[inoop]

I was bored so I downloaded the stock gingerbread image of the X2 and poked around the system a bit. It seems that the bulk of the code is in blur-services.apk.

Manifest: http://pastie.org/pastes/8102815/text strings.xml: http://pastie.org/pastes/8102837/text

I also found a bunch of apks that look like 'plugins', haven't really looked at them, but should provide a clue to what they're snooping

    blur_myspace.apk
    blur_linkedin.apk
    blur_picasa.apk
    blur_orkut.apk
    blur_lastfm.apk
    blur_flickr.apk
    blur_youtube.apk
    blur_activesync.apk
    blur_email.apk
    blur_twitter.apk
    blur_skyrock.apk
    blur_facebook.apk
    blur_photobucket.apk
    blur_yahoo.apk

edit: from looking at some of the code, it seems that all this stuff is mostly to provide social networking integration for MotoBlur, and probably not to steal your data. Although personally I'd be flashing Cyanogenmod pretty quickly :3

[qwerty_asdf]

  > it seems that all this stuff is mostly 
  > to provide social networking integration for MotoBlur

I'm not sure why you'd give them the benefit of the doubt. There's no way they built apps in 20 different flavors that consume ALL network traffic and redirect it to their servers, simply as an accidental rookie mistake.

I don't feel like buying into the idea that it was all consultants hired on short term by motorola, in a mad scramble to create an android platform and compete with the iPhone, working under a temporary contract with no accountability.

I don't even want to buy into the idea that maybe there was a large team of disinterested 9 to 5 corporate drones, with a middle manager who was a real dick with a middling paycheck as a mediocre incentive to produce high-quality work, who inspired nothing but apathy in his subordinates, and was too lazy, and too interested in fantasy football, to check their work for network security practices.

Capture ALLLL the traffic, and don't encrypt it? As an innocent mistake?

No way. I can't put the blinders on, here.