Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

github.com

Post reply on HN
Print view View original

61–70 of 363 posts

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#61

Post by speedgoose »

artwork159 wrote: post #56
cyberlab wrote: post #51

Remember: some apps check for what apps are installed on the device, and if they see this installed they can deduce you're poisoning the well. Also if you want to research obfuscation and how it thwarts surveillance, check these: https://www.schneier.com/blog/archives/2019/11/obfuscation_a... https://www.science20.com/news_articles/obfuscation_how_to_h... https://www.theguardian.com/technology/2015/oct/24/obfuscati..…

If they saw this app installed, what might they actually do about me or my contact list?

I guess they may decide to not sell your data. Which is actually a good thing.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#62

Post by cyberlab »

artwork159 wrote: post #56
cyberlab wrote: post #51

Remember: some apps check for what apps are installed on the device, and if they see this installed they can deduce you're poisoning the well. Also if you want to research obfuscation and how it thwarts surveillance, check these: https://www.schneier.com/blog/archives/2019/11/obfuscation_a... https://www.science20.com/news_articles/obfuscation_how_to_h... https://www.theguardian.com/technology/2015/oct/24/obfuscati..…

If they saw this app installed, what might they actually do about me or my contact list?

They could just flag you as someone who poisoned the well and ignore you I suppose. Remember: bad actors go after low hanging fruit and tend to ignore privacy-aware folk and those doing anti-surveillance.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#63

Post by lanstin »

rsync wrote: post #53
otterley wrote: post #32

Recently Apple added a feature to iOS that allows you only to allow selected photos to be accessible by an app. This allows the user to respond positively to an access request, but allow the app to see only a subset (or zero) actual photos. It would be a very useful feature for Apple to do the same for contacts: the app would think it's getting access to your contacts, but would only actually receive a subset of them…

"Recently Apple added a feature to iOS that allows you only to allow selected photos to be accessible by an app." What we really need to see from Apple is a permissions index in the app store that allows me to inspect, and consider, the permissions that an app will request before installing that app . I shouldn't have to install the app (or do laborious research online) to discover what permissions it will attempt to…

All these permission choices should be invisible to the app. If I say no contacts the call should succeed but with a zero Len response. It shouldn’t be possible for apps to say you have to agree to this or I won’t run. I can run the software and as the root user control what data the software can use.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#64

Post by ianmcgowan »

jpmattia wrote: post #20

Not exactly on topic, but historical context maybe: Long ago (early 90s?) when it was guessed/assumed that intelligence agencies were scanning emails, emacs was still among the best ways to read and send email. So emacs provided a handy function to append a random list of "hot" words to each outgoing email in the signature, just to degrade the signal-to-noise of such surveillance. It's still there today, and you can…

That used to be the case on usenet too - people would put attention-grabbing words in .signature as "NSA Food" - to overwhelm the NSA data capture algos. It seemed like a futile gesture even at the time, but particularly poignant looking back from a post-Snowden world.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#65

Post by lanstin »

lanstin wrote: post #63
rsync wrote: post #53

Earlier quoted context omitted.

"Recently Apple added a feature to iOS that allows you only to allow selected photos to be accessible by an app." What we really need to see from Apple is a permissions index in the app store that allows me to inspect, and consider, the permissions that an app will request before installing that app . I shouldn't have to install the app (or do laborious research online) to discover what permissions it will attempt to…

All these permission choices should be invisible to the app. If I say no contacts the call should succeed but with a zero Len response. It shouldn’t be possible for apps to say you have to agree to this or I won’t run. I can run the software and as the root user control what data the software can use.

Or even as a a service fake data - feed fake location data and fake contact list. Full of 202-555-1234 type numbers. I always put fake data into web forms and it is a sign that I don’t truly own the phone that I can’t do the same for local software.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#66

Post by djrogers »

rsync wrote: post #53
otterley wrote: post #32

Recently Apple added a feature to iOS that allows you only to allow selected photos to be accessible by an app. This allows the user to respond positively to an access request, but allow the app to see only a subset (or zero) actual photos. It would be a very useful feature for Apple to do the same for contacts: the app would think it's getting access to your contacts, but would only actually receive a subset of them…

"Recently Apple added a feature to iOS that allows you only to allow selected photos to be accessible by an app." What we really need to see from Apple is a permissions index in the app store that allows me to inspect, and consider, the permissions that an app will request before installing that app . I shouldn't have to install the app (or do laborious research online) to discover what permissions it will attempt to…

> and which of them are required to function.

On the iOS App Store, none of the optional permissions can be required for an app to perform it's basic functions - that's a store policy, and it's generally well enforced. Obviously if your app's function is mapping, GPS can be required to use those features (but only at the user's discretion - ie while running or all the time, granular or coarse), but the app can't just refuse to launch without it.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#67

Post by rsync »

vmception wrote: post #37
rzzzt wrote: post #13

Earlier quoted context omitted.

It is like signing up with an e-mail +suffix for services, or the non-existent streets on digital maps; if you come across your fake contact elsewhere, you know that information has been shared.

it is trivial to strip suffixes off of aliased email addresses

"it is trivial to strip suffixes off of aliased email addresses ..."

This actually is not a bad point to make ... it would, in fact, be simple to strip +aliases but ... economically I don't think it makes any sense.

You'd have to have a high level decision maker dictating an engineering fix in order to increase email authenticity by ... .01% ?

... and that assumes that the "engineers" down the chain understand how '+' works in email to begin with and have somehow communicated that back up to management.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#68

Post by djrogers »

lanstin wrote: post #63
rsync wrote: post #53

Earlier quoted context omitted.

"Recently Apple added a feature to iOS that allows you only to allow selected photos to be accessible by an app." What we really need to see from Apple is a permissions index in the app store that allows me to inspect, and consider, the permissions that an app will request before installing that app . I shouldn't have to install the app (or do laborious research online) to discover what permissions it will attempt to…

All these permission choices should be invisible to the app. If I say no contacts the call should succeed but with a zero Len response. It shouldn’t be possible for apps to say you have to agree to this or I won’t run. I can run the software and as the root user control what data the software can use.

> It shouldn’t be possible for apps to say you have to agree to this or I won’t run.

It's not - that's a violation of the App Store TOS. That's also not what's happening here - you can use clubhouse without allowing contacts access, but you can't invite someone to the closed beta without allowing it.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#69

Post by djrogers »

cyberlab wrote: post #51

Remember: some apps check for what apps are installed on the device, and if they see this installed they can deduce you're poisoning the well. Also if you want to research obfuscation and how it thwarts surveillance, check these: https://www.schneier.com/blog/archives/2019/11/obfuscation_a... https://www.science20.com/news_articles/obfuscation_how_to_h... https://www.theguardian.com/technology/2015/oct/24/obfuscati..…

>> some apps check for what apps are installed on the device

I can't believe that's allowed by the OS - seems like a horrible policy.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#70

Post by gherkinnn »

bredren wrote: post #9

Clubhouse requires contact list in order to get invites, which are required to sign up right now. I get why they are doing this, and it caused me to share my contacts with them. However, I resented it and it put me immediately in a defensive posture with the product and company. There is no possible way to trust a company with your contact list and Apple should make it how Photos works now--where you can select which…

I did the same and I’m still annoyed at myself.

Clubhouse is pretty shit, really. So I sold my soul and got nothing in return.

Post reply on HN