Is there a smart phone that doesn't track users?

Originally published 04/25/2011 at lubbockonline.com

Declan Mcullagh of CNET reports that Android also collects user data. This is similar to the complaint against Apple's iPhone and iPad last week. Google claims there is no user identifying data sent, but that isn't true, strictly speaking.

The article quotes Sammy Kamkar, a well known security researcher, as saying, ""It's not tied to a user, but it is a unique identifier to that phone that never changes unless you do a factory reset."

But it's worse than that. It may be impossible to truly anonymize data and have it retain it's usefulness for marketing purposes. AOL learned this. Netflix learned this. It's time we learned it. Police routinely request cell phone tracking data from providers, often without a warrant, and the Justice Department is pushing Congress to make it the law of the land that cell phone data can be searched without a warrant. Even if the data from cell providers is anonymized, current technology is more than adequate to allow clever people to attach a name, number and address to the anonymous data. According to Markus Ullman and Marco Gruteser all that may be necessary to identify a person is their location data:

Unfortunately, anonymous location samples do not fully solve the privacy problem. An adversary could link multiple samples (i.e., follow the footsteps) to accumulate path information and eventually identify a user.

No company should be able to just gather data on our whereabouts, our likes and dislikes, our political or any other preferences without our informed permission. But until we force them to stop, they won't. It's in their best interest to gather and use any information they can, either to sell or to use to tailor their offerings to us.

Accept credit cards on your mobile device.

In his NYT column yesterday, David Pogue reviewed the offering of a company called Square. Their product is a sweet software/hardware combo that allows anyone to accept credit card payments on their iPod, iPhone, Ipad, or Android phone. And do it at a reasonable cost.

I have to admit that I haven't paid any attention to processing credit cards on your cell phone. This looks like a cool idea, but apparently it's not the only option out there - although it may be the most palatable for some. In the comments to the article the reaction seems about even between the "This is great!" and the "This is a waste" crowds. There are a couple of people concerned about fraud, but I don't think the risks any worse than anything we already face on a daily basis. No worse than giving your credit card to the waitress at your favorite restaurant, anyway - and probably not as bad.

Square makes it possible to accept credit cards at your garage sale, or your booth at the local trade days, flea market, or for services you provide. It makes it possible to accept credit cards even if you only need to once or twice a year. And it makes it possible without having to have a merchant account or a paypal account, which is a big plus to some. Will it take off? I think it has a good chance, but only time will tell.

Android rootkit revealed at defcon18

esecurityplanet.com reports that researchers Nicholas Percoco and Christian Papathanasiou wanted to prove that it's not hard to create rootkits for Android devices. They succeeded with a rootkit that can exploit vulnerabilities to gain access to the phone or mimic real apps to fool users into downloading it.

Rootkits are nasty, mangy, fang-toothed things that get into your system, whether it's a computer or a smartphone, and hide itself from casual (and often intense) examination. Cell phone rootkits have been around for a little while, but as they become more commonly available and more people get smart phones serious effort may go into producing and deploying rootkits to mine this looming mountain of data.

javascript:void(0)