Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Path uploads your entire iPhone address book to its servers

mclov.in

Post reply on HN
Print view View original

81–90 of 283 posts

Re: Path uploads your entire iPhone address book to its servers

#81

Post by jan_g »

trotsky wrote: post #9

Honest question: Isn't this within the kind of behavior that AppStore reviews are supposed to prevent, at least if there isn't an app specific functional explanation for it? Does Apple have a list of what kind of behavior like this is tolerated or does word just get out about what they don't reject?

Our app was recently rejected specifically for this reason, though we had a "skip" button, contacts weren't just automatically 'farmed'. So we had to add a popup with explicit allow/deny buttons and then the app passed subsequent reviews.

Re: Path uploads your entire iPhone address book to its servers

#84

Post by [deleted] »

danso wrote: post #44

Dave Morin, Path's CEO just responded in a comment: http://mclov.in/2012/02/08/path-uploads-your-entire-address-... > Arun, thanks for pointing this out. We actually think this is an important conversation and take this very seriously. We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends…

[deleted]

Re: Path uploads your entire iPhone address book to its servers

#85

Post by pxlpshr »

AznHisoka wrote: post #26

Moral of story: don't target techies as your end users. They'll just look under your hood to make sure you're not doing anything embarassing like this, and passing back clear-text password in JSON.

That's not the moral of the story; techies are great early-adopters and end users for that reason.

The moral is to treat customers privacy with utmost respect.

Re: Path uploads your entire iPhone address book to its servers

#86

Post by feralchimp »

danso wrote: post #44

Dave Morin, Path's CEO just responded in a comment: http://mclov.in/2012/02/08/path-uploads-your-entire-address-... > Arun, thanks for pointing this out. We actually think this is an important conversation and take this very seriously. We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends…

>we proactively rolled out an opt-in for this on our Android client a few weeks ago and are rolling out the opt-in for this in 2.0.6 of our iOS Client, pending App Store approval.

"Proactively?" How do you get into the Social Networking business and not see this issue coming before the first line of code is written?

[re: hashing] >This is a good alternative solution which we'll look into. Thanks for the idea.

Again, no. That no competent system design talent/time was dedicated to this process is a damning critique of your organization's ability to be trusted to safeguard user data.

Re: Path uploads your entire iPhone address book to its servers

#87

Post by encoderer »

danso wrote: post #44

Dave Morin, Path's CEO just responded in a comment: http://mclov.in/2012/02/08/path-uploads-your-entire-address-... > Arun, thanks for pointing this out. We actually think this is an important conversation and take this very seriously. We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends…

As an engineer at a different social network -- not Facebook, but not small, about 30 million users -- he's right. That fuNctionality is important. But we do it in way that preserves privacy. IMO this is just sloppy...

Re: Path uploads your entire iPhone address book to its servers

#88

Post by samstave »

danso wrote: post #44

Dave Morin, Path's CEO just responded in a comment: http://mclov.in/2012/02/08/path-uploads-your-entire-address-... > Arun, thanks for pointing this out. We actually think this is an important conversation and take this very seriously. We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends…

This appears to be a sound response to a sensitive issue. Certainly handled far better than some others have handled their PR (debacles) recently.

Re: Path uploads your entire iPhone address book to its servers

#90

Post by TylerE »

maxerickson wrote: post #77
jd wrote: post #67

Earlier quoted context omitted.

Not that small. It's comparable to a weak password. There are about 5 billion active phone numbers in the world [1]. Besides, a small search space can only be searched quickly if it takes little time to a hash a phone number. Doing a few billion MD5-sums is not so difficult. If the hashes are computed with an expensive bcrypt then it's just a matter of increasing the number of iterations to make brute force attacks u…

The client could do 'signed' hashes using the local phone number and the friend number (sending the server both the local:friend pair and the friend:local pair). That wouldn't really stop anybody from reversing the hashes, but it would make a global rainbow table useless.

At that point it's also useless for matching.
Post reply on HN