Slashdot Mirror
Are There Any Smartphones That Respect Privacy?
An anonymous reader writes "After many years I am finally considering entering the smartphone era. Within the mainstream, there seem to be four OS choices: Windows, Android, Blackberry, or iOS: Android comes out as clear winner to me. However, all of the choices in one way or another require sharing a lot of personal information in the Cloud run by their respective corporations. Let alone Blackberry's centralized mail servers; there is no way to have an Android smartphone working decently without sharing all of your contacts, calendar appointments, and other stuff with Google. While Android is less intrusive than iOS, the lack of privacy remains quite annoying no matter how comfortable it is to have your own calendar and contacts centralized. In 2011 is there any option, other than living in a cave, to keep one's own life private while enjoying the wonders of modern smartphone apps?"
As is running CyanogenMod on a rooted Android phone.
OK, so you say you're concerned about the security of your list of contact phone numbers and addresses. Yet when you want to call the contact, you ask your cellular provider via the GSM network to establish the connection. When you email the contact you use the 4G network to access the internet, and send your email to them, secured only on the hop between your phone and your SMTP server, but otherwise probably being transmitted in cleartext. When you bring up their address in the map, you give Google the locations of every place you view. And every where you go, whether it be to a calendar appointment or just out for a stroll, the cell phone is broadcasting your identity and approximate location to anyone interested in such things.
I think distrusting Google wouldn't be first on the list of privacy actions to take.
Not having a cell phone would go a lot further protecting your privacy, but you said you don't want the cave option. Get a Kindle Fire (wi-fi only, only when you want it), root it, and add only GPL software you trust, including a SIP client. Carry a Sprint wi-fi hotspot, turning it on only on your terms. Or carry a dumb phone (Sony Ericsson makes one) then use Bluetooth to tether the smart device. Instead of the Kindle Fire, you could use an iPod touch.
You could even carry an iPhone. To the best of my knowledge, Apple isn't scraping my contact list. Yet. I think.
John
Wait a minute. I'm a manager, and I've been reading a lot of case studies and watching a lot of webcasts about The Cloud. Based on all of this glorious marketing literature, I, as a manager, have absolutely no reason to doubt the safety of any data put in The Cloud.
The case studies all use words like "secure", "MD5", "RSS feeds" and "encryption" to describe the security of The Cloud. I don't know about you, but that sounds damn secure to me! Some Clouds even use SSL and HTTP. That's rock solid in my book.
And don't forget that you have to use Web Services to access The Cloud. Nothing is more secure than SOA and Web Services, with the exception of perhaps SaaS. But I think that Cloud Services 2.0 will combine the tiers into an MVC-compliant stack that uses SaaS to increase the security and partitioning of the data.
My main concern isn't with the security of The Cloud, but rather with getting my Indian team to learn all about it so we can deploy some first-generation The Cloud applications and Web Services to provide the ultimate platform upon which we can layer our business intelligence and reporting, because there are still a few verticals that we need to leverage before we can move to The Cloud 2.0.
It also doesn't leak data to Google like Android does, it doesn't have the malware problem that Android has
The only reason Windows phone 7 doesn't have the malware issues is that there are only like 2 people in north america that use them. If Windows phone 7 ever gets even 50% of the north american users of either iOS or android,it will have such a malware problem that I'd bet you'd be better off putting your social security number on TV than carrying one.
Any reason you could not just get an Android phone and then just say no, when it ask you for permission for your location data? It only ask once.
Then you just need not to add your google account, and you will be free of the cloud.
RIM solved this problem. If you don't want your data on somebody else's server, set up your own BES (Blackberry Enterprise Server) with YOUR security policies.
Taint cheap, but you gets what you pays for.......
The consumer blackberries connect to BESs operated by the carriers. My corporate owned one connects to OURS, and the company has all kinds of flexibility to impose policy, remote wipe, etc.
Red
Microsoft may be many things, but they have always respected privacy.
That's why Microsoft got a lot of criticism because of the phoning home feature of WGA right? Or that's why MS gives your info to the government even without your consent. Or that's why Microsoft collected PC and phones locations in ther Web map services...
You should inform yourself a little more, all that glitters is not gold
I seriously doubt that, since it has a locked-down app store and sandboxed applications (fairly restricted API's, no native code.) It should be at least as secure as iPhone OS, if not more so.
And I'm serious. While not as versatile towards own-hosted solutions as the old Windows Mobiles, it's still light years beyond Android and iOS. You can easily use your own Exchange server to sync and share your contacts, calendar and other stuff, which gives you true privacy.
Is it really that easy to set up your own Exchange server? Does everyone around here keep a Windows server in a coloc somewhere so they can run Exchange?
The reason for this is simple too. Microsoft may be many things, but they have always respected privacy.
Really? Always?
http://grep.law.harvard.edu/articles/02/08/08/0923231.shtml
http://www.networkworld.com/community/blog/users-outraged-over-windows-live-privacy-violations
http://arstechnica.com/microsoft/news/2010/02/microsft-investigates-hotmail-privacy-breach.ars
And that's just what I found in a quick google search.
Either fill in the [citation needed] or you're just spouting very tired 10-year-old anti-MS FUD; which quite frankly is a boring topic these days.
At least do enough research to tell us what security holes Windows Phone 7 suffers from, or tell us from which tank of thin air you pulled the statistic "2 people in north america" from.
John
I will second the AC's point - why is Android a "clear winner" while iOS is "more intrusive"?
Not that I necessarily disagree, I am just interested in how you came to that conclusion.
FWIW, you don't have to share your contacts and calendars "in the cloud" in iOS - it's entirely optional, and you can sync solely through your home machine if you like. If you don't want to share personal info with Apple at all then you can set up a throwaway email account for your Apple ID and top it up using iTunes Gift Cards if you want to spend any more on the store (you *do not* need to give them a credit card at any stage).
Then turn off all the location services, and I'm not seeing how iOS is any more or less intrusive than Android is.
YMMV, of course. Pick the best phone for the job - if you're buying new, the Galaxy II S and the iPhone 4S are both excellent if you decide to go Android/iOS.
Or that's why MS gives your info to the government even without your consent.
Like Google and Apple does too, and every other US company. It's the law, they cant do anything about it. But since you can install and use Exchange with WP7, you can minimize effect of that. Not so with Google or Apple, which want all your data.
You can tell Android's built-in Sync to not touch your contacts, appointments, email & then use the generic (& built-in!) calender & email applications that do exactly the same things over standard protocols...
In spite of that, email communication and web communication is encrypted/decrypted on the BlackBerry smartphone itself, so RIM (the company that does BlackBerry) can't snoop into your data contents even if they wanted to. That's why some authoritarian countries around the world couldn't quite understand - they demanded RIM hand over the secret keys to let them read any message contents, which they just assumed RIM must have, even though they don't. Similarly, with the riots in Britain earlier this year, the authorities complained that the rioters were co-ordinating using BlackBerry phones, and they couldn't intercept those communications. To me, that's a strong recommendation for a BlackBerry if you want security and privacy.
Atheism is a religion to the same extent that not collecting stamps is a hobby.
It is perfectly workable to plug in your old SIM with phone numbers stored on it and use them from an Android phone without ever setting up a Google account. It is also possible to add fully featured contacts and calendar appointments locally on your phone without sharing them with Google.
If by "working decently" you mean the phone should seamlessly sync with your other devices through the cloud, you have the option of setting up your own SyncML server, and most manufacturers also include MS Exchange ActiveSync as well.
The problem is that most of the uneducated masses don't care about privacy and don't see a need for it. So they go for the number of Apps or GHz when purchasing a new mobile device, without caring that this device is a fully functional computer with all sorts of sensors that is connected to some sort of network 24/7!
There were a few attempts at true Linux mobile devices, but even the last two devices with potential (the Nokia N900 in 2009 and N9 this year) only got a lukewarm reception mostly due to crappy marketing and not enough people promoting truly open platforms that let users know what their devices are actually doing in the background.
The N9 is still up for graps. There is even an independent project called Mer being worked at that aims to be fully open, based on Meego, feel free to join if you have some coding skills.
Let alone Blackberry's centralized mail servers; there is no way to have an Android smartphone working decently without sharing all of your contacts, calendar appointments, and other stuff with Google.
You have got only partial information somewhere.
You can have pure Android smartphone, without any demands to share your privacy with Google. Period.
If you want to use Android market (market.android.com) then you need to activate your new phone first time to it. It does not mean you need to input your personal email address to it or bond your personal gmail to it. You only need to create a one for your Android market store profile.
You do not need to use other Google services at all.
- Not GMail for email, you can choose what ever just offers POP3/IMAP connection
- Not Google Calender, you can stick what ever just gives standard vcard sharing, even sync manually
- Not Google Contacts (GMail contacts), you can disallow the syncing contacts with Android profile account and keep them in phone only or in SIM card. You can even from contact book sync them with standard vcard to microSD and sync manually.
You don't either need youtube account or anything. Actually you don't even need a Android Market profile if you are willing to get your applications somewhere else than Android Market. Like Amazon store or any other third party who you can trust.
Android Market just makes it easy to install applications (via phone or any browser) to your phones and especially buy them (even that Google changed 24h return time to 15 minutes).
Corporations can at one step totally skip whole Android activation with Google. They can activate the phone to their own exchange environment (I could thing same thing would be possible to do with Linux servers).
So corporation IT department can manage the phone without Google knowing anything at all.
I have used GMail from the beginning when it was just in invitation mode.
I bought my first Android phone 9 months ago, it is a very cheap one (107€ with 2€/month for unlimited data speed and amount and the phone supports 7.2Mbits connection and nearly full speed (750-800KB/s) as hot-spot for computers with ping being 70-90 by avarage.
Before that I owned only a Nokia phones. Symbian before Symbian was terrible, I never used it for any things, even it was classified as smartphone (without touchscreen).
And now, I use Google services very much. Why? Because they integrate very well with the Android and I can really get many benefits from it.
If wanted, I could have kept contacts off from GMail or my calender off from there. But I don't have a home server what to keep online all the time or I don't want to start syncing contacts and other data with my own rented server.
If I would have home server, I would really use it for every thing what Android support.
Did you know that Microsoft has paid to at least one carrier in US to sell Android phones, on what every Google service is replaced with Microsoft own services and user can not install Google services back?
So customer is tied to Microsoft Bing search, Bing maps, Hotmail, Calender etc?
People believe that Android forces customer to Google. That simply ain't true. It is just the easiest and actually most secure way to use smartphone.
Google search .....
Picasa
Google Calender
Google Reader
Youtube
GMail
Google Docs
Google Maps
Google offers so many features and none of those need to even be used with your private contacts, emails, etc. You can just disable the sync or add a new offline account for those in phone.
When it comes to privacy, easiness and many other features. Android just is best, and not even Microsoft have nothing to offer in Windows Phone (7.5 yet... lets see what future shows us).
And even though it was launched in 2009, it offers a boatload of features that other phones don't even try to match: the Nokia N900.
-- Look to the Rose that blows about us--"Lo, Laughing," she says, "into the World I blow..."
We run BES Express for free....
http://us.blackberry.com/business/software/besx/
Every single story I've read so far about malware on Android was people either installing apps off the internet or through a third-party app store. How is Google not doing a good job removing harmful apps from the market?
Is that why Microsoft's flagship operating system was Windows XP for like a decade before they finally came out with Vista?
Yeah, that "speed to market" thing was really not that obvious.
You are welcome on my lawn.
And I'm serious. While not as versatile towards own-hosted solutions as the old Windows Mobiles, it's still light years beyond Android and iOS. You can easily use your own Exchange server to sync and share your contacts, calendar and other stuff, which gives you true privacy. It also doesn't leak data to Google like Android does, it doesn't have the malware problem that Android has [techcrunch.com] and the phone itself is a full smart phone with an great UI (Windows Mobile somewhat started lacking in this in recent years).
Stop spreading false information.
Android is possible to be configured from the beginning only to use any exchange server as well. You do not need to use any Google services or applications if you do not want to do so.
What comes to malware, so long most serious problems has been in third party resources for applications. And those few in official market, have not been so bad or anything serious. Still, I don't reject that there ain't possibility or anything else. but it is now so widely spread FUD about it that it is already a non-proofed truth.
And Windows Phone 7 GUI shares opinions very well. And that matter is out of the line here in this topic as well, what is about question of privacy concerning contacts and addresses of everyones elses who phone owners has stored to own phone. So far Windows Phone GUI has nothing to do with it, so bringing it to hype it as biased user does not help at all in this discussion.
When you can buy a Windows Phone where there are no single Microsoft service or application installed or need to be used, then come back to talk with the GUI.
Android is more secure and protects much better way the users privacy than your "Windows Phone GUI is awesome" phone does. (The other topic is then how much it is protected or informed the user about risks and same discussion can be gone trough again with any software system out there).
The only time when you need contact with other servers is to download and install apps, which imo is a stupid decision fueled by iOS and Android doing it that way. Old Windows Mobiles always allowed you to install apps the way you wanted, the desktop Windows way. However, I guess that provides some extra security.
Android does not force to use only online services to install applications. User can download application, save it where wanted (dropbox, FTP, webdav, microSD... you name it) and then install it with filemanager to Android device.
The one problem is with Android Market is that you can not download directly from there. But you can install application from there using any web browser (desktop, laptop or even iOS devices or Windows Phone phone) and it gets installed to your Android phone next time you have internet connection (WiFi, 3G etc) and it was activated to Google services and you have Market application installed with Google profile.
So don't spread lies that Android does not allow installing applications with old fashion way as it does. Even I do so sometimes when I want to install non-official Google Maps version where is just enabled navigation every country. And I don't even need a any Google account for that.
PS. N9 does not have MeeGo in it. It has Harmattan. Harmattan and MeeGo are two different products and development branches. Harmattan were code name for Maemo 6.0 (5.0 is in N900) and MeeGo was project of Maemo 5.0 + Moblin.
So do not talk about MeeGo when talking about N9 but only with Harmattan aka Maemo as that is used in it.
Agreed. If you want absolute privacy, your own BES is the way to go.
And you can get BES Express for free (you lose some of management policies, but the core security stuff is there) though you'll need a mail/calendaring/contact server to hook it up to, which means (if you want to avoid Exchange) probably VMware's Zimbra.
--srj/mmv
A decade? Windows XP was 2003,
Bullshit. XP was 2001, Vista was 2007. And he did say "like a decade", so fine, he rounded up. 6 years is like an eternity in between OSes anyway; it certainly felt like a decade by the time the long-promised "Longhorn" became reality.
And Vista was a huge success too.
Laughable. Probably the most hated OS released by anyone since Windows Millenium.
How long between vista and 7? how long between 7 and 8? How about windows 98, me, and 2000?
He was specifically only talking about the lag between XP and Vista. And you're missing his point entirely - even though it took 6 years, negating the "speed to market" point, the OS still sucked, so "quality of software" not really a valid point either. Basically what I'm saying is he ripped you apart in two short sentences, it went over your head, and I just wasted 3 minutes of my life explaining it to you.
I've learned that they're worthless, so I don't read AC comments anymore.
Came here expecting to see a link to this video of why RMS doesn't use cell phones: http://www.youtube.com/watch?v=WGkNiRFwmOg. Left dissatisfied.
Most of the security bashing is related to drive-by installs and related security holes, where software gets installed without user interaction. And the ease of which installed software can escalate its own permissions, and the hardness of running Windows as non-privileged user.
Stop spreading false information.
Android is possible to be configured from the beginning only to use any exchange server as well. You do not need to use any Google services or applications if you do not want to do so.
I'm afraid you're the one, that inadvertantly or otherwise, is spreading false information. Some models of Android phone will not let you even use the calendar or contacts unless you sign up with Google. One my Acer AOD255 I could not get anywhere without signing up with Google, but at least that doesn't have contacts from my SIM card to share. On my Acer Liquid Metal I found that the 2.3.5 image did indeed turn on sharing by default. It gives you the option not to sync contacts with Google but they're shared by default and there are a bunch of different options that will easily trip up even an experienced user. Background data, auto sync, then sync on each of Phone SIM and Google account.
What is worse is that import and export to SD card are broken - they put all numbers in US number format with dashes hard coded, which makes Australian numbers look wrong and is confusing for an Australian user use to dashes in different location. The stupid thing is import from SIM is not broken and does not do any such hard coding. The easiest way around it is to sync with Google and correct it there since trying to correct it in phone is awkward. When you try to delete a dash it also deletes the preceding number, so you have to delete it and re-enter that number (which is error prone and slow on a small touch screen - in fact if you have more than a handful of contacts it is unworkable). The only other way is to write an app to fix the number format. I found one that did just that but only to US number format. I also found the source but I don't have weeks to spend on a hobby project modifying someone else's code to fix a bug in the OS. So I caved and shared my data begrudgingly.
I accidentally shared my wife's data because I set her phone up while I was tired and picked the wrong option at setup (default is ticked to share data). Once done it was too late.
So yeah, please follow your own advice and stop spreading falsehood.
These posts express my own personal views, not those of my employer
Google Is Your Friend
citation needed :p
Never antropomorphize computers, they do not like that
Although I prefer Maemo since it seems to be the least soul sucking OS around, Android is also quite nice once you install a few odds and ends to clean up the advertising mess - though you need hardware that can be rooted. Applications like DroidGuard, AdAway, LBE Privacy Guard, or similar will put a halt to anything trying call home or get in your way.
Different lines of products. Mmmmm. How about, same products, aimed at different markets? Or, we could decide that Windows Home Edition is a different product than Windows Pro.
Automotive analogy would be the old Chevy Nova, Buick Skylark, and Oldsmobile Omega. The vehicles came down the same assembly line, bolted and welded together by the same people and same robots, had the same paint applied, used the same motors and transmissions, rearends, everything. The only differences were really cosmetic. A Nova got some thin carpeting, cheaper vinyl seats, and a bad bowtie. Buick got thicker carpeting, choices of better seats and stereo, and a Buick decal. Olds got even thicker carpeting, I think tinted windows were standard, a nicer speaker system for the stereo, and of course the Olds markings inside and out.
Now, for MARKETING PURPOSES, we can agree that all three vehicles were different products. But, when the car started making weird noises, and the mechanic told you that your discombobulator was percolating nanobots through the wazoo, you were equally fucked, and you bought your repair parts from the same manufacturer, at the same retail store.
The biggest difference between server editions and consumer editions are the rules put into place, in observance of security needs.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Last I checked, Cyanogenmod was made by Cyanogen and his crew. Cyanogen is employed by Samsung. All of them are well known in multiple places. They are most certainly not "anonymous hackers", you tool.
I would add that CyanogenMod has a "incognito mode" privacy feature. I would also add nothing really beats rooted Android with a short list of tweaks for privacy. It's also not as hard as you think, there's a lot of excellent work done by the modding community to make rooting relatively straightforward and a lot of the tweaks as simple as side-loading a simple app. It's pretty cool because it makes a lot of it quite of nerdy powerful things accessible to a wider range of people.
Dare I say the modding community for Android is awesome.
After logging in slashdot still does not take you back to the page you were on. It's been that way for 20 years.
.... because running a software made by "anonymous hackers" is much more safe than original OEM version.
Except a) the hackers aren't anonymous; the guy is well known and has just taken up a job with a phone manufacturer. b) The people who write for the big companies actually are anonymous and often don't even work directly for the big companies c) most of the privacy violations we see are motivated by commercial interests which is before we even get to d) the thing about Cygenomod is that the source code is out there
c) that I mentioned above is the most important thing though. According to reviews, Windows Phone has no native contacts data store. This essentially means that you end up using Facebook (or linkedin etc) for storing data. This is a simple commercial decision which compromises the user's security in order to push forward Microsoft's partnership with Facebook and against Google+. It's very key to understand, at this point, that Microsoft's investment in Skype and Facebook tells us that the company's entire attitude to personal computing and privacy has changed. They will now do whatever they can to make up for the lost years when they allowed their own users to do more or less as they pleased.
Simply put, to have any chance of privacy at all we need something which has at most limited influence from commercial develpers and must have no influence from Microsoft.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
I know this is hard to believe for most of you, but outside of your Moms' basements, the majority of users see these smartphone features and cloud services as a feature, not a security flaw.
More importantly, there is continuum of convenience and security. Most of the world thinks you lot here err on the side of security, which compromises user friendliness (hello, ever try to get an entire office to install their certs correctly?) in favor of security. Most users err on the side of convenience, at the risk of security. The correct choice depends on each user's individual needs and situation, and these one-size-fits-all corporate IT policies you all love around here aren't always very good for Average Joe.