‘Phone and Messages app secretly send info to Google’

Google is accused in a new research paper of not communicating transparently about the data it collects with its Messages and Phone app. It concerns sensitive data and short messages could be deciphered, according to scientists.

Privacy in ‘Phone’ and ‘Messages’

The Phone and Messages app from Google are very popular and the apps are also preinstalled on many Android phones from Samsung, Motorola and Xiaomi, among others. A computer scientist named Douglas Leith of Trinity College, Ireland now argues that Google is not communicating correctly about the data the apps collect. He writes that in his paper.

According to Leith, telephone sends information about the caller and recipient to Google’s servers. The time and duration of the telephone conversation and the telephone numbers used are also part of the exchanged data.

Messaging sends the content of messages to Google’s so-called Clearcut logger and Firebase Analytics, two separate Google services. Text messages are sent as a so-called ‘SHA256 hash’, which means that the content is first encrypted. However, according to Leith, it is possible to decipher the hashes of short messages with the power of modern computers. Short messages are secured by Google with a simpler 128-bit code.

‘Not transparent’

The paper further states that Google only refers to these apps in the Play Store to its general privacy policy, which does not explain what these apps do with users’ data and what data they collect. You can’t download the information that the two apps send to Google with Google Takeout either.

However, Google does require other app developers to communicate transparently in the Play Store about the data that is collected, the researcher notes. Leith asks aloud whether the two apps are in accordance with European privacy rules or GDPR.

Google responds

Google has responded to Douglas Leith’s findings at The Register, partly explaining the different data the apps collect. In it, the company states that Messages collects hashes with the content of messages to more easily resolve errors in the app. And, according to Google, phone numbers are collected by the Phone app to make the RCS features work.

The apps each also send data to Firebase Analytics to better measure the effectiveness of advertising for the apps, according to Google. For example, Google checks whether the apps are only downloaded, or whether users actually use them.

According to a Google spokesperson, the company is also constructively working with Leith’s research team to address their feedback. In his paper, the researcher has come up with even more tips and improvements for the security and handling of user data in Messages and Telephone.

Previous criticism

Google has been criticized in the past about the way it collects data from Android users. For example, you can turn off the location on your phone, but your location will still be registered by Google. Google meanwhile made it possible for users to automatically delete data. It has also become easier to delete your search history and the company also wants to emphasize privacy features in Android 13.

Want to stay up to date with the latest Google apps news? Then download our Android app and follow us on Facebook, Instagram, YouTubeTelegram and Twitter†