Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Path uploads your entire iPhone address book to its servers

mclov.in

Post reply on HN
Print view View original

151–160 of 283 posts

Re: Path uploads your entire iPhone address book to its servers

#151

Post by dchmiel »

frederickcook wrote: post #36
dsplittgerber wrote: post #13

Earlier quoted context omitted.

Which apps do that? Do you have a list? Can anything be done about the data after-the-fact?

Facebook, Foursquare, Twitter, basically any app that allows you to "search my address book for friends" will do this. All these services require either a email or phone number to sign up, so to search for friends who have also signed up for the service, you need to compare two data sets: emails or phone numbers of users you already have, and those in the person's address book. You obviously wouldn't download your en…

If so many apps do this, why all of the sudden uproar with Path doing the same? I'm not condoning it, just curious why it still happens and so frequently. It seems to me that the "industry best practices" actually need to be best practice.

Re: Path uploads your entire iPhone address book to its servers

#152

Post by cstejerean »

shalmanese wrote: post #147

Can someone explain to me exactly how I could be harmed by this? My contact list is just a list of names and phone numbers of people I contact. Even if I had an escort service in there or something, I don't think anyone on Path's end is individually looking through the data.

An employee at Path might very well decide to start looking through that data. There have been other cases where employees gave in to temptation to access someone's data. Imagine for example if a celebrity is involved and someone decides to leak their address book.

Now one would hope that employees wouldn't have unrestricted data to this access, but one would also hope Path wouldn't do this in the first place. The fact that they collect all this information in the first place, unnecessarily and without consent does not inspire much confidence in their internal safeguards for access to this data.

Also, if anything were to happen to the company, it's hard to know what hands all that data will end up in.

Re: Path uploads your entire iPhone address book to its servers

#153

Post by ABS »

from a company that claims they "don't currently have the internal tools to delete an account" I'm sadly not surprised.

The above was their official response to me when I asked to delete my account... and I had to ask by email since there is no link on their website to close your account...

Re: Path uploads your entire iPhone address book to its servers

#154

Post by lwat »

JS_startup wrote: post #145
pclark wrote: post #128

Earlier quoted context omitted.

If I were involved in this (and I'm not, I just think transparency - not privacy - matters) I would want the CEO and CTO of Path to create a video that is displayed to all relevant users in their mobile app. The first thing they do is apologise, they explain in plain words what people are up in arms about, the CTO reiterates that a) this was dumb and a poor choice but we are all human, b) what this means (eg: we did…

I would want the CEO to: 1) Immediately delete all of the non-user data 2) Send an apology e-mail to each Path user explaining the situation 3) Write, by hand, a corresponding apology letter for each Path user 4) Hold a townhall-style meeting in which members of the public can ask him questions 5) Pay, out of pocket, the travel expenses of anyone who attends the townhall meeting 6) Wear an indicator of shame (large n…

Seppuku basically

Re: Path uploads your entire iPhone address book to its servers

#156

Post by JS_startup »

JS_startup wrote: post #145
pclark wrote: post #128

Earlier quoted context omitted.

If I were involved in this (and I'm not, I just think transparency - not privacy - matters) I would want the CEO and CTO of Path to create a video that is displayed to all relevant users in their mobile app. The first thing they do is apologise, they explain in plain words what people are up in arms about, the CTO reiterates that a) this was dumb and a poor choice but we are all human, b) what this means (eg: we did…

I would want the CEO to: 1) Immediately delete all of the non-user data 2) Send an apology e-mail to each Path user explaining the situation 3) Write, by hand, a corresponding apology letter for each Path user 4) Hold a townhall-style meeting in which members of the public can ask him questions 5) Pay, out of pocket, the travel expenses of anyone who attends the townhall meeting 6) Wear an indicator of shame (large n…

7) Commit seppuku

Re: Path uploads your entire iPhone address book to its servers

#157

Post by FuzzyDunlop »

rhizome wrote: post #142
pclark wrote: post #128

Earlier quoted context omitted.

If I were involved in this (and I'm not, I just think transparency - not privacy - matters) I would want the CEO and CTO of Path to create a video that is displayed to all relevant users in their mobile app. The first thing they do is apologise, they explain in plain words what people are up in arms about, the CTO reiterates that a) this was dumb and a poor choice but we are all human, b) what this means (eg: we did…

I wouldn't be surprised if there is an engineer there who voiced concerns, but whether they still work there or not would be an open question. Wherever they are, they should be found and put in charge of development.

Ethical engineer: "I've got a problem with doing this, we're storing personal info without permission. Shouldn't we at least have something that lets our users know?"

Ambivalent boss: "I don't think it's a problem, who's going to notice anyway?"

Not that the ethical engineer will get anything more than personal vindication for actually giving a shit.

Re: Path uploads your entire iPhone address book to its servers

#158

Post by mikeash »

shalmanese wrote: post #147

Can someone explain to me exactly how I could be harmed by this? My contact list is just a list of names and phone numbers of people I contact. Even if I had an escort service in there or something, I don't think anyone on Path's end is individually looking through the data.

Don't forget about the possibility of Path's data being stolen. Your contacts probably contain enough info for a criminal to carry outa pretty good phishing expedition, for example.

Re: Path uploads your entire iPhone address book to its servers

#159

Post by charlieok »

pclark wrote: post #103

I find it mind blowing that (in the comments of the blog post) someone asked the Path CEO: > Why wasn't this [sending all the contacts to your servers without users knowing] an opt-in situation to begin with? Isn't that against Apple's own T&Cs? and the Path CEO replied: > This is currently the industry best practice and the App Store guidelines do not specifically discuss contact information. However, as mentioned,…

If “Apple would never do this to their users”, then how is it that Apple provided the API which Path used to do this to their users, without requiring the users to give the app permission (as they do with, say, allowing an app access to a user's location)?

Re: Path uploads your entire iPhone address book to its servers

#160

Post by droithomme »

pclark wrote: post #103

I find it mind blowing that (in the comments of the blog post) someone asked the Path CEO: > Why wasn't this [sending all the contacts to your servers without users knowing] an opt-in situation to begin with? Isn't that against Apple's own T&Cs? and the Path CEO replied: > This is currently the industry best practice and the App Store guidelines do not specifically discuss contact information. However, as mentioned,…

Yeah, I only came to the comments to express my utter disgust and anger at the claim anything about this is "currently the industry best practice". What a load.

Wait, on second thought. Maybe he is right. Hopefully he will post a comprehensive list of all other companies he is aware of that engage in this practice in order to show his good will in stating it is an industry best practice according to his personal knowledge, and not that he is merely a compulsive liar. I look forward to Mr. Morin's follow up with the list.

Post reply on HN