Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Path uploads your entire iPhone address book to its servers

mclov.in

Post reply on HN
Print view View original

91–100 of 283 posts

Re: Path uploads your entire iPhone address book to its servers

#91

Post by jasongullickson »

0x0 wrote: post #70
jasongullickson wrote: post #64

Earlier quoted context omitted.

Pulling contact data requires API calls that can be detected in the compiled binary (this is one way that Apple detects calls to unpublished API's). That said, it's humorous how a blatant abuse of trust such as this gets through unscathed but god help you if you try to access the iPod library the wrong way!

Well, the app could have legitimate reasons for linking to the required API (such as pretending to only use it after obtaining user confirmation), but then you could add additional obfuscated calls to the same API without prompting the user. So that wouldn't really help.

Perhaps, however when calls like this are noted additional scrutiny of the application could be applied to ensure they are not abused (such as using a proxy in the way described by the parent).

There are other actions allowed by the SDK that seem to have little non-nefarious use, such as the ability to hide the fact that an application is transmitting and receiving data (the network "spinner" can be disabled by the application); as others have mentioned it's interesting which API calls require authorization from the user while others do not.

Re: Path uploads your entire iPhone address book to its servers

#92

Post by psychotik »

trotsky wrote: post #9

Honest question: Isn't this within the kind of behavior that AppStore reviews are supposed to prevent, at least if there isn't an app specific functional explanation for it? Does Apple have a list of what kind of behavior like this is tolerated or does word just get out about what they don't reject?

Two 'by review' app stores I've had experience with are iTunes App Store and Amazon App Store. Here's what I've seen:

- iOS app review is very minimal. For the initial submission, they'll play around with the app for ~5 minutes. I've had updates approved without the app even being launched, and other times it's approved with simply logging in and launching the app on different devices. They are mainly concerned about policies, private APIs, etc. Things get stricter when you submit in-app purchases, but again those are more administrative than functional. So, I don't think they would ever catch something like this.

- Amazon's testing is insanely detailed compared to Apple's(at least, for the first submission - I haven't submitted updates yet). They tested the app on several Android devices, and also were looking at data over the wire using, presumably, a client proxy. They will reject the app if you send up passwords/usernames without using SSL, for instance. They hit all the menu buttons and try most features. And they review all permissions your app needs.

Re: Path uploads your entire iPhone address book to its servers

#94

Post by jpmc »

encoderer wrote: post #87
danso wrote: post #44

Dave Morin, Path's CEO just responded in a comment: http://mclov.in/2012/02/08/path-uploads-your-entire-address-... > Arun, thanks for pointing this out. We actually think this is an important conversation and take this very seriously. We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends…

As an engineer at a different social network -- not Facebook, but not small, about 30 million users -- he's right. That fuNctionality is important. But we do it in way that preserves privacy. IMO this is just sloppy...

Are you in a position to elaborate on your method? Does it involve hash comparisons?

Re: Path uploads your entire iPhone address book to its servers

#95

Post by lurker17 »

Terretta wrote: post #27
ajross wrote: post #21

Earlier quoted context omitted.

Android apps must explicitly request a READ_CONTACTS permission. But even there, no one actually reads those permissions lists, and apps routinely ask for far more than they need. User authorization is a very weak security mechanism in the consumer space.

Like FB apps, even legit Android apps ask for the moon, with no option to dole out granular permissions. "The Weather Channel" is a default icon suggesting a free download on the Kindle Fire. It asks for: Set the wallpaper Send SMS messages Write to external storage Access info about Wi-Fi networks Access coarse location Initiate a phone call without going through the Dialer user interface for the user to confirm the…

CyanogenMod allows the user to remove specific permissions frmo specific apps. If more users used CyanogenMod, more app developers would become compatible.

Re: Path uploads your entire iPhone address book to its servers

#96

Post by rhizome »

feralchimp wrote: post #86
danso wrote: post #44

Dave Morin, Path's CEO just responded in a comment: http://mclov.in/2012/02/08/path-uploads-your-entire-address-... > Arun, thanks for pointing this out. We actually think this is an important conversation and take this very seriously. We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends…

>we proactively rolled out an opt-in for this on our Android client a few weeks ago and are rolling out the opt-in for this in 2.0.6 of our iOS Client, pending App Store approval. "Proactively?" How do you get into the Social Networking business and not see this issue coming before the first line of code is written? [re: hashing] >This is a good alternative solution which we'll look into. Thanks for the idea. Again,…

I think the simplest explanation is that he's playing dumb.

Re: Path uploads your entire iPhone address book to its servers

#99

Post by greyman »

I begin to understand what Richard Stallman has been saying all those years. Although I don't like the guy on the personal level, this incident make him completely right - running closed source software can compromise your rights. (rights to privacy in this case).

I also want to thank the author of this post to discover this! I wanted to try Path some time ago, now I can safely avoid it without regret.

Re: Path uploads your entire iPhone address book to its servers

#100

Post by maxerickson »

TylerE wrote: post #90
maxerickson wrote: post #77

Earlier quoted context omitted.

The client could do 'signed' hashes using the local phone number and the friend number (sending the server both the local:friend pair and the friend:local pair). That wouldn't really stop anybody from reversing the hashes, but it would make a global rainbow table useless.

At that point it's also useless for matching.

It wouldn't be a strong signature, it would simply be the other half of the number pair. Numbers A and B both have easy access to A:B and B:A.

The hashes for a given user could still be attacked using their phone number, but a global table wouldn't work.

Post reply on HN