Apple, for example, doesn't offer a firewall product on its iPhone.

"If the numbers in this report are correct, then obviously this is an issue," Sweeney said.

"We may need to see firewall-type software on phones."

However, he said that education of users had to come first.

"There are other ways of addressing this issue that doesn't require a firewall."

Sweeney said network providers, such as Telstra and Optus, could help out. Apple could as well, he said.

Choice spokesman Christopher Zinn questioned whether some of the apps using the code broke Australian privacy laws.

"One would ask whether it is a possible breach of some of our privacy laws," Zinn said.

He said that, although Apple and some of the apps might stipulate in their contracts that they collect data and send it to third parties, "How many of us actually read the contracts and the small print that come with them?

"We know that people don't read them. You just press OK," he said.

"We know that, especially with Apple contracts - they're so long - nobody reads them; you probably need a law degree to understand them."

Zinn said that if something as significant as some of the data that was revealed in the report was being sent to a third party, it "shouldn’t be in small print".

It should be something that a user has to consent to and be in "big print", Zinn said.

Apple and Google did not respond to requests from the Associated Press for comment on Lookout's research.

- with AP

- Sydney Morning Herald Retrieved from http://www.stuff.co.nz/technology/digital-living/3972405/Your-smartphone-is-watching-you

Remover personal details from facebok: expert (2011).

The social networking site announced in a blog post at the weekend that it would give developers of applications access to the contact information of users who install their apps.

"These permissions must be explicitly granted to your application by the user via our standard permissions dialogs," Facebook's Jeff Bowen said.

"Please note that these permissions only provide access to a user's address and mobile phone number, not their friend's addresses or mobile phone numbers."

But Sophos security expert Graham Cluley, in a blog post on the firm's site, questioned the move.

"You have to ask yourself - is Facebook putting the safety of its 500+ million users as a top priority with this move?" he said.

"I realise that Facebook users will only have their personal information accessed if they 'allow' the app to do so, but there are just too many attacks happening on a daily basis which trick users into doing precisely this."

He said "shady app developers" would now "find it easier than ever before to gather even more personal information from users".

"You can imagine, for instance, that bad guys could set up a rogue app that collects mobile phone numbers and then uses that information for the purposes of SMS spamming or sells on the data to cold-calling companies," he said.

http://www.stuff.co.nz/technology/digital-living/4549786/Remove-personal-details-from-Facebook-expert

Face book bows to privacy pressure (2010).

I wanted mainly to point out a problem which seems to be too common online - not reading the fine print, but also to reinforce the statements made by Ben, which are basically that our online privacy is our responsibility, not Facebook's, or anyone else's.

When you sign up to Facebook you are confronted with a bit of reading. To most, it is the boring but significant which is never read fully (if at all) and the vast majority will just click "I Agree" before actually knowing what they are signing up for.

It's just something we do. Then, when we don't like the way something is happening, we cry foul and say we weren't informed of the changes, or didn't know what they were doing.

Facebook reserves the right to make changes to their policies, and encourages all users to pay close attention to the Facebook Governance Page in order to know what is happening.

However, not many do. At the time I wrote this, there were 1,497,744 people following the Governance page - less than 1 percent of Facebook's roughly 400 million users.

It's kind of like voting in an election. If you are apathetic, don't take an interest in the politics and don't vote, you may end up with something you don't like.

Did you ever hear the argument that if you don't vote you can't complain? Well...

I see the point that these agreements are long and the settings take some time to understand and set up to your liking. It took me roughly 25-30 minutes to read the paperwork and another 10 to set my privacy up how I want it.

So all up, I paid about 40 minutes in time for peace of mind and knowing my rights. It's really not a raw deal when you consider the time you are likely to spend using it and the benefits it can provide.

They say Facebook's privacy policy is longer than the US Constitution. If Facebook was a country, it would nowoutnumber the USA by almost 100 million people, and be the third largest country in the world.

So should it not require its own Constitution of sorts? Their privacy policy and other terms and conditions are just that.

These agreements are legal contracts between you and Facebook under the jurisdiction of Californian law. When you agree to it, they've got you, and it's up to you to know what you are getting in to. It really is that simple.

http://www.stuff.co.nz/technology/blogs/connector/3717219/Facebook-bows-to-privacy-pressure