Google's 'back up my data' feature for Android could be providing users' Wi-Fi passwords to the likes of US National Security Agency (NSA) and the FBI, the Electronic Frontier Foundation (EFF) has warned.
A bug report posted by the consumer and civil rights group suggests that given Google is required to hand over data when requested, and the fact that the 'back up my data' option stores the passwords in plain text means that, if the authorities come calling, Google is obliged to hand over its users' network passwords.
Further reading H4cked Off: Prism, death and taxes ICO threatens Google with fine over privacy policy Google does not need to delete data, says EU legal bigwig
"The 'back up my data' option in Android is very convenient. However it means sending a lot of private information, including passwords, in plaintext to Google. This information is vulnerable to government requests for data," wrote the EFF's Micah Lee in the blog.
"Since backup and restore is such a useful feature, and since it's turned on by default, it's likely that the vast majority of Android users are syncing this data with their Google accounts. Because Android is so popular, it's likely that Google has plaintext Wi-Fi passwords for the majority of password-protected Wi-Fi networks in the world," he added.
Lee suggests that this privacy loophole could easily be closed by Google if the 'back up my data' feature encrypted passwords or stored them separately. He also warned Android users against trusting Google with the data in the format it is currently stored.
"While using Android requires a certain amount of trusting Google, I don't think it's rational to expect users to trust Google with their plaintext passwords when Google can be compelled to give this data to the US government when they request it," said Lee.
The EFF recently praised Yahoo for standing up for its user's data privacy.
