Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hipster (like Path) uploads your address book emails to its servers

markchang.tumblr.com

Post reply on HN
Print view View original

11–20 of 81 posts

Re: Hipster (like Path) uploads your address book emails to its servers

#11

Post by mcav »

jazzychad wrote: post #10

Surprise! Likewise, Instagram uploads your contact list to their servers (phone numbers, names, emails) to help find friends (confirmed with mitmproxy as well). At least you have to click "Find from my contact list" first. This practice is super-common. The last ordeal around this was a year or so ago with Kik, but then everyone stopped caring. At least Instagram is over https.

Same with HeyZap.

Re: Hipster (like Path) uploads your address book emails to its servers

#12

Post by teej »

splrb wrote: post #5

Thank goodness Apple is scrutinizing all these apps. I definitely like my walled garden well curated.

Surprise! Apple doesn't give a shit that this is happening. If they didn't want developers to have the data, they wouldn't have made the API public. Apple even touts this as a feature in their public-facing developer site!

Quote from https://developer.apple.com/technologies/ios/data-management...

"iOS apps even have access to a device’s global data such as contacts in the Address Book, and photos in the Photo Library"

This is in no way a failure of the App Review process. This is a failure in the way Apple expects user data to be treated. Lots of developers do this. The only way to stop this is a change in Apple policy, end of story.

Re: Hipster (like Path) uploads your address book emails to its servers

#13

Post by masonlee »

zackzackzack wrote: post #3

Making a prediction: When you wake up tomorrow morning, the front page will be filled with stories like these about every type of app you can think of. It will only get worse from here.

Beluga, Kik Messenger, Path, Hipster... Who else?

Re: Hipster (like Path) uploads your address book emails to its servers

#14

Post by bri3d »

I wrote a little MobileSubstrate (Jailbroken iPhone) shim to intercept the most common API used to access this data, block its use, and alert the user when it's happening.

https://github.com/bri3d/AddressBookPrivacy/downloads

It should be available in the BigBoss repository as "Address Book Privacy" sometime tomorrow.

My tweak catches and displays the use of address book data as it happens, and based on my observations I think the Hipster version of address book theft is a lot less egregious than the Path one. Hipster accesses your address book only when you ask it to "Find Friends" - "Contacts" is selected by default. While this certainly shouldn't be the case, it's nowhere near as bad as Path, which sends all your contacts without asking every time you log in (along with again if you select "Find Friends").

Re: Hipster (like Path) uploads your address book emails to its servers

#15

Post by foobarbazetc »

splrb wrote: post #5

Thank goodness Apple is scrutinizing all these apps. I definitely like my walled garden well curated.

Do you really expect Apple to MITM every app (and update) to make sure that every developer in the world isn't sending random stuff to their servers?

Are you really that anti-Apple to believe that?

Blame the developer, not the distributor.

Re: Hipster (like Path) uploads your address book emails to its servers

#16

Post by bri3d »

foobarbazetc wrote: post #15
splrb wrote: post #5

Thank goodness Apple is scrutinizing all these apps. I definitely like my walled garden well curated.

Do you really expect Apple to MITM every app (and update) to make sure that every developer in the world isn't sending random stuff to their servers? Are you really that anti-Apple to believe that? Blame the developer, not the distributor.

It would be absolutely trivial for Apple to flag apps which use the Address Book APIs for closer inspection (including making sure that the user has to opt in to have their Address Book sent anywhere) - the same Apple tool which detects access to unauthorized ("private") Objective-C APIs could just as easily flag access to the AddressBook framework.

Re: Hipster (like Path) uploads your address book emails to its servers

#17

Post by jonknee »

foobarbazetc wrote: post #15
splrb wrote: post #5

Thank goodness Apple is scrutinizing all these apps. I definitely like my walled garden well curated.

Do you really expect Apple to MITM every app (and update) to make sure that every developer in the world isn't sending random stuff to their servers? Are you really that anti-Apple to believe that? Blame the developer, not the distributor.

Yes, or at least not allow open APIs that make it so simple. What else is the point of a walled garden? They're able to make sure all their other arcane rules are followed (like Amazon linking to their web store), they should be able to keep data safe.

Re: Hipster (like Path) uploads your address book emails to its servers

#18

Post by Kylekramer »

foobarbazetc wrote: post #15
splrb wrote: post #5

Thank goodness Apple is scrutinizing all these apps. I definitely like my walled garden well curated.

Do you really expect Apple to MITM every app (and update) to make sure that every developer in the world isn't sending random stuff to their servers? Are you really that anti-Apple to believe that? Blame the developer, not the distributor.

I've bitched about how restrictive Apple is with the App Store plenty, but that ship has sailed a long time ago. But once you decided to have a restrictive app store and declare to provide "freedom from programs that steal your private data" (http://gawker.com/5539717/), be the best damn restrictive app store you can be and actually provide freedom from programs that steal your private data. Apple has inserted themselves as necessary component in the developer-customer relationship of iOS (and even declared privacy as one of the reasons why they are necessary), so they damn well should take some blame here.

Re: Hipster (like Path) uploads your address book emails to its servers

#19

Post by radishpower »

masonlee wrote: post #13
zackzackzack wrote: post #3

Making a prediction: When you wake up tomorrow morning, the front page will be filled with stories like these about every type of app you can think of. It will only get worse from here.

Beluga, Kik Messenger, Path, Hipster... Who else?

I am thinking of precise reasons why these services want the e-mail addresses in the first place. Is it to create a social network graph of the email addresses? Does this mean that all of these small services have a social graph? That doesn't seem so bad given that most people have already given that to one very large institution.
Post reply on HN