Spyware app turns the privacy tables on Google Glass wearers | Hacker News Reader

Spyware app turns the privacy tables on Google Glass wearers

nakedsecurity.sophos.com

38 pointsBrandonMarc48 comments

I think my preferred solution is to not hang out with anyone who uses google glass, ever. Come to think of it, this was my attitude before any spyware came out for it.

> the app takes a photo every 10 seconds when the display is off

> The app can also access the internet from the user's Glass connection to upload the images to a server.

Isn't that basically what lifeloggers want?

Don't forget the voyeurs...

With the changing attitudes toward privacy, I wouldn't be surprised if in a few decades you would be considered stupid/crazy/insane to not have a Glass-like device recording your life. with which you could easily find out e.g. what you did, where you put something, etc. Reviewing what you did during the past few days could definitely be a beneficial thing.

(And personally, I don't have a problem with being recorded in public. I value privacy, but that's privacy in private places, not out in public.)

You guys need to watch Black Mirror.

Hahaha, just posted about it above (or below?) :-))

It would be nice if glass came with a physical cover attached that can be slid over the camera lens. Thus, you could have the lens normally covered and still use the glass without others being uncomfortable. As long as the cover became a widely recognized symbol, it could allow for social cues to develop separately around wearing "blind" glass vs regular glass.

The physical cover would of course also prevent this type of malware.

The comprehensive solution to this issue (as we, the researchers mentioned in the article, see it) should be a combination of API safeguards and to have a hardwired "recording" light on Glass.

The API checks would prevent what we were able to do in Malnotes, and the "recording" light would work much like webcams currently do.

A more technical discussion of what we were able to exploit is on Ars Technica in the comments (skip past the trolls). http://arstechnica.com/security/2014/03/google-glass-spyware...

I agree that a "recording" light would be a great idea, but that will really only protect against malware, not against people who are intentionally trying to surreptitiously take pictures. The reason being that anyone with direct hardware access to the device can find a way to disable the light.

I think a recording light could be defeated by a tiny dot of suitably-colored opaque pigment dabbed onto the recording light. I prefer the earlier poster's thought of a sliding, readily visible lens cover.

The lens cover would defeat the whole purpose of having an at an instant camera. You may as well pull your cell phone out of your pocket if you have to fumble with removing a lens cover while you're wearing Glass. I understand why people are concerned, but I still believe through my own experience, that the issue is gratefully overblown.

How would anyone other than the Glass user know that the cover is actually obstructing?

I mean, a person could fashion a "cover" that functions as a one-way mirror does, no?

It would a) have to be a first-party cover (preferably by Google) b) have some symbols that indicate 'not recording', c) easy to demonstrate to nearby folks what it's function is (i.e., by removing it and putting it back on).

If Google pushed this and marketed it, it'd really take the edge off the privacy concerns about Glass (I'd still not buy one but I wouldn't necessarily force a wearer to put them away before entering my house).

Relying on your userbase to "not be glass holes" is a recipe for backlash, even against those who "use responsibly".

Yes, but that's still about as much effort as it would take me to hide a spy-cam on my person.

At some point you just have to go out on a limb and hope that everyone you know or meet isn't actively trying to invade your privacy.

You must be new to the internet.

Internet != Real Life. If you operate in Real Life under the assumption that everyone you pass on the street or give money to at the coffee shop is desperate to invade your privacy, you're gonna have a hard time.

But with the tech available today mixed with the behaviors of people online/offline, we can and have been passively invading others (perceived) privacy, even our own.

To give a more specific view on how bad this could evolve, please take a look at Episode 3 of Season 1 of the amazing mini-series "Black Mirror"[1].

That said. I expect computer security and privacy to be taken extremely seriously in the years as we proceed in the internet of things where our lives will be televised. Really, escaping will be virtually impossible, so we need to make sure that some breaches are severely punishable.

Technology is tool, the more powerful the tool the more good or damage can do.

[1] http://en.wikipedia.org/wiki/List_of_Black_Mirror_episodes#S...

"Google's initial response to hearing of Lady and Paterson's app was to threaten the researchers for violating the Glass developer terms."

To think I use to root heavily for Google. :(

They contacted us later and were very conciliatory about the person who was a bit heavy-handed in his communications. They really haven't been aggressive beyond that one guy who probably didn't have the authority to speak for Google. I was worried at first too, but they are handling the situation a lo t better.

At the time of the first contact, did they understand you were researchers? I would certainly hope they went after malware authors in general with guns blazing to protect users in their ecosystem, but threatening legal action against legitimate researchers has a chilling effect.

I'm not entirely sure (because it was our professor who had the initial contact over Twitter) if it was clear that it was for research even though our prof. said "two of my students" in his original tweet. Once he cleared that up, someone hirer up got back to us with an apology for whoever wrote to my prof. initially. Still pretty crappy, but I think the person from the initial contact wasn't representative of Google's attitude about it.

This whole paranoia about Glass reminds me of those people who act like smartphones are only for calling/texting. "Why are you bringing your phone? Who are you going to need to call today?" Nobody, but I might want to get directions, or research something on Wikipedia, or check my to-do list, or listen to music, or...

The camera is the least interesting thing about Glass. Stop acting like it's a single-purpose surveillance machine.

Nobody is acting like it's a single-purpose surveillance machine. People are claiming that one of its features can be used in a way that they find unsettling. You can argue that it can't be used in that way, or that it shouldn't be unsettling, or that it's so useful that it doesn't matter if it's unsettling, but you shouldn't act like people who disagree with you just aren't thinking straight or aware of what they're talking about.

> Nobody is acting like it's a single-purpose surveillance machine.

The top comment in this thread right now explicitly advocates shunning anyone wearing Glass in any circumstances, regardless of what they're doing with it. That's absurdly paranoid.

And yet, that still doesn't mean anyone is acting like it only has a single purpose, but rather that they dislike one of its purposes strongly enough to dislike the whole thing. It's ok to argue that the point of view is unreasonable, but not to be willfully ignorant or just dishonest about what their point of view actually is. If you said "but it does all these other great things!", they would say "I don't care, I still hate it", not "oh, I didn't realize that, I like it now".

Also, you can't actually tell what someone is doing with it, so complete shunning is the only way to be sure you aren't being recorded. Some people don't like being recorded at all, and most people don't like being recorded surreptitiously. These really aren't absurd or paranoid preferences.

If you're paranoid enough to think that anyone wearing Glass might be not only recording you but also painting over the active-camera light and lying to you about it, then I don't understand why you're not also worried about everyone on the street having buttonhole spycams in their lapels. Surely our hypothetical lying spy would prefer something less obtrusive.

If anyone says that to somebody about their phone, they're clearly not actually mystified as to why someone would have their phone with them in that context. They're much more likely just annoyed by that person's lack of phone etiquette and wishing they would've left it behind.

Which is actually a great parallel with Glass- there are no shortage of people with totally legitimate privacy concerns, etc., but I think much of the driving force behind anti-Glass sentiment is humanity collectively sighing, rolling their eyes, and saying, "can we all agree that this is not going to become a thing? Please? Please don't let this become something that is considered socially acceptable because we really don't want to live in that world."

I'm sure we all know people who treat their phone like a pacifier and are always screwing around with it at meetings, social occasions, etc. Do it a little, and that's fine, do it too much and it can quickly become one of the most annoying habits a person can have. Glass, as it is being presented at least, seems like something that would allow That Guy to be even more annoying to deal with, and it would be all the time- not just when he whips out his phone. It might lead to there being many, many more That Guys in the world, and it would grant them the ability to be That Guy 24/7/365.25.

The camera is the most worrisome thing about Glass, and it can potentially force me into participating without my knowledge much more easily than a phone or camera. It's an issue.

I'm not at all interested in Glass, but this issue has caused me to think about how I'll react and interact with a Glass user. I never had to think about that with phones or cameras.

And by the way, this conversation has me thinking about those unfortunate retail workers who have to wear those earbud/microphones, so that they can be re-purposed at a moment's notice. If they wore Glass there would be a backlash.

But it wouldn't be obvious at all if their mics were recording you, and you could easily be simultaneously video recorded by "security" cams in the store. With enough AI and FR, the cameras could automatically focus on whoever the employee was talking to, or even record ambient conversations and connect that to travel so far within the store. "For training purposes."

1. I don't see how you participate much more easily without your knowledge. Phones are everywhere, record video, audio, etc. You think because it's not pointed at you on someone's face you aren't participating?

2. You don't think retail stores are already doing this anyway with their security cameras?

Google search for "Retail store video analytics".

(http://blog.nrf.com/2013/06/13/how-retailers-can-drive-perfo... for example, has some real life examples of what various stores are doing)

They don't make any pretense that it's for training purposes.

I guess i'm here to break it to you that you are already participating without your knowledge, everywhere, glass or not.

The only difference is that glass gives you some inkling it is happening.

> I guess i'm here to break it to you that you are already participating without your knowledge, everywhere, glass or not.

Thanks, I'm aware. I have the right to resist.

I was at Sharper Image the other day, and they had a pen that took video. You could clip it in a shirt pocket and nobody would ever notice. Why people are freaking about Glass, I just don't get.

Why people are freaking about Glass, I just don't get.

Because there is a difference between a technology being relatively obscure, because a lot of people find it creepy and socially unacceptable, and the same kind of technology being more widely adopted by the general public because it's piggybacking on something else, apparently without any real privacy safeguards to prevent abuse whatever Google might have liked to happen, and in addition automatically uploading footage to the mothership with or without the knowledge of its owner in approximately real time.

As with much of the modern privacy debate, matters of scale, connectivity and the erosion of anonymity/obscurity make a much bigger difference in practice than traditional distinctions between public and private locations.

Stop pointing a camera at me, then.

When phones started having cameras, it was basically the same thing "oh my god now people are going to take pictures of everyone everywhere! good bye privacy!"

The difference is that a phone has to be taken out of one's pocket or bag and quite visibly pointed at something, whereas Glass is always looking wherever the wearer is.

It is and it isn't. Glass is always available, but unlike using a cellphone it isn't necessarily as discrete. If I'm taking a picture of a subject with Glass, there is a body language with how you position your head that you are taking a picture or recording. Plus, you are wearing this apparatus on your head that already draws some attention. You really can't be discrete.

Furthermore, because you can't easily frame your shot as you can with a cell phone or conventional camera, the field of vision is significantly wider. It really makes for a crummy spy cam.

I really do understand why people are concerned, but I believe that if there were more Explorers, it would diffuse the perceived problem. I just finished shooting pool in an APA match and I recorded each of my shots. This has been a fantastic way for me to use the camera in Glass. I also demonstrated lots of other features to those that asked, and the camera faded to the background as a nice to have capability, but it isn't what defines Glass for most of the people I talk with.

I think my experience with taking photos with Glass closely follows how frequently I use the camera on my phone. I take photos, but the camera capability isn't why I choose a particular phone. I now take significantly more photos with Glass, but they are usually at the pool hall during my match. If you ignore that outlier, my photo taking frequency is probably about the same, but I enjoy the experience more because Glass is out of the way and secondary to what is going on around me.

I honestly believe that how you use Glass is a reflection on who you are already. If you want to secretly take pictures using your sunglasses, there are plenty of sources online to buy a pair that are cheaper and less obvious. If you are getting Glass only for the camera, the novelty will wear off quickly.

That was interesting to read, especially the insight into altered body language - thanks for the personal perspective.

Thinking of http://xkcd.com/1235/ , this will be an interesting future for sure...

Well that's also why in some places the cameras must make a noise when they take a picture. (I'm sure there's ways around it, but there are ways to get around pretty much anything)

You can also disable the camera light on the glass with about $0.10 worth of black paint.

There's no light on Glass, just the display

That is some very expensive paint.

You're really paying for the packaging

Thanks for the shout-out, OP. Great to see our work starting a conversation!

> Malnotes

Clever.

We have so much regret about that name...

I was instantly delighted with the name, it strikes me as open and responsible, which is exactly how security researchers should appear.

Reply on news.ycombinator.com