Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Path uploads your entire iPhone address book to its servers

mclov.in

Post reply on HN
Print view View original

11–20 of 283 posts

Re: Path uploads your entire iPhone address book to its servers

#11

Post by rmc »

corywatilo wrote: post #2

This is actually nothing new. A lot of apps have been doing this for a very long time. However, it is one of the best kept secrets in our space. I kind of have a feeling no one talks about it because they don't want word to get out. Can you imagine the scandal if this made it on the front page of CNN or Drudge? Ever since I learned this was possible, I've been very careful about which apps I download, and actually ha…

This sort of behaviour is almost certainly illegal in the European Union. You may not store personal information unless you have a clear and legitimate reason to store it. If you affected by this, you should contact your local data protection office.

Re: Path uploads your entire iPhone address book to its servers

#13

Post by dsplittgerber »

corywatilo wrote: post #2

This is actually nothing new. A lot of apps have been doing this for a very long time. However, it is one of the best kept secrets in our space. I kind of have a feeling no one talks about it because they don't want word to get out. Can you imagine the scandal if this made it on the front page of CNN or Drudge? Ever since I learned this was possible, I've been very careful about which apps I download, and actually ha…

Which apps do that? Do you have a list? Can anything be done about the data after-the-fact?

Re: Path uploads your entire iPhone address book to its servers

#15

Post by brudgers »

From the Wikipedia entry [http://en.wikipedia.org/wiki/Path_%28social_network%29]:

"Contacts are suggested from among persons in a user's electronic address book, as well as people with whom the user is communicating by email."

It's been there for over a year. http://en.wikipedia.org/w/index.php?title=Path_%28social_net...

Re: Path uploads your entire iPhone address book to its servers

#16

Post by jonknee »

timjahn wrote: post #4
corywatilo wrote: post #2

This is actually nothing new. A lot of apps have been doing this for a very long time. However, it is one of the best kept secrets in our space. I kind of have a feeling no one talks about it because they don't want word to get out. Can you imagine the scandal if this made it on the front page of CNN or Drudge? Ever since I learned this was possible, I've been very careful about which apps I download, and actually ha…

If no explicit permission is given by the user, how is this practice not illegal?

Apple doesn't prompt the user to ask for permission when the APIs are used (like what happens with location), so this is the desired behavior. It's very simple:

https://developer.apple.com/library/ios/#documentation/Addre...

Re: Path uploads your entire iPhone address book to its servers

#17

Post by rmc »

trotsky wrote: post #9

Honest question: Isn't this within the kind of behavior that AppStore reviews are supposed to prevent, at least if there isn't an app specific functional explanation for it? Does Apple have a list of what kind of behavior like this is tolerated or does word just get out about what they don't reject?

Yes that's the offical line. There are numerous examples of bad behaviour going live though.

Re: Path uploads your entire iPhone address book to its servers

#18

Post by rmc »

brador wrote: post #8
corywatilo wrote: post #5

Earlier quoted context omitted.

Android asks for your permission on what information you want to give the app. iOS just simply gives it whatever it asks for, without asking you first.

Interesting. What else can an iOS app get access to without permission? location? browser history? other installed apps list? emails? notes? pics? vids? music list? podcast list? itunes username?

In theory, all iOS apps are supposed to be reviewed by Apple and not allowed if they do Bad Things™. Walled garden and all that.

In theory.

Re: Path uploads your entire iPhone address book to its servers

#19

Post by achille »

corywatilo wrote: post #2

This is actually nothing new. A lot of apps have been doing this for a very long time. However, it is one of the best kept secrets in our space. I kind of have a feeling no one talks about it because they don't want word to get out. Can you imagine the scandal if this made it on the front page of CNN or Drudge? Ever since I learned this was possible, I've been very careful about which apps I download, and actually ha…

This was news to me, so I went ahead and submitted a tip to both CNN and Drudge. I hope they pick it up.

Re: Path uploads your entire iPhone address book to its servers

#20

Post by reidmain »

brador wrote: post #8
corywatilo wrote: post #5

Earlier quoted context omitted.

Android asks for your permission on what information you want to give the app. iOS just simply gives it whatever it asks for, without asking you first.

Interesting. What else can an iOS app get access to without permission? location? browser history? other installed apps list? emails? notes? pics? vids? music list? podcast list? itunes username?

Location: Permission is asked for

Browser History: There is no way to communicate directly with what Mobile Safari stores.

Other installed apps list: Apps are sandboxed so it is impossible to know what else is installed. If you've developed one of the other apps you can share the same App ID which gives you access to the same storage space so you could create a flag to indicate one of your apps has been installed. Some apps respond to certain protocols so you can ask iOS if a given protocol will be handled and if it returns yes then you know the app is installed. Again because they are sandboxed you really can't do anything harmful and responding to the protocol only allows the other app to receive information, not expose it.

Emails: No, the only way you can do anything with email is prompt the user to compose an email.

Notes: Same as Mobile Safari.

Pics: You can display a popup to the user that asks them to select an image from their camera roll/iPhoto and if they select a photo you then get a reference to an object that represents the photo. You can't just search their camera roll.

EDIT: rbritton points out that with the AssetLibrary framework you can actually search through all pics/videos and for some reason it gives a location access prompt when you do. http://news.ycombinator.com/item?id=3563336

Vids: Same as pics.

Music List: You can get a list of every song in the users library without asking for permission:

Podcast list: Same as music list.

iTunes Username: To my knowledge there is no way to access this but I've never been asked to so I really haven't spent time looking. In theory because you can access the Address Book you could make a best guess at which contact is the user and then assume one of their emails is their iTunes username.

Post reply on HN