[D9u]

I believe that the keyword here is "ActiveSync," which is another Microsoft product.

Since I made a conscious effort (years ago) to remove all Microsoft products from my life, ActiveSync is another app which I have never used.

Who needs it?

[wfraser]

Did you even read the article? It has nothing to do with EAS or Microsoft; it's Motorola software siphoning pretty much all the user's credentials off to Motorola servers.

[D9u]

Yes, I did read the article in its entirety. Did you? The author mentions ActiveSync more than once.

    *" What I am going to do as a result of this discovery

    As of 23 June 2013, I've removed my ActiveSync configuration from the phone, because I can't guarantee that proprietary corporate information isn't being funneled through Motorola's servers. I know that some information (like the name of our ActiveSync server, our domain name, and a few examples of our account-naming conventions) is, but I don't have time to exhaustively test to see what else is being sent their way, or to do that every time the phone updates its configuration.
    I've also deleted the IMAP configuration that connected to my personal email, and have installed K-9 Mail as a temporary workaround.
    I'm going to figure out how to root this phone and install a "clean" version of Android. That will mean I can't use ActiveSync (my employer doesn't allow rooted phones to connect), which means a major reason I use my phone will disappear, but better that than risk sending their data to Motorola.
    I'll assume that other manufacturers and carriers have their own equivalent of this - recall the Carrier IQ revelation from 2011."*

ActiveSync is not only used for "Exchange Server" connections.

Judging by your past comments, you are merely another Microsoft shill who believes that they can do no wrong...

[bdcravens]

The article is about stealing credentials. If you have an Exchange setup, or Gmail, or Yahoo mail, or IMAP, it's the same.

[mwfunk]

I'm sorry but as soon as you accuse someone of being a shill or try to dismiss someone's comments because of fanboyism, you lose all credibility for pretty much the next 10 years of your life. There aren't enough downvotes in the world for that crap.

[D9u]

To beat a dead horse, regardless of the opinions of the mindless:

[from the article]

    *" I was quickly able to determine that the connections to Motorola were triggered every time I updated the ActiveSync configuration on my phone, and that the unencrypted HTTP traffic contained the following data:

    The DNS name of the ActiveSync server (only sent when the configuration is first created).
    The domain name and user ID I specified for authentication.
    The full email address of the account.
    The name of the connection.

    As I looked through more of the proxy history, I could see less-frequent connections in which larger chunks of data were sent - for example, a list of all the application shortcuts and widgets on my phone's home screen(s)."*

Would someone please illuminate me as to why my reference to ActiveSync is alleged to be irrelevant to this conversation?

[bskap]

The author originally noticed the snooping because he happened to be examining the phone's traffic when the ActiveSync credentials were sent. If you actually read the entire article, you'll notice that credentials were sent for Exchange, Facebook, Twitter, Photobucket, Picasa, YouTube, IMAP, POP, Yahoo Mail, and Flickr. Of those, the Microsoft and Yahoo services are the only ones where passwords are NOT sent, meaning you leak less data using ActiveSync than you do using IMAP.

[D9u]

So what is the name of the software which is sending the information, if it's not ActiveSync?

[jacalata]

Motoblur.