Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

ndss-symposium.org

Post reply on HN
Print view View original

51–60 of 206 posts

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#51

Post by anthropodie »

zibzab wrote: post #43
anthropodie wrote: post #33

I will criticize how Contacts are implemented on Android for this. For example, I don't want any person who I interact with once or twice a month to have access to my WhatsApp or any other social media app. But I can't do this in Android because once you add contact every damn app has access to that contact list. It's full access or no access if app uses permissions. I need something where I can label contacts to not…

That is not correct. In Android you have two ways of accessing most things: full access or use the system to access one entry. You should blame WhatsApp for not supporting the second method.

My point remains valid. If OS is handling contacts it should have some sort of control over what's getting shared. Theirs no point of providing alternate ways if an app can access full list of contacts.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#52

Post by ReptileMan »

qwertox wrote: post #24
walterbell wrote: post #2

Wire (from the creators of Skype) does not mandate a mobile phone number (SIM cards are tied to government identity in many countries). Only an email address is required to open a free account. Nor does Wire mandate upload of your phone's address book with personal social graph of contacts. Free for consumers with paid teams offering for enterprises, optional on-prem server. Open-source clients and server. Cross-devi…

Threema also does not require your phone number.

It requires payment - so google account or your paypal/credit card are on record.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#53

Post by h0h0h0h0111 »

furyg3 wrote: post #20
jannes wrote: post #13

Earlier quoted context omitted.

An alternative would be to make it similar to the iOS photo gallery permissions: When an app requests permission to all photos the user gets the option to share only a subset of photos with the app. (This subset can be different for each app.)

While I agree with you, the current way this functionality works is really terrible.

Agree - it's a great concept but seems to involve an inordinate number of clicks (touches?) all over the screen

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#54

Post by ThermalCube »

ReptileMan wrote: post #52
qwertox wrote: post #24

Earlier quoted context omitted.

Threema also does not require your phone number.

It requires payment - so google account or your paypal/credit card are on record.

You can pay by Wire transfer, MasterCard, Visa, PayPal or even Bitcoin[1] so there is at least one anonymous payment option available

1: https://shop.threema.ch/terms

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#55

Post by viraptor »

anthropodie wrote: post #51
zibzab wrote: post #43

Earlier quoted context omitted.

That is not correct. In Android you have two ways of accessing most things: full access or use the system to access one entry. You should blame WhatsApp for not supporting the second method.

My point remains valid. If OS is handling contacts it should have some sort of control over what's getting shared. Theirs no point of providing alternate ways if an app can access full list of contacts.

You need a migration path and backwards compatibility. They can't kill all the apps which used the old system.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#56

Post by zibzab »

anthropodie wrote: post #51
zibzab wrote: post #43

Earlier quoted context omitted.

That is not correct. In Android you have two ways of accessing most things: full access or use the system to access one entry. You should blame WhatsApp for not supporting the second method.

My point remains valid. If OS is handling contacts it should have some sort of control over what's getting shared. Theirs no point of providing alternate ways if an app can access full list of contacts.

That is a very odd take away.

The first method is good to have for apps you trust, and requires permission from the user.

https://developer.android.com/guide/topics/permissions/overv...

The second method is what you want with apps you don't yet fully trust or for some other reason don't want to give direct access to your contacts.

https://developer.android.com/training/permissions/evaluatin...

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#57

Post by itg »

Jonnax wrote: post #12

There needs to be two lists of contacts. One which I allow to be shared with apps And another which are my contacts I use with my dialer. People don't need their messenger apps knowing the phone number of their doctor

I don't know about other Android phones, but Samsung has a Secure Folder with a separate list of Contacts.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#58

Post by Andrew_nenakhov »

This scientifically-looking paper could have been written by Captain Obvious himself. It is beyond obvious that contact discovery in any major messenger or social network is facilitated by uploading all contacts from the user’s address book, with all the implied drawbacks.

If users' behaviour has shown us anything, it's that they love it. And for all the dangers of their privacy loss, they happily trade it for the convenience of finding the people they know.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#59

Post by qwertox »

ReptileMan wrote: post #52
qwertox wrote: post #24

Earlier quoted context omitted.

Threema also does not require your phone number.

It requires payment - so google account or your paypal/credit card are on record.

I forgot this fact. One could create a new Google account and buy a gift card.

In any case, doesn't this only link your personal data to the ownership of a Threema app usage license and not to the content (user ID) inside the app?

It's definitely different to entering your phone number into the app.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#60

Post by MattJ100 »

Andrew_nenakhov wrote: post #58

This scientifically-looking paper could have been written by Captain Obvious himself. It is beyond obvious that contact discovery in any major messenger or social network is facilitated by uploading all contacts from the user’s address book, with all the implied drawbacks. If users' behaviour has shown us anything, it's that they love it. And for all the dangers of their privacy loss, they happily trade it for the co…

"They love it" but they often aren't given the choice, nor are they fully aware of the consequences (I expect many would choose not to accept if the findings in this paper were presented to them in a clear understandable way).

The average person barely knows what a server is. They install e.g. WhatsApp on their phone, they are likely to think that the app on their phone is doing the work of telling them who else is on WhatsApp. They are not likely to think that their contact list is being scraped and uploaded and stored on someone else's computer in a warehouse, and then profiled for advertising purposes and then exposed to strangers via an API.

The average person may love the convenience, but the average person does not understand how it is implemented or the consequences of using such a service (as described in this paper).

Post reply on HN