....from: http://arstechnica.com/security/2013/07/does-nsa-know-your-wifi-password-and...
Does NSA know your Wi-Fi password? Android backups may give it to them EFF technologist says "back up my data" exposes users' data to government spies. by Sean Gallagherhttp://arstechnica.com/author/sean-gallagher/ - July 17 2013, 11:55am CDT [cid:7EADC2E1-0230-4F2B-AFFF-1E4A986C5838] On by default on most newer Android devices, Google's Android backup stores your personal details in plaintext.
If you’re using Google’s “back up my data” feature for Android, the passwords to the Wi-Fi networks you access from your smartphone or tablet are available in plaintexthttps://code.google.com/p/android/issues/detail?id=57560 to anyone with access to the data. And as a bug report submitted by an employee of the Electronic Frontier Foundation (EFF) on July 12 suggests, that leaves them wide open to harvesting by agencies like the NSA or the FBI.
“The ‘Back up my data’ option in Android is very convenient,” wrote Micah Lee, staff technologist at the EFF. “However, it means sending a lot of private information, including passwords, in plaintext to Google. This information is vulnerable to government requests for data.”
The Backup Managerhttps://play.google.com/store/apps/details?id=com.backup.manager&hl=en app stores Android device settings in Google’s cloud, associated with the user account paired with the device; the Backup Manager interface is part of the core Android application APIhttp://developer.android.com/reference/android/app/backup/BackupManager.html as well, so it can be used by other Android apps. Backup is turned on by default for Nexus devices and can push data such as MMS and SMS messages, browser bookmarks, call logs, and system settings—including Wi-Fi passwords—to Google’s cloud for retrieval in the event that a device is broken, lost, or stolen.
“Since backup and restore is such a useful feature, and since it's turned on by default,” wrote Lee, “it's likely that the vast majority of Android users are syncing this data with their Google accounts. Because Android is so popular, it's likely that Google has plaintext Wi-Fi passwords for the majority of password-protected Wi-Fi networks in the world.”
Most of those Wi-Fi networks have been mapped by Google as wellhttp://arstechnica.com/tech-policy/2010/04/google-talks-street-view-wifi-collection-details/. So it would be relatively trivial for an organization with access to backup data to match Wi-Fi network names and passwords with geolocation data. The result would be a partial map of where the targeted user has been as well as access to the networks his or her device has connected to in its travels.
Lee suggested that an easy fix to this privacy hole would be to encrypt the content of backups with a user’s Google credentials or a separate sync password. “I don't think it's rational to expect users to trust Google with their plaintext passwords when Google can be compelled to give this data to the US government when they request it,” he added
Wayne Billing Classroom Technology Support Audio Visual and Classroom Technology Support 130 Machray Hall Building 204-474-6649 204-807-3153 (cell) 204-474-7625 (fax) Wayne.Billing@umanitoba.camailto:Wayne.Billing@umanitoba.ca
