Database Info

WP7 guilty of accumulating tracking data on users a la iOS?

Can't say I'm surprised, but you'd think MSFT would push out a quickfix to solve this issue after Apple's problems if it's true. Read for yourself...
http://www.mobilemag.com/2011/09/02...-location-data-from-wp7-without-user-consent/

Is not that I'd not believe something like this but is it a fact?
I mean all I've seen is brief and factless (I'm inventing here ) articles.
I remember iphone case to be proven, a fact.
Is this the case?

This isn't, or shouldn't be, news. Everytime you use location services on the phone data is collected and sent to Microsoft, and the phone/OS warns you numerous times about this. For e.g. every time you install an app that uses location services, it asks if you want to give that app permission to use location, and warns that every time location is used that data is sent back.
I don't like that it does this, and I especially don't like that you can't enable location services without also sending data back, but they have at least been upfront and honest about it.

stevenmu said:
This isn't, or shouldn't be, news. Everytime you use location services on the phone data is collected and sent to Microsoft, and the phone/OS warns you numerous times about this. For e.g. every time you install an app that uses location services, it asks if you want to give that app permission to use location, and warns that every time location is used that data is sent back.
I don't like that it does this, and I especially don't like that you can't enable location services without also sending data back, but they have at least been upfront and honest about it.
Click to expand...
Click to collapse
I agree, also, every major developer does this;
Facebook
Google
Microsoft
Apple
etc.
This is how they improve the user experience & add new features. I don't like it either, but if you want new better features, this is one main way they get the information on what is needed to be added.

I've been scratching my head about how this is such earth-shattering news as well. Sure, if there's a bug in the camera app (and it would be a bug, not some nefarious plan), and it sends location data when you have the option disabled in settings, then it should be fixed. But other than that, this seems like a huge non-issue, and I doubt that any class action lawsuit - if one really has been filed - would stand much of a chance.
I mean, let's be honest. How would people expect new features such as Local Scout to work without sending location info? It would be kind of difficult for the Bing server to provide a rich localized experience without it, wouldn't it?

You know what, there's a rather big mistake in this whole suit from the start. The setting is to turn of location setting when you upload a picture, not turn off feedback to MS. This is under Settings > Feedback.

Right, but there are two location-related settings specific to the camera. One controls including location data when uploading a picture (the "Keep location info on uploaded pictures" setting), and one controls whether to record it at all (the "Include location (GPS) info in pictures you take" setting). I can see how people would interpret that setting to mean "don't record or send any location info at all for pictures" if it is disabled.

RoboDad said:
Right, but there are two location-related settings specific to the camera. One controls including location data when uploading a picture (the "Keep location info on uploaded pictures" setting), and one controls whether to record it at all (the "Include location (GPS) info in pictures you take" setting). I can see how people would interpret that setting to mean "don't record or send any location info at all for pictures" if it is disabled.
Click to expand...
Click to collapse
True, but in the end that'd be end user error. Not MS specifically ignoring the denial of consent. It's basically mean MS, just needs to "fix" the issue. The again, if MS really wanted they could just force everyone to agree by adding it to the license agreement you must agree to to use the software for that matter.

Oh, I completely agree. I'm just saying I can see how some people might interpret the wording of the setting, and it would probably be a good PR move if Microsoft acknowledged it in some way.
With that said, the lawsuit is completely frivolous, and really rather silly in today's smartphone world.

RoboDad said:
Oh, I completely agree. I'm just saying I can see how some people might interpret the wording of the setting, and it would probably be a good PR move if Microsoft acknowledged it in some way.
With that said, the lawsuit is completely frivolous, and really rather silly in today's smartphone world.
Click to expand...
Click to collapse
Saw an article on this earlier (trying to relocate the link ), but independent testing confirmed that when the setting is turned off, the camera at least does *not* record GPS info to the images. That doesn't necessarily mean it doesn't capture or transmit that data, but it's at least some indicator that the claims are probably frivolous.

jasongw said:
Saw an article on this earlier (trying to relocate the link ), but independent testing confirmed that when the setting is turned off, the camera at least does *not* record GPS info to the images. That doesn't necessarily mean it doesn't capture or transmit that data, but it's at least some indicator that the claims are probably frivolous.
Click to expand...
Click to collapse
Here it is;
Microsoft denies they are watching us

Thanks for the link. As I mentioned in a comment to that article, there are valid reasons a person might be afraid to have the photos they upload to Facebook geotagged, so it is great that the feature works correctly.
But the rest of the lawsuit should be summarily dismissed (IMO), since there is no basis in fact for any of their claims. Anonymous location information does not represent any privacy violation, and may be necessary for other features that a user has enabled on their phone to work correctly (such as "where you are" live tile weather updates).
And am I the only one who is more than a little peeved that "Mrs. Cousineau" has the stupid audacity to file a lawsuit "on behalf of all Windows Phone 7 users", without my knowledge or consent? Throw the bum out of court!

RoboDad said:
Thanks for the link. As I mentioned in a comment to that article, there are valid reasons a person might be afraid to have the photos they upload to Facebook geotagged, so it is great that the feature works correctly.
But the rest of the lawsuit should be summarily dismissed (IMO), since there is no basis in fact for any of their claims. Anonymous location information does not represent any privacy violation, and may be necessary for other features that a user has enabled on their phone to work correctly (such as "where you are" live tile weather updates).
And am I the only one who is more than a little peeved that "Mrs. Cousineau" has the stupid audacity to file a lawsuit "on behalf of all Windows Phone 7 users", without my knowledge or consent? Throw the bum out of court!
Click to expand...
Click to collapse
Agreed, after hearing Microsoft's rebuttal, with evidence, the case has no merit.

You know everytime you use Local Scout of Microsoft, Check-in Button in Facebook apps, Check In Button of Foursquare , you give away your position. (the apps have already asked you if you allow them to use your position)
The Maps apps of Windows Phone itself also ask if you want to use your location to have better search experience.

Clz Comics / Barry - Buddy for Android

About two weeks ago I went to the Collectorz.com forums and threw down an entire layout for how to change "Requires the PC application to work" into a full mobile solution that could link to a PC application. This concept was shot down, but has since become something they claim to be "releasing in the next few weeks" despite having been at that status for nearly 10 months. While we wait, I have released this plugin to provide the required scanning and editing features.
New updates will come shortly. Hopefully this project proves useful to others who find that purchasing comics means not being at their computer to update their collection and paying $7 for a barcode scanner should be worth the price.
Sent from my ADR6400L using Tapatalk

http://www.multiupload.com/686BLB0LTJ
Improved on the wish list by allowing you to check scanned items against your database and your wish list. If the item could not be scanned, a seconday function allows you to attempt comparing series and issue information and as an alternative, directly accessing the complete wish list. All the menus now allow multiple selections. I am improving the information displayed from the wish list to make sure all values are properly displayed because currently missing database values can cause you to end up with selections such as " Batman #" or just "#"

Did my first real testing out and about and came to the conclusion that support for "Barcode Scanner" would be added. There is no reason to get the barcode from Barry for a quick compare if this is no longer being developed for actual integration. Feature is almost done. Will be posted shortly.
Sent from my ADR6400L using Tapatalk

Barcode scanner is taking a bit longer than estimated. Dumped the export feature from Barry and added text search capability for those with a larger database to not have to scroll through it on the go to check items. Turns out the barcode scanner supports the ean+5, but does not return it by default. It is a little tedious reading through the code for Barry to see how they did it and currently a method without including a secondary modification of the barcode source in the same manner is inefficient. The series can be scanned from the barcode, but further updates will get the issue number also.
Sent from my ADR6400L using Tapatalk

Malicious News Apps?

I've noticed sometime last year that local news apps developed by LSN Inc. requires hardware control of the phone camera. I suspect those apps actually snap pictures every time the app is opened.
Can the experts here help me validate this suspicion? Is there a way you can inspect for malicious codes in those apps?

Why suspicious?
sp_1st_timer said:
I've noticed sometime last year that local news apps developed by LSN Inc. requires hardware control of the phone camera. I suspect those apps actually snap pictures every time the app is opened.
Can the experts here help me validate this suspicion? Is there a way you can inspect for malicious codes in those apps?
Click to expand...
Click to collapse
Permission to use the camera is explicity requested. It probably supports a feature for the user to send pictures/videos back to the news station.
LSN Mobile has a legitimate looking website, including names of the officers
http://www.lsnmobile.com/about_us/our_team.html
... as well names/numbers/email for key contact personnel and physical address of the business:
http://www.lsnmobile.com/contact_us.html
Can I ask what makes you suspicious about these Apps?

Not sure if I should post a paranoid parrot meme, or a conspiracy keanu meme.

First, I can't find in the apps where a user can actually use the camera feature. And when opening the apps, it gives a completely black screen for several seconds before getting to the main interface. It makes me think it snaps an image during the black screen delay.
Why require permission to access the camera when there is no user accessible feature that requires it?

To GermainZ - I have seen you on the Tasker forum and always considered you a knowledgeable and helpful guy. Give this guy a break - he's just asking a question.
sp_1st_timer said:
First, I can't find in the apps where a user can actually use the camera feature. And when opening the apps, it gives a completely black screen for several seconds before getting to the main interface. It makes me think it snaps an image during the black screen delay.
Why require permission to access the camera when there is no user accessible feature that requires it?
Click to expand...
Click to collapse
The software from LSN gets a clean bill of health from mobilesecurity.com
http://appview.mobilesecurity.com/search?q=LSN
I downloaded the Local TV station LSN program to check it out, and I agree with you there is no accessible feature within the software to use the camera within the program that I looked at. Perhaps a capability for users to send pictures/videos is left over from a previous version or reserved for a future version. Perhaps it is a feature built into the general program that needs to be activated by the specific local TV station. At any rate, given the very wide use of this software by a seemingly-legitimate company, I personally wouldn't have a high level of concern about it. Also,perhaps it will help you to know that it can only take pictures when the program is running, not all the time.
There is a feature in the program where you can contact the developer... you might want to try that out to see if they have an explanation that satisfies you (and post any results back here if you do). There is certainly nothing wrong with a cautious and questioning attitude when it comes to permissions.

These posts make my day.
Sent from my cm_tenderloin using xda app-developers app

Electric Pete,
Thanks for not ridiculing my question. Yes, I presume it could only take pictures when the app is on. The are people who likes reading the news or checking the weather forecast while in the bathroom or as they come out of the bathroom. It's up to your imagination.
I'm not sure they would care to answer my question, because when I pointed this out in my user review of the app, my review is made invisible to the public. I actually waited for several days to see if my review would eventually become visible, but never. My reviews on other apps are visible.
If they are not guilty, they should not suppress my "wrong suspicion".

If the review you mentioned is on Google Play, I don't think the developer has any capability to supress that. Google runs the show there.
I do see your point about privacy. Reading the permissions and questioning the ones that don't make sense is good practice in my opinion.

electricpete1 said:
If the review you mentioned is on Google Play, I don't think the developer has any capability to supress that. Google runs the show there...
Click to expand...
Click to collapse
That is interesting. Why would Google suppress my review which can be considered laughable (as indicated by some reactions in this thread).
Anyways, thank you for giving time replying to this thread. If only I got the knowledge to inspect program codes of these apps...
By the way, the local news here where I live switched to different app provider. They listened to my concern.

Bottom line is, you could decompile the apk, edit the manifest and remove the camera permission (you could also check the output; or try a tool that decompiles an apk to java code, which will be much clearer, but it's still in beta if I'm not mistaken).
Monitoring the logcat/using the "ps" shell command might also reveal something useful, but I'm not if taking pics within an app starts a separate camera process ps would show.
Also, the logcat probably won't show anything useful, tho (the same thing applies; and if the app is malicious, it won't output anything malicious-related to the logcat).
Still think it's paranoid, tho. Why not contact the devs?

[Q] A way to digitize notes

I'm looking for a way to digitize notes. Normally (at least at my last job) I would either take my laptop or my TF700 into a meeting and just dictate the notes straight to the device. However at my new job I have had a few stipulations put upon me. They are:
1.) Actions must be documented and filed.
2.) Electronic devices such as laptops, tablets, smart phones, and recording devices (IE Camcorders, cameras) are prohibited.
I am allowed to bring a pad of paper and/or an audio recorder as long as it does not have an LCD or anything with a lens in it (Tape recorder / etc).
My current process is to take a legal pad in with a pencil, short hand everything and duplicate drawings /schematics, then go home and transcribe everything to my computer and sync it with my phone/tablet. To say the process is tedious is an understatement.
Is there a way to do this so that the process is faster and easier?
Any suggestions at all would be helpful.
Thank you.

Search for software that lets you scan a piece of paper and have it turned into digital text.
It shouldn't be that hard to find, I know something like that came with a cheap scanner we bought in the 90s - and the technology can only have improved.
Or if you don't care about file size and if it's in text or picture, you could just keep the scanned image as is, compress a little and use that.

Pennycake said:
Search for software that lets you scan a piece of paper and have it turned into digital text.
It shouldn't be that hard to find, I know something like that came with a cheap scanner we bought in the 90s - and the technology can only have improved.
Or if you don't care about file size and if it's in text or picture, you could just keep the scanned image as is, compress a little and use that.
Click to expand...
Click to collapse
Pennycake, I kind of need to have the OCR for key word searches the handheld scanner and software that I have does not recognize my handwriting, even in print.

I would wonder if there is better software / hardware out there.
You can record and there are speech-to-text programs, but I wonder if they would even be as successful as the attempts to digitize the handwriting.

Actually, in my opinion the suggestions made so far are looking at this problem the wrong way.
I think he correct solution is to talk to your manager about the situation and point out that:
i) Any security benefits they think they are getting by banning laptops etc from the meeting are delusional, as after the meeting you are transcribing your handwritten notes to electronic format anyway.
ii) That the current process of you working outside normal hours at home on your personal devices results in a very high risk of the meeting notes being exposed in an insecure environment - in fact, if laptops are banned from the meeting I'm surprised you're even allowed to remove the notes from the office to work on them at home on a personal device.
iii) That while they may have valid reasons to restrict electronic devices at meetings, common sense would suggest that now days the most secure and efficient method of recording meeting notes is to enter said notes directly into a secure enterprise computing environment using an enterprise approved secure device ie., if no-one else, the meeting secretary should be able to use an approved laptop (or similar device) during the meeting.
You need to initiate the discussion that results in a rule change that allows you to take the meeting notes in the most efficient and secure way, rather than search for a better method of circumventing the existing rules - both you and your employer will be better off - you won't have to transcribe the notes at home in your own time and they will have a much higher level of security surrounding those notes.

Pennycake said:
Search for software that lets you scan a piece of paper and have it turned into digital text.
It shouldn't be that hard to find, I know something like that came with a cheap scanner we bought in the 90s - and the technology can only have improved.
Or if you don't care about file size and if it's in text or picture, you could just keep the scanned image as is, compress a little and use that.
Click to expand...
Click to collapse
Mike_NZ said:
Actually, in my opinion the suggestions made so far are looking at this problem the wrong way.
I think he correct solution is to talk to your manager about the situation and point out that:
i) Any security benefits they think they are getting by banning laptops etc from the meeting are delusional, as after the meeting you are transcribing your handwritten notes to electronic format anyway.
ii) That the current process of you working outside normal hours at home on your personal devices results in a very high risk of the meeting notes being exposed in an insecure environment - in fact, if laptops are banned from the meeting I'm surprised you're even allowed to remove the notes from the office to work on them at home on a personal device.
iii) That while they may have valid reasons to restrict electronic devices at meetings, common sense would suggest that now days the most secure and efficient method of recording meeting notes is to enter said notes directly into a secure enterprise computing environment using an enterprise approved secure device ie., if no-one else, the meeting secretary should be able to use an approved laptop (or similar device) during the meeting.
You need to initiate the discussion that results in a rule change that allows you to take the meeting notes in the most efficient and secure way, rather than search for a better method of circumventing the existing rules - both you and your employer will be better off - you won't have to transcribe the notes at home in your own time and they will have a much higher level of security surrounding those notes.
Click to expand...
Click to collapse
I actually tried this, but the reason they don't want electronic media in these rooms are due to the rooms being marked a secure. Electronic media is not allowed to be brought into or out of the room. We have some rooms that have computers that are not allowed to connect to the network or internet in some rooms.
Me removing the notes from the building is not a problem because they are not proprietary or classified in any shape or form. As an engineer they want to make sure I document everything on the projects that I work on. They don't care if I did it via handwritten or pdf. In fact they only request that I make it readable. I transcribe it to electronic media because it makes it much easier for me to do a quick search for key words and find the notes or diagrams and for the teams that I work on to add or make changes.

Juniper Networks study reveals how dangerous Android is to our privacy

Okay, so, I summed up some 5 articles on this subject - in the hope of starting a discussion about device security. I hope you will find this interesting and meaningful and perhaps you will find out about some of the risks of using Android.
2 months ago Juniper Networks, one of the two biggest network equipment manufactures, published a blog post (1) about an intensive research their mobile threat department had on the Android market place.
In essence they analyzed over 1.7 million apps in Google Play, revealing frightening results and prompting a hard reality check for all of us.
One of the worrying findings is that a significant number of applications contain capabilities that could expose sensitive information to 3rd parties. For example, neither Apple nor Google requires apps to ask permission to access some forms of the device ID, or to send it to outsiders. A Wall Street Journal examination (2) of 101 popular Android (and iPhone) apps found that showed that 56 — that's half — of the apps tested transmitted the phone's unique device ID to other companies without users' awareness or consent. 47 apps — again, almost a half — transmitted the phone's location to other companies.
That means that the apps installed in your phone are 50% likely to clandestinely collect and sell information about you without your knowledge nor your consent. For example when you give permission to an app to see your location, most apps don't disclose if they will pass the location to ad companies.
Moving on to more severe Android vulnerabilities. Many applications perform functions not needed for the apps to work — and they do it under the radar! The lack of transparency about who is collecting information and how it is used is a big problem for us.
Juniper warns, that some apps request permission to clandestinely initiate outgoing calls, send SMS messages and use a device camera. An application that can clandestinely initiate a phone call could be used to silently listen to ambient conversations within hearing distance of a mobile device. I am of course talking about the famous and infamous US Navy PlaceRaider (3).
Thankfully the Navy hasn't released this code but who knows if someone hadn't already jumped on the wagon and started making their own pocket sp?. CIO magazine (4) somewhat reassures us though, that the "highly curated nature of [smartphone] application stores makes it far less likely that such an app would "sneak through" and be available for download."
A summary by The Register (5) of the Juniper Networks audit reads that Juniper discovered that free applications are five times more likely to track user location and a whopping 314 percent more likely to access user address books than paid counterparts. 314%!!!
1 in 40 (2.64%) of free apps request permission to send text messages without notifying users, 5.53 per cent of free apps have permission to access the device camera and 6.4 per cent of free apps have permission to clandestinely initiate background calls. Who knows, someone might just be recording you right now, or submitting your photo to some covert database in Czech Republic — without you even knowing that your personal identity is being compromised.
Google, by the way, is the biggest data recipient — so says The Wall Street Journal. Its AdMob, AdSense, Analytics and DoubleClick units collected data from 40% of the apps they audited. Google's main mobile-ad network is AdMob, which lets advertisers target phone users by location, type of device and "demographic data," including gender or age group.
To quote the The Register on the subjec, the issue of mobile app privacy is not new. However Juniper's research is one of the most comprehensive looks at the state of privacy across the entire Google Android application ecosystem. Don't get me wrong. I love using Google's services and I appreciate the positive effect this company has had over how I live my life. However, with a shady reputation like Google's and with it's troubling attitude towards privacy (Google Maps/Earth, Picasa's nonexistent privacy and the list goes on) I sincerely hope that after reading this you will at least think twice before installing any app.
Links: (please excuse my links I'm a new user and cannot post links)
(1) forums.juniper net/t5/Security-Mobility-Now/Exposing-Your-Personal-Information-There-s-An-App-for-That/ba-p/166058
(2) online.wsj com/article/SB10001424052748704694004576020083703574602.html
(3) technologyreview com/view/509116/best-of-2012-placeraider-the-military-smartphone-malware-designed-to-steal-your-life/
(4) cio com/article/718580/PlaceRaider_Shows_Why_Android_Phones_Are_a_Major_Security_Risk?page=2&taxonomyId=3067
(5) theregister co.uk/2012/11/01/android_app_privacy_audit/
____________________________________________________________________________________________
Now I am proposing a discussion. Starting with - do we have the possibility to monitor device activity on the phone? By monitoring device activity, such as outgoing SMSs and phone calls in the background, the camera functions and so on we can tell if our phone is being abused under the radar and against our consent. What do you think?
.

I am finding it sad and troubling but even more so ironic that nobody here cares about this stuff.

Pdroid allows you to tailor your apps and what permissions your device actually allows on a per app basis. Requires some setup, and the GUI is nothing fancy.. but for those worried about permissions, it is quite ideal.
Edit : http://forum.xda-developers.com/showthread.php?t=1357056
Great project, be sure to thank the dev
Sent from my ADR6425LVW using Tapatalk 2

DontPushButtons said:
Pdroid allows you to tailor your apps and what permissions your device actually allows on a per app basis
Click to expand...
Click to collapse
Sounds good for a start, I'll look it up

pilau said:
Sounds good for a start, I'll look it up
Click to expand...
Click to collapse
Okay, so I looked it up, and Pdroid does look like a fantastic solution to control what apps have access to what information on your droid.
However, it doesn't cover monitoring hardware functions such as texts being sent, calls being placed etc. as described in the OP. Besides, it only works in Gingerbread as far as I could gather.
EDIT: looking at PDroid 2.0, it does exactly what I originally asked

pilau said:
Okay, so I looked it up, and Pdroid does look like a fantastic solution a control what apps have access to what information on you droid.
However, it doesn't cover monitoring hardware functions such as texts being sent, calls being placed etc. as described in the OP. Besides, it only works in Gingerbread as far as I could gather.
Click to expand...
Click to collapse
I actually first found out about it on an ics rom, so it's definitely not just gb. As for monitoring, no clue. Any sort of extra process logging would likely bog down resources or space eventually.
Sent from my ADR6425LVW using Tapatalk 2

DontPushButtons said:
Any sort of extra process logging would likely bog down resources or space eventually.
Click to expand...
Click to collapse
I definitely wouldn't know. This solution looks very complicated in first impression but on the Google play page it says 100% no performance effects.
Anyway, I looked up PDroid 2.0 here on XDA, which is the rightful successor of the original app. It does everything the original app does and also monitors many device activities! Here is the full list of features. I would add a working link but I'm still a n00b and I am restricted from doing so. Sigh....
forum.xda-developers com/showthread.php?t=1923576
PDroid 2.0 allows blocking access for any installed application to the following data separately:
Device ID (IMEI/MEID/ESN)
Subscriber ID (IMSI)
SIM serial (ICCID)
Phone and mailbox number
Incoming call number
Outgoing call number
GPS location
Network location
List of accounts (including your google e-mail address)
Account auth tokens
Contacts
Call logs
Calendar
SMS
MMS
Browser bookmarks and history
System logs
SIM info (operator, country)
Network info (operator, country)
IP Tables(until now only for Java process)
Android ID
Call Phone
Send SMS
Send MMS
Record Audio
Access Camera
Force online state (fake online state to permanent online)
Wifi Info
ICC Access (integrated circuit-card access, for reading/writing sms on ICC)
Switch network state (e.g. mobile network)
Switch Wifi State
Start on Boot (prevents that application gets the INTENT_BOOT_COMPLETE Broadcast)

I've always had the luxury of someone else integrating it into the Rom, then I just had to set it up through the app. It is time-consuming, but not very difficult at all. I say give it a shot and see if that's what you had in mind. Maybe the logging is less detrimental than I had previously thought.
I'm sure you could get your post count up by asking for some tips in that thread. Every forum on xda has at least one person that's EXCESSIVELY helpful, frequently more. So have a ball
Sent from my ADR6425LVW using Tapatalk 2