Baidu for Windows and Android, leak Sensitive Data and GPS Coordinates

[Ink]

Full Report by Baidu's and Don'ts: Privacy and Security Issues in Baidu Browser - The Citizen Lab

Thousands of apps running Baidu code collect, leak personal data - research

"Thousands of apps running code built by Chinese Internet giant Baidu have collected and transmitted users' personal information to the company, much of it easily intercepted, researchers say.

The researchers at Canada-based Citizen Lab said they found the problems in an Android software development kit developed by Baidu. These affected Baidu's mobile browser and apps developed by Baidu and other firms using the same kit. Baidu's Windows browser was also affected, they said.

The unencrypted information that has been collected includes a user's location, search terms and website visits, JeffreyKnockel, chief researcher at Citizen Lab, told Reuters ahead of publication of the research on Wednesday.

The problem highlights how difficult it is for users to know just what data their phone collects and transmits, and the risk that personal data might leak because of poor or no encryption. It also highlights how many different groups might be interested in accessing such data.

"It's either shoddy design or it's surveillance by design,"said Citizen Lab director Ron Deibert.

Citizen Lab said Baidu - which reports quarterly earnings in New York on Thursday - had fixed some of the problems since it brought them to the company's attention in November, but the Android browser still sends sensitive data such as the device ID in an easily decryptable format.

Baidu told Reuters its interest in the data was just commercial, but declined to say who else might have access."

News Source: Thousands of apps running Baidu code collect, leak personal data - research

 

[kev216]

Why am I not shocked or surprised by this news? This is the reason why I avoid Baidu (and Qihoo, although not mentioned here) products.

 

[Rishi]

Everybody does this, some more some less, but users must be given a control on what they are willing to share and when or at least informed about it, and that data too should be encrypted properly unless it's as the article says - surveillance by design.Statistical data for commercial needs is understood(if you like the company you help it) but making it easy for any prying eyes is questionable.

 

[kev216]

Everybody does this, some more some less, but users must be given a control on what they are willing to share and when or at least informed about it, and that data too should be encrypted properly unless it's as the article says - surveillance by design.Statistical data for commercial needs is understood(if you like the company you help it) but making it easy for any prying eyes is questionable.

That's true, I can live with the fact that they do gather some statistical information, and lot's of companies does this. There is no problem with it as long as you say cleary that your company is only doing it for the improvements for the products. And that not everyone can look into these detailed information packages that easy.

Baidu told Reuters its interest in the data was just commercial, but declined to say who else might have access."

But instead of saying it's only for that purpose, they don't even confirm that nobody else has acces to the information. That says it all. And with that in mind they don't deserve the benefin of the doubt imho.

 

[Blackhawk]

Just another reason to stay away from Baidu, Qihoo, and ALL Chinese software. I am sorry, but those are my feelings. I would never buy into the notion that they are using any data collection to help improve their products.

 

[jamescv7]

Too bad, because of the fallacy called 'Argumentum Ad Homenem' even though Baidu suffered on the critical leak however its already been pin point other products especially the location based.

Yes there numerous reasons not to use their product considering their massive collecting of information for statistics but better not to mentioned a lot of reputable Chinese products.