Fake_contacts: Android app to create fake phone contacts, to do data-poisoning • Hacker News Board

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#161

Post by osamagirl69 » Sat, Feb 27, 2021, 7:15 PM UTC

Answerawake wrote: post #94

techsupporter wrote: post #76

Earlier quoted context omitted.

I've noticed a bunch of spammers starting to strip out anything after the + and before the @. This is why I've long used a catch-all e-mail domain (subdomain.example.net) where I can put anything I want to the left of the @ sign and no one is the wiser for my real e-mail address.

Is there some service where I can easily create unlimited custom email addresses for a flat monthly fee? I want to use a unique email for each new website/service. That would go a long way to solving some data leak/privacy problems. The problem with custom domain is I have to maintain it right? I want a service which I don't have to maintain. I used to use new Yahoo accounts but they are a hassle and recently they di…

You can do this with any email provider that supports a catchall. I personally use fastmail and have been very happy with it. You don't need to 'create' the accounts, you just set it up so that *@yourdomain.com goes to your catchall. When signing up for a new service, you pick a unique/random email. Then you know unambiguously where each email in your inbox came from.

I personally use the website as the email (example, if HN required an email it would be hn@mydomain.com) to make it easier to filter. But this can be gamed/guessed, to be more secure it is better to generate an actual random email for each site and store it in your password manager.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#162

Post by tonylemesmer » Sat, Feb 27, 2021, 7:15 PM UTC

post_break wrote: post #17

bredren wrote: post #9

Clubhouse requires contact list in order to get invites, which are required to sign up right now. I get why they are doing this, and it caused me to share my contacts with them. However, I resented it and it put me immediately in a defensive posture with the product and company. There is no possible way to trust a company with your contact list and Apple should make it how Photos works now--where you can select which…

I mean this is why they do it. You knew it was wrong, you knew they were going to take that data and mine it, and you still said sure.

That means that more than likely clubhouse have our details even if we have no desire to be part of it.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#163

Post by throwawei369 » Sat, Feb 27, 2021, 7:17 PM UTC

paulie_a wrote: post #105

Data poisoning needs to become a standard practice. Make the "valuable" ad data useless

Couldn't agree more. It's a far better approach as a cloaking technique. Reason I use privacy-possum addon on Firefox.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#164

Post by federona » Sat, Feb 27, 2021, 7:18 PM UTC

nbzso wrote: post #149

All the shady data schemes and dark patterns in todays idea of software business motivated me to look to my phone as an enemy and using the web cautiously all the time. Actually the idea of hyperconnected future in which 24/7 monitoring of the individuals will be normalised and mandatory makes me cringe. The Internet from force of good is turning to dystopian toolchain by the hour. And all is because we as society ca…

Society, current society also called capitalism, is designed not for greed but constant growth. When your goal is not satisfaction but constant growth and you already are a billion dollar company, then it makes you look at all the shady shit you can still do and get away with in order to grow. These companies don't need to grow, if anything they actually should be growing smaller and sustainable if we actually wanted to engineer towards goodness rather than money. The fact that the rich are getting richer while having absolutely no need for it says to me our prerogatives are wrong and our engineering about business is wrong. A lot of the common laws rules and norms around which business is built are insane.

That is to say that if the economy is a mirror of nature, then businesses should be engineered to die. Not to be a going concern forever. After a certain amount of profit is extracted and life is lived, into the grave they should go. Not just as a result of competition, but as a result of system design.

This would then lead to a more evolutionary world and better distribution of power and resources rather than continuous monopolizing and consolidation. Also a different mentality of you can't take it with you to the grave, rather than infinite mindset. It would be a cyclical mindset about finite things, not infinite things. Corporations want to be people, so engineer them like people and less like machines.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#165

Post by shervinafshar » Sat, Feb 27, 2021, 7:19 PM UTC

remram wrote: post #142

shervinafshar wrote: post #106

Earlier quoted context omitted.

Not an expert on guerilla cyber-warfare, but isn't it the whole point of this sort of poisoning? If enough people do this the cost of those bouncing emails would become prohibitive. That's my speculation. Would be great to know more from someone who knows the domain better.

Even if you make your contact list 99% bounces and 1% real (and every user of the app does the same), I don't see how this becomes a problem for the app's operator. Remove a contact after 1-2 bounces and you're golden.

Fair. Still golden if this needs to be done for all contacts of all users?

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#166

Post by shervinafshar » Sat, Feb 27, 2021, 7:20 PM UTC

cyral wrote: post #160

crazygringo wrote: post #90

I don't see what the point is. "Data poisoning" gives companies a bunch of fake contacts... on top of all your real ones? Who cares? So they send some e-mails to addresses that don't exist or something? So it takes up an extra 1% of disk space in their database? If you could share an empty address book then that would actually preserve the privacy of your contacts. But this doesn't do that. I don't get it.

It will be interesting to see if these fake contacts show up in a leak somewhere someday. Almost like how people do myname+yourcompany@gmail.com, we could create similarly fake contacts to see who is selling or leaking data.

*@myname.name

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#167

Post by tchalla » Sat, Feb 27, 2021, 7:21 PM UTC

Waterluvian wrote: post #21

Apps using contacts is a $#%$ing anxiety attack for me. The scum companies don't care. They just want more leads. But for me, it's this fear that they're going to spam my exes and old roommates and bosses and professors and landlords and everyone who ends up added to my contacts. Signal did that to me last week. This person I'm not on speaking terms with got Signal and it added us and announced to each other we were…

Does Signal share contacts the same way others like WhatsApp does?

https://signal.org/blog/private-contact-discovery/

> Signal clients will be able to efficiently and scalably determine whether the contacts in their address book are Signal users without revealing the contacts in their address book to the Signal service.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#168

Post by csommers » Sat, Feb 27, 2021, 7:21 PM UTC

jtsiskin wrote: post #121

koboll wrote: post #97

Earlier quoted context omitted.

Huh, so Clubhouse is explicitly breaking Apple's rules. Surely Apple knows this, but is allowing it because... it's mega-popular? What's the point of having rules if clawing your way to popularity by leveraging their violation is deemed permissible?

How are they breaking the rules? It seems like they are using it for the same purpose they prompt permissions for.

They create ghost profiles for those contacts, just in case that user ever signs up. That’s fucking garbage and they should be ashamed of doing that, let alone immediately removed from the App Store.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#169

Post by forgotmypw17 » Sat, Feb 27, 2021, 7:21 PM UTC

kzrdude wrote: post #126

post_break wrote: post #17

Earlier quoted context omitted.

I mean this is why they do it. You knew it was wrong, you knew they were going to take that data and mine it, and you still said sure.

They do it because all the successful social apps need to make contact discovery easy. The ones that don't use this trick - ethical - we don't hear so much about, maybe they don't succeed.

There are quite a few that have not done it. I don't think it's necessary for success at all.

HN seems to be doing pretty well, and it's never done this sort of thing, as far as I know.

Reddit never did it during their growth phase, instead they provided their own seed content.

Metafilter has never done anything unethical to my knowledge.

There are many, many successful social networks which have not performed unethical contact harvesting and other shady things.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#170

Post by Aerroon » Sat, Feb 27, 2021, 7:24 PM UTC

_jal wrote: post #100

bredren wrote: post #9

Clubhouse requires contact list in order to get invites, which are required to sign up right now. I get why they are doing this, and it caused me to share my contacts with them. However, I resented it and it put me immediately in a defensive posture with the product and company. There is no possible way to trust a company with your contact list and Apple should make it how Photos works now--where you can select which…

Clubhouse can bite me. I refuse to use tooling from shitbags who try to exort me into compromising others' privacy for shiny toys. I know other shops do it, as if that makes it OK.

I remember signing up for Facebook back in the day. They tried to get me to share something about my email contacts list. That just made me not use Facebook instead. Unfortunately, everyone else didn't seem to have a problem with it.