5

prey project tracks mobile devices and helps to find stolen devices.

Is it safe from privacy perspective? How can I know that it doesn't spy on me?

  • 1
    Can you define "safe" and "spy" ? Better requirements beget better answers. – Joshua Aslan Smith Sep 9 '14 at 16:57
  • I think even more important about if Prey company is spying (I don't think so) is: does not open a possible backdoor to our laptop/mobile? Prey allows to request info and also remove and send data. What happens if someone hacks this system? they will have access to everything from using our Prey. – Enrique Sep 28 '17 at 16:00
1

It depends.

Prey bases on a software installed onto the device which pings regularly a server owned by prey. Prey could misuse this regular connection to get an ip address - identity link. Its hard to get rid of this one (eg. by using tor), so nothing to blame prey here.

The apps are open-source, so you can check yourself that when you only allow a small subset of the app's features in the app, other rights the app got by the system won't get executed, at least that's my interpretation of "Prey isn’t doing anything weird while running on your device." (FAQ entry "What about my privacy?").

Standalone

You are on the safe side when you run in "prey standalone" mode. In this mode, you can set up an email address and password on the device, and let it send the report using that address in the case the prey server calls the device stolen. Worst prey could do is report the device as stolen in your name, and trigger a report, but you would be aware of it, and prey wouldn't get the data, as the mail comes directly to you.

Control panel

If you use the web based control panel, things are not as shiny. Even if prey writes:

Not even we can see the reports since each device gets its own unique key, which only you have access to.

Every device might have its own key, but when you use the control panel, even if prey stored these keys into the localstorage of the web browser (don't know if they do), they could modify the javascript of the site to send the keys (or the cleartext reports) to them. The only way this could be resolved is by adding an open source add-on that keeps the keys and doesn't expose the decrypted data to the website. It becomes even harder with the map. The tiles have to come from somewhere.

2

Prey is free, but for the app to work they have to have access to a lot of your information (TANSTAAFL)

Generally if an app is "free" its like any other "free" product on the internet in that they use your actions and track you to sell data about you. Prey may or may not be doing this but at the very least you should assume they track your actions as much as possible to improve their product (especially the paid version).

Looking at the app permissions page on in the google play listing reveals:

Version 1.1.3 can access: Identity

find accounts on the device

Contacts/Calendar

read your contacts

Location

approximate location (network-based)
precise location (GPS and network-based)

SMS

receive text messages (SMS)
send SMS messages
read your text messages (SMS or MMS)
edit your text messages (SMS or MMS)
receive text messages (MMS)

Photos/Media/Files

modify or delete the contents of your USB storage
test access to protected storage

Camera/Microphone

take pictures and videos

Wi-Fi connection information

view Wi-Fi connections

Device ID & call information

read phone status and identity

Other

interact with a device admin
receive data from Internet
change your audio settings
full network access
run at startup
view network connections
modify system settings
connect and disconnect from Wi-Fi
change network connectivity
prevent device from sleeping

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.