Google account and privacy concerns

How much easier it would be if we would be able to access information without sharing anything. We would have much less privacy concerns. And we would use any site and any application knowing that nothing will be unveiled without our permission.

Talkatone is a social application and uses google credentials to let you login, pull your friends, make calls and chats. And many of our users are concerned how we use their google username and password.

We want to deliver a clear message which should not confuse, but help to understand details.
In short, we DO NOT collect any usernames or passwords on our servers and we DO NOT share them from Talkatone app. They only used to communicate with Google servers over secured connection.

First of all there is Apple Application EULA. It clearly says:

b. Consent to Use of Data: You agree that Application Provider may collect and use technical data and related information, including but not limited to technical information about Your device, system and application software, and peripherals, that is gathered periodically to facilitate the provision of software updates, product support and other services to You (if any) related to the Licensed Application. Application Provider may use this information, as long as it is in a form that does not personally identify You, to improve its products or to provide services or technologies to You.

According to this chapter in EULA our application MUST NOT collect anything which can help us to identify users and clearly usernames/password are not allowed. We DO comply with Apple’s terms. Otherwise our application will not be approved and will be removed from the Apple store. We established very open communication with Apple app review team and always ask for their advice when something is not clear.

Second, Google Talk APIs require the client to login directly to their servers using XMPP protocol. Here’s how the how flow works:

  1. Talkatone establishes insecure connection to talk.google.com
  2. Google Server immediately asks to upgrade connection to TLSv1 (aka SSLv4)
  3. Talkatone upgrades connection to TLS as demanded by Google.
  4. Talkatone transmit your username/password directly to Google for authentication over secured connection.
  5. Google accepts or rejects the password.

Third, in order to make subsequent calls to google both username and password are stored together locally on your iPhone/iPod with the rest of the settings. iOS guarantees that no other app can access settings (e.g. no app can read/write files outside of installation directory). Please be careful with “jailbroken” devices, as app installed from “Cydia” may have “root” permissions to read everything.

Please note, at this time Google Talk does not offer OAuth authentication method, it requires plain text username/password over secure connection. You may experience the same behavior with native iOS email app when you setup your GMail account.

Keep in mind that whenever you use Talkatone your username/password pair is never sent open! Also whenever possible communication between Talkatone and Google servers is secured and use TLSv1 (aka SSLv4).  Ex. upcoming Talkatone v0.9.3 will support retrieving Google Voice history which will establish HTTPS connection to Google Voice server and will perform authentication over it using username/password already stored in your device.

If you still have concerns please DO contact our support. We’ll be happy to answer your questions.

Update: As of v1.2 we do offer optional

About talkatone
Talkatone marketing

18 Responses to Google account and privacy concerns

  1. Rob says:

    Thanks for this post, I found out about this app and it looked intriguing. However, I had some big privacy concerns, especially considering some of the shady (intentionally or not) things other apps do with your information/data. I hope you guys keep things secure and make privacy your utmost priority.

    • talkatone says:

      Rob, we take privacy issues very seriously. There are several reasons, but the most important one – we simply want to sleep well.
      We follow all security recommendations and requirements from Apple, Google and other companies. If things are shady, we prefer to stay on a safe side and don’t explore opportunities which potentially can hurt users. Thus said DO let us know (via any channel, blog, twitter, facebook, email) if you notice something unusual or questionable.

  2. Rob says:

    I will keep looking online for other comments or concerns people may have about this with your app

  3. Z says:

    I found out about this app on lifehacker. I started to use it and didn’t even think twice about entering my login info to use it until I read comments to the post on that site. Thanks for this information to clear things up!

  4. Security Question says:

    I just want to verify that _all_ data is passed over SSL. I am primarily concerned about the conversation being monitored by the ISP. Will the Talkatone app use the VPN or proxy setting from the iPhone?
    Thanks.

    • talkatone says:

      1. Talkatone will NOT use proxy settings from iPhone because the connections established are NOT http. (Http is used, but not for primary request).

      2. During establishing chat connection, first thing Google server does is sends “startTls” command (in place upgrade of insecure connection to TLSv1). Talkatone upgrades connection to TLS and then sends the password.

      3. All chat and signaling data is sent over secure connection.

      4. In-call audio is sent over plain UDP non-encrypted connection (this is the case with most of the VoIP).

  5. Peace Nepal says:

    Does talkatone access (or has ability to access ) only Google Chat or gmail too? My privacy concern here is about my emails and other data being accessed by talkatone. Could you clear this?

    • talkatone says:

      1. Google Chat is part of Gmail.
      2. To receive SMS notifications Talkatone subscribes to monitor certain incoming email messages (specifically messages containing the word “SMS” in the subject). Talkatone does not look through past email conversations.
      3. We also do access Google Voice account to retrieve certain account settings, list of calls and SMS message content.

  6. Security Question says:

    Hi!

    As you mention, for Android, battery saving mode is the default. Have a few queries regarding the same:

    1. Given that in this mode your servers contact google on my behalf, this means you store my username and password in your servers. Are these saved in encrypted format? I hope so and that too a good one but pls confirm, or are they not stored at all in which case how do you maintain continuous contact with google?

    2. How long after I logout doe these remain stored on your servers? Is it forever or do they get deleted immediately?

    Thanks.

    • talkatone says:

      1. The passwords are kept in the memory and encrypted (never written to disk) for the duration of connection.

      2. When connection to device terminated gracefully – passwords are released immediately (garbage collector will nuke them in couple seconds), when connection is lost abruptly (leaving WiFi coverage area) the connection will be kept alive for the “Keep Alive” interval duration (configured in Connection settings in Talkatone – default value is 5 minutes) and then released to garbage collector.

      p.s. we are closing your support inquiry with “no response” as we really doubt you provided real email address. It’s always good idea to provide real email address in the support ticket if you are interested in receiving response to your inquiry.

      • Security Question says:

        Thanks, you are talking about the server side processes here on your computers? And not the talkatone app process on my device right?

        I typically keep talkatone running continuously, and it has been for the past few days so that means that in all this time my login and pw have never been stored on your server side? And will not be after logout as well I presume?

        You can close the ticket thanks, should have not raised it as I can ask the questions here, apologies for that. Thanks.

      • talkatone says:

        Yes, we are talking about servers. During that time username/password was in memory on our computers and password was never written to disk.

        So basically within upto 10 minutes of disconnect – your password will be gone from our servers.

  7. Security Question says:

    Thanks, for what it’s worth this is a great app and makes having google voice worthwhile. Am unsure why google did not create anything like this in their app. Keep up the good work.

    One last query, through all this process of logging in, keeping connection alive and finally logging out once in a while over multiple days or weeks, is the password ever in plain text form in the device app or servers or over the air? Thanks.

    • talkatone says:

      We use SSL-encrypted connection between device and server (we have 2048 bit certificate, while for example Google is using 1024 bit, which makes over-the air transmission to talkatone servers more secure than directly to Google in some way).

      On the device it’s kept in plain text form. So we strongly advise against rooting/jailbreaking of the devices (when you root/jailbreak device you are allowing some apps to run as super-user and to have complete/unrestricted access to all information stored on the device. And it doesn’t matter if that information is encrypted – the decryption key is stored on the same device somewhere anyway).

  8. Chris Cotner says:

    I just want to clear up Google access because Google sent me a warning email stating access occurred on Sunday, September 9, 2012 2:52:51 AM GMT, IP Address: 173.249.152.50 (getbetterhosting.com), but I stopped using app at 10pm the night before. Why the access 5 hours later when userid/pw retention in memory is only 10 minutes?

    • talkatone says:

      Chris,

      To clarify: retention policy on username is immediate cleanup upon our detection of client disconnect.

      E.g. if Talkatone on your phone keeps connection to server (to receive calls and texts) – our servers will keep connections to Google. As long as our servers detect disconnect they remove username.

      Detection of disconnect is done through several ways, but in worst case scenario we should detect it no later than 10 minutes after actual disconnect had happened.

      Note: we are working on push notifications and in that mode connections will be lingering for longer. Much longer.

  9. yash says:

    Is getbetterhosting.com a valid domain for access of Talkatone? I got a message from google saying there was suspicious activity from the ip address 173.249.152.50

Follow

Get every new post delivered to your Inbox.

Join 233 other followers

%d bloggers like this: