21–30 of 283 posts
I think this is Apple's problem really. Path is just one of many apps that probably do this without asking you. Ideally the OS should prompt you if an app wants access to your address book, just like it does for location.
Earlier quoted context omitted.
Android asks for your permission on what information you want to give the app. iOS just simply gives it whatever it asks for, without asking you first.
Interesting. What else can an iOS app get access to without permission? location? browser history? other installed apps list? emails? notes? pics? vids? music list? podcast list? itunes username?
From the Wikipedia entry [ http://en.wikipedia.org/wiki/Path_%28social_network%29 ]: "Contacts are suggested from among persons in a user's electronic address book, as well as people with whom the user is communicating by email." It's been there for over a year. http://en.wikipedia.org/w/index.php?title=Path_%28social_net...
Honest question: Isn't this within the kind of behavior that AppStore reviews are supposed to prevent, at least if there isn't an app specific functional explanation for it? Does Apple have a list of what kind of behavior like this is tolerated or does word just get out about what they don't reject?
The problem is surely one of governance - it must be that the app reviewers simply don't (whether through sheer volume of apps they have to review, or lack of ability) see what's being posted, and where.
What's more if Path used https and a CA, would we ever have found out what was being posted short of live debugging?
I think this is Apple's problem really. Path is just one of many apps that probably do this without asking you. Ideally the OS should prompt you if an app wants access to your address book, just like it does for location.
Android apps must explicitly request a READ_CONTACTS permission. But even there, no one actually reads those permissions lists, and apps routinely ask for far more than they need. User authorization is a very weak security mechanism in the consumer space.
"The Weather Channel" is a default icon suggesting a free download on the Kindle Fire.
It asks for:
Set the wallpaper
Send SMS messages
Write to external storage
Access info about Wi-Fi networks
Access coarse location
Initiate a phone call without going through the Dialer user interface for the user to confirm the call being placed
Write (but not read) calendar data
Read calendar data
Required to be able to access the camera device
Open network sockets
Access fine GPS location
Access vibration feature
Access info about networks
Record audio
If legit apps are demanding all this, then a Chinese weather app dialing those toll numbers in the Caribbean could do the same.
Honest question: Isn't this within the kind of behavior that AppStore reviews are supposed to prevent, at least if there isn't an app specific functional explanation for it? Does Apple have a list of what kind of behavior like this is tolerated or does word just get out about what they don't reject?
The app explanation for it will be 'path can hook into your address book' - presumably for sending invites or messages to friends. However at this point the cat's out the bag and path can do what they like with this data (albeit against app store policy). The problem is surely one of governance - it must be that the app reviewers simply don't (whether through sheer volume of apps they have to review, or lack of abili…
Earlier quoted context omitted.
The app explanation for it will be 'path can hook into your address book' - presumably for sending invites or messages to friends. However at this point the cat's out the bag and path can do what they like with this data (albeit against app store policy). The problem is surely one of governance - it must be that the app reviewers simply don't (whether through sheer volume of apps they have to review, or lack of abili…
The address book is uploaded using TLS/SSL and the author used mitmproxy.
Earlier quoted context omitted.
Android apps must explicitly request a READ_CONTACTS permission. But even there, no one actually reads those permissions lists, and apps routinely ask for far more than they need. User authorization is a very weak security mechanism in the consumer space.
Like FB apps, even legit Android apps ask for the moon, with no option to dole out granular permissions. "The Weather Channel" is a default icon suggesting a free download on the Kindle Fire. It asks for: Set the wallpaper Send SMS messages Write to external storage Access info about Wi-Fi networks Access coarse location Initiate a phone call without going through the Dialer user interface for the user to confirm the…