Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Path uploads your entire iPhone address book to its servers

mclov.in

Post reply on HN
Print view View original

71–80 of 283 posts

Re: Path uploads your entire iPhone address book to its servers

#71

Post by natesm »

0x0 wrote: post #39
trotsky wrote: post #9

Honest question: Isn't this within the kind of behavior that AppStore reviews are supposed to prevent, at least if there isn't an app specific functional explanation for it? Does Apple have a list of what kind of behavior like this is tolerated or does word just get out about what they don't reject?

Well, since you only ever only submit the compiled application binary to Apple, it'd be pretty darn hard for them to detect behaviour like this. Especially if the code to do so is obfuscated, and/or the data is smuggled out via SSL (or worse, steganography-style piggy-backed on to other data). Sometimes it's tempting to speculate whether the real purpose of the app store review team is just to ensure developers aren'…

I've received a rejection for using a "private" ivar (it was actually a framework doing it).

The ivar was in a public header, and was not marked @private, which is the only correct way to designated an ivar as private in Objective-C. Putting a comment above it saying "this is private" (which they did) doesn't count. It's protected, by definition.

NSActionCell.h, I think.

Re: Path uploads your entire iPhone address book to its servers

#72

Post by alanh »

jonknee wrote: post #16
timjahn wrote: post #4

Earlier quoted context omitted.

If no explicit permission is given by the user, how is this practice not illegal?

Apple doesn't prompt the user to ask for permission when the APIs are used (like what happens with location), so this is the desired behavior. It's very simple: https://developer.apple.com/library/ios/#documentation/Addre...

Yep, which makes the address book a hack for (high-latency, obviously) cross-app communication. E.g., last I knew, TextExpander added an entry to your address book with your abbreviations, so that other apps e.g. Simplenote can use those abbreviations as you type. Very well intentioned hack, which shouldn’t be necessary, but is, using an API that really just shouldn’t be open…

Re: Path uploads your entire iPhone address book to its servers

#73

Post by [deleted] »

natesm wrote: post #56
Vitaly wrote: post #49

Earlier quoted context omitted.

You really don't need to upload address book for that. Sending just hash sum of each of phone, address, name, and email would be enough to make the matching.

Hashing doesn't let you match Kate, Katie, Katherine as the same person like Facebook does, however.

[deleted]

Re: Path uploads your entire iPhone address book to its servers

#74

Post by Aqua_Geek »

danso wrote: post #44

Dave Morin, Path's CEO just responded in a comment: http://mclov.in/2012/02/08/path-uploads-your-entire-address-... > Arun, thanks for pointing this out. We actually think this is an important conversation and take this very seriously. We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends…

I understand wanting this from a usability perspective, but is there some way to opt-out if our data is already on their servers? I, for example, in just browsing around the app out of curiosity ended up on the "find my friends" screen and without warning Path now has all of my contact data.

I have yet to open the app again.

Re: Path uploads your entire iPhone address book to its servers

#75

Post by jansen »

danso wrote: post #44

Dave Morin, Path's CEO just responded in a comment: http://mclov.in/2012/02/08/path-uploads-your-entire-address-... > Arun, thanks for pointing this out. We actually think this is an important conversation and take this very seriously. We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends…

I actually think that Dave's response was pretty lame. That was a typical PR/B2C response, neglecting that he is talking to techies here.

Everybody knows "why" Path is doing this and the response should have been more of "why this way".

Re: Path uploads your entire iPhone address book to its servers

#76

Post by mahyarm »

badclient wrote: post #10

So I download an IM app that automatically finds your friends based on your phone directory. I launch it and scrolling through my friend's list I see my mom. Some contacts later, I see the real name of the hooker. Both my mom and the real hooker are on this IM platform...just a click away from chatting with me under the same identity . This can be more than creepy, fortunately this is a made up example ;) I thought a…

It's a double edged sword. Many users like it that they don't have to create a user name, remember a password, confirm an account (usually), etc and that all of their other friends 'automagically' appear on the app who've installed it. Whatsapp has something like %90 of smartphone users in sweden.

Phone numbers cost money, and multiple emails are usually a chore still.

Re: Path uploads your entire iPhone address book to its servers

#77

Post by maxerickson »

jd wrote: post #67
bdr wrote: post #54

Earlier quoted context omitted.

Hashing phone numbers doesn't do much since the space is so small.

Not that small. It's comparable to a weak password. There are about 5 billion active phone numbers in the world [1]. Besides, a small search space can only be searched quickly if it takes little time to a hash a phone number. Doing a few billion MD5-sums is not so difficult. If the hashes are computed with an expensive bcrypt then it's just a matter of increasing the number of iterations to make brute force attacks u…

The client could do 'signed' hashes using the local phone number and the friend number (sending the server both the local:friend pair and the friend:local pair).

That wouldn't really stop anybody from reversing the hashes, but it would make a global rainbow table useless.

Re: Path uploads your entire iPhone address book to its servers

#78

Post by chc »

natesm wrote: post #71
0x0 wrote: post #39

Earlier quoted context omitted.

Well, since you only ever only submit the compiled application binary to Apple, it'd be pretty darn hard for them to detect behaviour like this. Especially if the code to do so is obfuscated, and/or the data is smuggled out via SSL (or worse, steganography-style piggy-backed on to other data). Sometimes it's tempting to speculate whether the real purpose of the app store review team is just to ensure developers aren'…

I've received a rejection for using a "private" ivar (it was actually a framework doing it). The ivar was in a public header, and was not marked @private, which is the only correct way to designated an ivar as private in Objective-C. Putting a comment above it saying "this is private" (which they did) doesn't count. It's protected, by definition. NSActionCell.h, I think.

Eh, I don't think you're quite right here. @private means "Only accessible by this class and its instances, not parent, sibling or child classes." What Apple means by "private" in that case, though, is "Only for use by Apple, not outside vendors." If NSActionCell has private subclasses that need the variable, marking it @private would be flat-out wrong.

Re: Path uploads your entire iPhone address book to its servers

#79

Post by United857 »

bengl3rt wrote: post #22
brador wrote: post #8

Earlier quoted context omitted.

Interesting. What else can an iOS app get access to without permission? location? browser history? other installed apps list? emails? notes? pics? vids? music list? podcast list? itunes username?

I can say for sure that iTunes username is not exposed. In fact, they won't even provide an opaque user ID, which makes correlating purchases through in-app purchase with server-side user accounts very frustrating. You can sort of fake it by correlating with a device UDID, but that is leaky and has a lot of edge cases.

Furthermore, they've officially deprecated the UDID as of iOS 5 which means it'll be going away sometime after that.

Re: Path uploads your entire iPhone address book to its servers

#80

Post by eco »

derwiki wrote: post #30
Terretta wrote: post #27

Earlier quoted context omitted.

Like FB apps, even legit Android apps ask for the moon, with no option to dole out granular permissions. "The Weather Channel" is a default icon suggesting a free download on the Kindle Fire. It asks for: Set the wallpaper Send SMS messages Write to external storage Access info about Wi-Fi networks Access coarse location Initiate a phone call without going through the Dialer user interface for the user to confirm the…

With FB apps, you can go into your App settings and revoke individual permissions that you don't want to give. They still have to be granted to auth the app, but at least you can clean it up very quickly and easily.

Where is this setting? This is the second time I've heard someone say you could do that but I cannot find any options like that. Settings just has Refresh interval and options to configure notifications.
Post reply on HN