[speeder]

Since lots of this data is sent through not encrypted HTTP, this means that NSA (and any other intelligence agency) can also get all this data...

Then people wonder the "nothing to hide" well, you might not, but will everyone you know be bothered you are sending their e-mails around to intelligence agencies?

[lawnchair_larry]

Who cares about the NSA when all of your logins and passwords are literally being stolen and are sitting on Motorola servers in plaintext. This is extremely egregious, and I'm expecting there will be some major fines from the FCC. How can they be this dumb?

I guess since Google bought them, this is their disaster now.

[cmircea]

What if you DO have something to hide? Company secrets can be very, very valuable for someone.

[corresation]

This is where modern intelligence is going. We know that one of the most common targets of Chinese intelligence gathering now is industrial espionage -- stealing trade secrets. I hardly think China is alone in this, and if the NSA or anyone else can get a heads-up that advantages US firms against Chinese, Canadian, or EU firms, you can bet your ass that is going to be communicated to the necessary people.

From a "hacker" perspective, even metadata on the key employees of a corporation is incredibly valuable -- imagine knowing with what firms a company is communicating, giving inside lines of investment-impacting activities like acquisitions. This is enormously valuable stuff.

[saryant]

> From a "hacker" perspective, even metadata on the key employees of a corporation is incredibly valuable -- imagine knowing with what firms a company is communicating, giving inside lines of investment-impacting activities like acquisitions. This is enormously valuable stuff.

When Boeing and McDonnell Douglas merged, executives from those companies would fly to different, distinct cities for negotiations and then drive several hours to the actual meeting location. In that case, just knowing that execs from those two firms were flying to the same city repeatedly would be more than enough to start merger rumors.

IIRC, ExxonMobil did the same when acquiring XTO. Exxon didn't want XTO's share price to skyrocket on rumors of an acquisition as it could've made the deal unprofitable.

[gohrt]

> IIRC, ExxonMobil did the same when acquiring XTO. Exxon didn't want XTO's share price to skyrocket on rumors of an acquisition as it could've made the deal unprofitable.

That doesn't make sense. If shares rose on the merger rumor, Exxon could still offer a low price, since everyone knew XTO's price would collapse if the merge fell through.

[yardie]

During an acquisition the price on the shares of the acquirer goes down while the acquiree goes up. Since most mergers tend to be stock swaps rather than cash they would have to invest more shares than originally intended. If the merger falls through both would lose out as the acquirer would be seen as wasting a lot of money with nothing to show and the acquiree would be see as not so valuable.

[dllthomas]

They could still, in principle, negotiate around fixed numbers of shares instead of market values.

[javert]

Use encryption all the time, and don't use any Microsoft products. All companies that have valuable secrets should already have this policy in place.

[jacalata]

An Android phone made by Motorola is reported to be leaking data, and your response is 'don't use any Microsoft products'? How is that relevant?

[javert]

I was responding to a comment about company secrets. I guarantee you a lot more information is being exfiltrated from large US companies via Windows than via Android, and since most businesses are built around Windows, it's a lot harder for them to do anything about it.

[xogouyne]

Show the proof or stop trolling. What can you gurantee exactly? Op links to article with raw packet data. Suprised mods does not change title to Google. Stop talking out of your ass

[javert]

How about the billions of dollars of intellectual property that has been stolen from American defense contractors? Do you think that is being stolen from their Windows desktops, or do you think it's being stolen from their cell phones?

The aggressive behavior and language you are using are not welcome or appreciated on Hacker News.

Also, you are coming across as a Microsoft astroturfer. If you are, you're going to be doing more harm to the MS brand than good.

[kryten]

This. We have a firewall in our company to stop things escaping as much as letting them in. There are so many things built into windows that phone home its scary. Even a VLK 7 with internal KMS has a good bash at trying to get out of the network. The problem is that it is virtually impossible to stop it without affecting users as everything goes over HTTP and pokes holes in windows' application level firewall.

Our shift to Java EE recently has resulted in us switching a few users to Ubuntu 12.04. Removing a couple of packages makes it 100% network silent plus we can host a mirror in house of packages.

Windows is going to end up inside virtualbox on a private virtual lan on the workstation if this works out.

I dread to think what nefarious code phones have in them if these are the problems we have with a desktop OS.

[loudmax]

...don't use any Microsoft products...

Should be "don't use proprietary software," no? That would apply to Google as well.

[flagnog]

and, importantly, check what software you do run. It's only happenstance that the article author found out what was being sent back.

[soundgecko]

Any Microsoft product? They shouldn't use any Google product by the same token.

Report: Android malware up 614% as smartphone scams go industrial http://www.theregister.co.uk/2013/06/26/android_malware_bloo...

From http://gawker.com/5637234/gcreep-google-engineer-stalked-tee...

In at least four cases, Barksdale spied on minors' Google accounts without their consent, according to a source close to the incidents. In an incident this spring involving a 15-year-old boy who he'd befriended, Barksdale tapped into call logs from Google Voice, Google's Internet phone service, after the boy refused to tell him the name of his new girlfriend, according to our source. After accessing the kid's account to retrieve her name and phone number, Barksdale then taunted the boy and threatened to call her.

In other cases involving teens of both sexes, Barksdale exhibited a similar pattern of aggressively violating others' privacy, according to our source. He accessed contact lists and chat transcripts, and in one case quoted from an IM that he'd looked up behind the person's back. (He later apologized to one for retrieving the information without her knowledge.) In another incident, Barksdale unblocked himself from a Gtalk buddy list even though the teen in question had taken steps to cut communications with the Google engineer.

[javert]

I completely agree. If you want to keep something secret, do not use Google products.

I don't recommend taking the time, but if you were to trawl through all my posts on Hacker News, you'd find that I've said this about Google several times in the past, before the breaking of the NSA scandal.

[cmpxchg8]

I do not use Google products either, but you need to add more companies to that. You can't use Facebook, or Yahoo products.

Funnily enough I stopped using Google products because they keep alienating me with their decisions like the Real Names policy or killing Reader. Taking my privacy back is an added bonus.

That also means no Android phone, although FirefoxOS phones look promising.

[flagnog]

the problem will be that people you interact with use Google or MS products, then the data leakage happens on their side of the conversation.

[rayiner]

In light of the second article, I find it ridiculous that people are asserting they have an expectation of privacy in google communications when apparently random creepy engineers have access to that data! I'd at the very least expect strong internal lockouts on customer information, with keys limited to "need to know" people...

[ealexhudson]

Given Motorola are now owned by the same Google that participates in the PRISM programme (et al), I'm really not sure the encryption matters so much.

[dserodio]

With unencrypted communication, any insecure Wifi network is enough to "leak" your information, it's much worse then "only" Google/NSA/etc having access to it.

[mirkules]

Whether you data is encrypted or not is really not relevant when the device's OS cannot be trusted. You can encrypt 'till the cows come home, but if the OS is stealing your data before you have a chance to encrypt it, your encryption is worthless.

I just want people to stop thinking that encryption is some magic bullet that will solve all communication trust issues.

[bonyt]

It's not completely worthless - it's the difference between the targeted attacker having your data through the backdoor in your devices OS, and that attacker PLUS anyone on the unsecured wifi in the coffee shop having your data. Yes, it's a difference of degree, not kind; but it's still relevant.

[ealexhudson]

Sure, I was just commenting on the potential ability of the NSA in particular to grab it.

[speeder]

Good point, I had forgotten that.

[jsz0]

For most people the bigger threat is going to come from the wifi networks they connect to at work, school, coffee shops, etc. If I owned a Motorola SmartPhone I would stop using wifi on untrusted & semi-trusted networks immediately.