Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Path uploads your entire iPhone address book to its servers

mclov.in

Post reply on HN
Print view View original

211–220 of 283 posts

Re: Path uploads your entire iPhone address book to its servers

#211

Post by dkrich »

pclark wrote: post #103

I find it mind blowing that (in the comments of the blog post) someone asked the Path CEO: > Why wasn't this [sending all the contacts to your servers without users knowing] an opt-in situation to begin with? Isn't that against Apple's own T&Cs? and the Path CEO replied: > This is currently the industry best practice and the App Store guidelines do not specifically discuss contact information. However, as mentioned,…

But Apple did do this to their users. They are just as culpable as Path, if not more so. If you are going to provide a platform for app distribution, it is your, and only your responsibility to ensure that private information is not abused if you create the illusion that user information is safe.

Re: Path uploads your entire iPhone address book to its servers

#212

Post by mishmash »

[deleted] wrote: post #186
ryanwaggoner wrote: post #185

Earlier quoted context omitted.

As I emailed to Path's support, our 3-4 year old children's schools, bus companies, physicians, pharmacies and our family lawyer were in that contact list Ok, I'm going to pick on you for a second. Hold the downvotes everyone! Let me explain. This seems like a bit of a knee-jerk reaction akin to "think of the children!" or the whole child porn scare-mongering that politicians engage in that we on HN are always critic…

[deleted]

One of my kids has special needs. This means he rides a certain bus and goes to a certain school. It would be trivial to uniquely identify him for the rest of his LIFE with only the information contained in my contacts list.

So now, without consent, this "private" "friends and family"-based app I installed on my phone, plus it's company, plus any other company they choose to do business with, or any entity that acquires them in perpetuity, or any data mining, social profiling, credit bureau, can start building far-reaching and long-lasting profiles of a four year old little boy that needs a extra help.

What part of that confuses you?

p.s. this could have been avoided with a dozen lines of code via a dialog box.

Re: Path uploads your entire iPhone address book to its servers

#213

Post by gmaslov »

ryanwaggoner wrote: post #185
mishmash wrote: post #138

Earlier quoted context omitted.

I've just: 1) saved their Privacy Policy and Terms of Use 2) requested a complete deletion of our family's account 3) requested deletion of any/all stored information 4) considering contacting our lawyer As I emailed to Path's support, our 3-4 year old children's schools, bus companies, physicians, pharmacies and our family lawyer were in that contact list - that's an insane, willful, and quite unexpected violation o…

As I emailed to Path's support, our 3-4 year old children's schools, bus companies, physicians, pharmacies and our family lawyer were in that contact list Ok, I'm going to pick on you for a second. Hold the downvotes everyone! Let me explain. This seems like a bit of a knee-jerk reaction akin to "think of the children!" or the whole child porn scare-mongering that politicians engage in that we on HN are always critic…

Having all that information (school, doctor, lawyer, pest control company, health insurer, employer, credit card company, ...) about one person or a family, together in one place, is a social-engineering / identity-theft cornucopia. Imagine if Path had a data breach resulting in this contacts database floating around the internet.

Now most people's response to that kind of threat is to think "I'm just nobody important, no one would ever go to the trouble of using this information to impersonate me or otherwise make my life difficult." Probably you are underestimating one or more of: (a) your importance, meaning how much money someone stands to gain by impersonating you, (b) the gullibility/apathy of customer service reps at the companies you interact with, or possibly (c) the amount of free time and/or perversity of someone who will fuck with you just for the lulz.

Re: Path uploads your entire iPhone address book to its servers

#214

Post by mishmash »

guywithabike wrote: post #196
rokhayakebe wrote: post #182

Earlier quoted context omitted.

considering contacting our lawyer What do you expect to achieve with this step?

To get his money back, of course.

To get perspective, actually. Most lawyers are wicked smart and it sucks you aren't in a position to have such a valuable resource available in your own life. HTH.

Re: Path uploads your entire iPhone address book to its servers

#216

Post by mishmash »

damptrousers wrote: post #179
mishmash wrote: post #138

Earlier quoted context omitted.

I've just: 1) saved their Privacy Policy and Terms of Use 2) requested a complete deletion of our family's account 3) requested deletion of any/all stored information 4) considering contacting our lawyer As I emailed to Path's support, our 3-4 year old children's schools, bus companies, physicians, pharmacies and our family lawyer were in that contact list - that's an insane, willful, and quite unexpected violation o…

Lawyer? God, get a fucking grip. No wonder companies treat their users like morons.

Because asking for advice from those wiser than oneself clearly makes one a moron.

Re: Path uploads your entire iPhone address book to its servers

#219

Post by cnyc »

mishmash wrote: post #210
ryanwaggoner wrote: post #185

Earlier quoted context omitted.

As I emailed to Path's support, our 3-4 year old children's schools, bus companies, physicians, pharmacies and our family lawyer were in that contact list Ok, I'm going to pick on you for a second. Hold the downvotes everyone! Let me explain. This seems like a bit of a knee-jerk reaction akin to "think of the children!" or the whole child porn scare-mongering that politicians engage in that we on HN are always critic…

> I'm unclear on why them having the information you cited First of all, my wife and I actually read and attempted to analyze Path's Terms and Privacy Policy before joining. They did not in ANY WAY have our permission, either implicitly or explicitly to collect private information about our children, who are, 3 and 4 years old. > along with dozens or hundreds of other contacts from your address book From path.com/abo…

I think you're spot on here mash but I have a disconcerting question. How do you intend to handle this situation with every other app you, and presumably your wife, have ever downloaded? Specifically those that may not be as 'transparent' as Path?

I ask because we would be foolish to think the developers of some less then typical quality apps have, or will, certainly exploit this for their own monetary gain.

Re: Path uploads your entire iPhone address book to its servers

#220

Post by po »

charlieok wrote: post #204
po wrote: post #202

Earlier quoted context omitted.

Because it requires 2 API's both of which have legitimate uses: 1.) Get the user's address book and 2.) upload it to a server. Installing an application implies a higher level of trust than a web application. You can't prompt the user for every API that might have a nefarious use. Location data is also much more sensitive so it makes sense to prompt the user for that.

From the traction this story is getting, it sure looks like address book information is considered sensitive by a lot of people. Possibly on par with location data.

It's sensitive depending on what you're going to do with it. If you're a native app and you want to access it so that you can show me my address book in some unique way, then I don't want to be bothered giving permission. If you're a native app that's just a front end to some social network and you're going to shuttle it off to some big database in the sky, then maybe not.

The problem is that this isn't easily enforceable at the API level without the user having to make decisions. The right level of enforcement is at the app review stage.

Post reply on HN