Palm Pre Reports Your Location and Usage To Palm

[ksg]

From Slashdot: http://yro.slashdot.org/story/09/08/...Palm?art_pos=4
(Original source: http://kitenet.net/~joey/blog/entry/Palm_Pre_privacy/)

"It turns out the Pre periodically uploads detailed information about the user to Palm, including the names of installed apps, application usage (and crashes), as well as GPS coordinates. This, of course, is without user consent or control. The only way he found to disable the uploads was to modify system files."

I've been taking a closer look at the WebOS side of my Palm Pre tonight, and I noticed that it periodically uploads information to Palm, Inc.

The first thing sent is intended to be my GPS location. It's the same location I get if I open the map app on the Pre. Not very accurate in this case, but I've seen it be accurate enough to find my house before.

{ "errorCode": 0, "timestamp": 1249855555954.000000, "latitude": 36.594108, "longitude": -82.183260, "horizAccuracy": 2523, "heading": 0, "velocity": 0, "altitude": 0, "vertAccuracy": 0 }

Here they can tell every WebOS app I use, and for how long.

{ "appid": "com.palm.app.phone", "event": "close", "timestamp": 1250006362 }
{ "appid": "com.palm.app.messaging", "event": "launch", "timestamp": 1250006422 }
{ "appid": "com.palm.app.messaging", "event": "close", "timestamp": 1250006446 }

It sends the above info on a daily basis.

2009-08-10t09:15:10z upload /var/context/pending/1249895710-contextfile.gz.contextlog ok rdx-30681971
2009-08-11t09:15:10z upload /var/context/pending/1249982110-contextfile.gz.contextlog ok rdx-31306808

There is also some info that is recorded when a WebOS app crashes. Now, I've seen WebOS crash hard a time or two, but it turns out apps are crashing fairly frequently behind the scenes, and each such crash is logged and a system state snapshot taken. At least some of these are uploaded, though if things are crashing a whole lot it will be throttled.

2009-08-09T17:01:22Z upload /var/log/rdxd/pending/rdxd_log_59.tgz OK RDX-30246857
2009-08-09T17:05:36Z upload /var/log/rdxd/pending/rdxd_log_26.tgz OK RDX-30249465
2009-08-09T17:09:11Z upload /var/log/rdxd/pending/rdxd_log_56.tgz OK RDX-30252374
2009-08-09T17:11:46Z upload /var/log/rdxd/pending/rdxd_log_70.tgz OK RDX-30253958
2009-08-09T17:16:29Z upload /var/log/rdxd/pending/rdxd_log_67.tgz ERR_UPLOAD_THROTTLED_DAILY
2009-08-09T17:17:28Z upload /var/log/rdxd/pending/rdxd_log_51.tgz ERR_UPLOAD_THROTTLED_DAILY
2009-08-09T17:20:40Z upload /var/log/rdxd/pending/rdxd_log_21.tgz ERR_UPLOAD_THROTTLED_DAILY

Each tarball contains a kernel dmesg, syslog, a manifest.txt listing all installed ipkg packages (including third-party apps), a backtrace of the crash, a df (from which they can tell I'm using Debian on the phone), and ps -f output listing all processes owned by root (but not by joey).

The uploading is handled by uploadd, which reads /etc/uploadd.conf:

[SERVER=rdx]
RepositoryURL=https:///palmcsext/prefRequest?prefkey=APPLICATIONS,RDX_SRV
UploadURL=https:///palmcsext/RDFileReceiver

[SERVER=context]
RepositoryURL=https:///palmcsext/prefRequest?prefkey=APPLICATIONS,RDX_SRV
UploadURL=https:////palmcsext/RDFileReceiver

The "HOST" this is sent to via https is ps.palmws.com.

My approach to disable this, which may not stick across WebOS upgrades, was to comment out the 'exec' line in /etc/event.d/uploadd and reboot. However, then I noticed a contextupload process running. This is started by dbus, so the best way to disable it seems to be: rm /usr/bin/contextupload

BTW, since Palm has lawyers, they have a privacy policy, which covers their *** fairly well regarding all this, without going into details or making clear that the above data is being uploaded.

This is a HUGE invasion of privacy. Wow... just wow.

[conflipper]

how many people bought pre? how many people are being tracked? how exciting is new products

[Geekcop]

I can't wait to hear Palm's excuse. If I was ever thinking about getting a Pre, this would pretty well convince me not to.

[wesscoggin]

P.A.L.M. = Privacy Avoidance and Location Manager.....aka Big Brother EEK

[ksg]

Well, I can see Palm wanting debugging information on crashes. However:

1. Why do they need to know your EXACT location? How about the SID of the nearest cellular tower?

2. Why is there no option to opt out of debugging?

This really is inexcusable....

[sanmanc]

If you think of it your wireless carrier keeps records of your location all the time. A former peace officer here was recently convicted of insurance fraud when his wireless carrier provided police with the coordinates of his location within a half mile away from where his "stolen" vehicle was reported on fire three minutes later.

Here is the article for your viewing pleasure.

[info[]box1]

This new is disturbing, but not that big of a deal if you are the average Joe the plumber. Today in America there alot of under table things that breach our privacy.

I say if its in your nature to be do something you have no business doing, then the pre is not for you. Unless you plan to disable the unwanted feature from the pre.

I do think this is good info and thread, don't get me wrong. But this doesn't effect me in no ways. I'm the average joe the plumber that go to work, then home to my family. I vote for the feature to be removed never the less.

[Genjinaro]

Meh I could care less about that & still buy the thing. Hell thats just one thing you know is tracking you.

I'm sure Google could tell you my life story and where I've been (lattitude/Chrome), Microsoft could explain my work history, Yahoo could turnover all of my info over to the Chinese secret police, Sprint could tell you where I am & who I'm dating, ASUS could probably tell you what type of Pr0n I like and how often I see it, Starbucks knows how I like my latte and tell the baristas whom I never met before, Plantronics possibly knows what I did last summer etc.

Consented or not,
Trust me, its a losing battle keeping privacy... Take it on the chin guys.

[ayling68]

Wow it's like your widows pc hasn't been doing this for years if it get improvements made more power to them its not like palm is stalking you

[sanmanc]

This is posted at phonescoop.com:

Palm Issues Statement Over Palm Pre Privacy Concerns

Today, 5:21 PM by Eric M. Zeman
Today a report surfaced that accused webOS and the Palm Pre of sending end-user information -- including location data and what sort of applications were running -- back to Palm without end-user consent. In response, Palm issued the following statement: "Palm takes privacy very seriously, and offers users ways to turn data collecting services on and off. Our privacy policy is like many policies in the industry and includes very detailed language about potential scenarios in which we might use a customer's information, all toward a goal of offering a great user experience. For instance, when location based services are used, we collect their information to give them relevant local results in Google Maps. We appreciate the trust that users give us with their information, and have no intention to violate that trust." Palm did not say exactly how end users can opt out of these data-sharing services, nor did it fully explain why Palm would want to know which applications users have downloaded and are running.

from Palm