安全与密码学2022scss.tcd.ie
Android 上的 Google Dialer 与 Messages 应用向 Google 发送哪些数据？
What data do the Google Dialer and Messages apps on Android send to Google?
进阶 · 约 30 分钟读完前置知识：Android 应用基础、网络流量分析、隐私与遥测基础
导读
这篇论文由都柏林三一学院的 Doug Leith 测量 Android 上 Google Messages 和 Google Dialer 向 Google 发送的遥测数据。研究发现这些应用会上报消息/通话的发生时间、通话时长、电话号码、消息文本哈希以及用户与应用的交互时长等，且用户无法退出；数据通过 Google Play Services 的 Clearcut logger 和 Firebase Analytics 发送。
HN 关注点：即使用户尽量避开 Google，只要联系人使用 Android，自己的通话/短信元数据仍可能被收集，以及 Android 初始设置阶段的大量遥测和难以退出。
HN 评论精选
这几条评论里：支持 1 补充 1 亲历 1
支持报告揭示 Google 可关联通话/短信双方并掌握时间、时长、号码等元数据，且无退出选项。
这是来自严肃研究机构（都柏林三一学院）的一份严肃报告。此前外界对 Google Play Services 的数据收集了解不多。可怕的结果是，Google 可以轻易看到（1）哪个发送者（2）发送了什么（3）给谁（4）在什么时间，以及（5）用户何时使用应用（6）用了多久。它甚至会上传电话号码和 Android ID。据报道，报告发布后 Google 将在某些法律文本中作出说明。我预计这至少在欧盟是完全非法的。是时候让高管因这类侵权行为坐牢了。摘要称：Google Messages 发送消息文本哈希，使一次消息交换中的发送方和接收方可被关联；Google Dialer 发送通话时间和时长，同样可关联两部手机；电话号码也会发送；用户与应用交互的时间和时长也会发送；无法退出；数据通过 Clearcut logger 和 Firebase Analytics 两个通道发送。
exceptione查看英文原文
This is a serious report from a serious research institute (Trinity College Dublin). There was previously not much insight into data harvesting by Google Play Services. The terrifying result is that google can easily see (1) which sender sends (2) what (3) to who at (4) what time, and (5) when the user uses the app (6) for how long. It does so by even sending phone numbers and Android ID. Reportedly, Google will clarify something in some legal text after this report came out. I would expect this would be totally illegal in at least the EU. It is about time top executives will receive jail time for these kind of breaches. From the abstract: We report on measurements of the data sent to Google by the Google Messages and Google Dialer apps on an Android hand- set. We find that these apps tell Google when message/phone calls are made/received. The data sent by Google Messages includes a hash of the message text, allowing linking of sender and receiver in a message exchange, and by Google Dialer the call time and duration, again allowing linking of the two handsets engaged in a phone call. Phone numbers are also sent to Google. In addition, the timing and duration of user interactions with the apps are sent to Google. There is no opt out from this data collection. The data is sent via two channels, the Google Play Services (i) Clearcut logger and (ii) Google/Firebase Analytics. This study is therefore one of the first to cast light on the actual telemetry data sent by Google Play Services, which to date has largely been opaque.
补充第三方联系人可“替”非用户同意数据收集，隐私选择失效。
我最讨厌 Google 和 Facebook 的就是这一点。你想选择让他们收集你的所有数据，可以；我不同意，但最终这是你的选择。但像我这样尽最大努力把这两家公司从生活中清除的人，如果我和使用 Android 的人通信，或和允许 Facebook 完全访问联系人等数据的人通信……这些公司仍然在未经我同意的情况下拿到我的数据。不知怎么地，这些公司让另一个人替他们同意获取我的数据，竟然变得合法了。
nerdjon查看英文原文
This is what I hate most about Google and Facebook. If you want to choose to let them gather all of your data, fine. I disagree with it but it is ultimately your choice. But as someone who has made every effort to remove both of these companies from my life as much as possible, if I communicate with someone who uses Android or someone who allows Facebook complete access to their contacts and other data... those companies still get MY data without my consent. Somehow it has become legal for these companies to allow someone else to consent for them to get my data.
亲历亲测 Android 初始设置大量外联且无法先装防火墙/走代理，用户没有事前控制权。
我最近对一台 Android 11 设备初始设置过程做了 tcpdump。仅仅到启动器就下载了约 60MiB。它不仅联系 Google，还联系制造商、Microsoft，以及一些我认不出的域名。在遭受内置间谍软件之前，根本不可能安装 AFWall 这类隐私工具。bootloader 默认锁定，只有创建 Google 账号（涉及接受条款）后才能解锁。也无法通过代理服务器完成初始设置：它确实用我设置的代理联系 Google，但在流量通过默认网关之前，它不认为有互联网连接并拒绝继续。我认为应该像香烟盒一样给所谓“智能”设备加警告。可惜永远不会发生。相反，当权者更可能把“绕过”或“篡改”我们曾经拥有的锁定计算机定为非法。
pdenton查看英文原文
I recently tcpdump'd an Android 11 device going through the initial setup. About 60MiB was downloaded just to get to the launcher. It contacts not only Google, but the manufacturer and Microsoft, as well as a few domains I couldn't recognize. It's impossible to install privacy tools (like AFWall) before being subjected to built-in spyware. The bootloader was locked by default and could only be unlocked after creating a Google account (which involves accepting their terms and conditions). It was also impossible to go through initial setup using a proxy server. It did use the proxy server I had setup to contact Google, but it wouldn't accept the connection as having internet connectivity (and refuse to go any further) until traffic was routed through the default gateway. I think it would be reasonable to add warnings to so-called "smart" devices the same way as packs of cigarettes. It'll never happen, sadly. If anything, the Powers That Be would rather make it illegal to "circumvent" or "tamper" with the locked-down computers that we used to own.
相关资源
从这篇论文所有 HN 讨论帖的全部评论里整理出来的链接。
历次讨论
- 2022Hacker News 讨论帖233 分 · 90 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选