Live data from Hacker News

Hipster (like Path) uploads your address book emails to its servers

markchang.tumblr.com

21–30 of 81 posts

Re: Hipster (like Path) uploads your address book emails to its servers

#21
post #14

I wrote a little MobileSubstrate (Jailbroken iPhone) shim to intercept the most common API used to access this data, block its use, and alert the user when it's happening. https://github.com/bri3d/AddressBookPrivacy/downloads It should be available in the BigBoss repository as "Address Book Privacy" sometime tomorrow. My tweak catches and displays the use of address book data as it happens, and based on my observatio…

Cool. Too bad about the jailbreak requirement :).

Hipster doesn't leak as much information, but it is almost just as persistent. You can uncheck the "Contacts" button when you enter that preference, but only after the app sends your data. Also, if you come back to the screen, it reverts to checked. They are really filter buttons, and not stateful, apparently.

But yes, it doesn't happen every time.

Re: Hipster (like Path) uploads your address book emails to its servers

#22
post #14

I wrote a little MobileSubstrate (Jailbroken iPhone) shim to intercept the most common API used to access this data, block its use, and alert the user when it's happening. https://github.com/bri3d/AddressBookPrivacy/downloads It should be available in the BigBoss repository as "Address Book Privacy" sometime tomorrow. My tweak catches and displays the use of address book data as it happens, and based on my observatio…

Random observation from reading the source: your tweak is going to cause issues (possibly crashes) if the application is accessing the address book on a non-main thread. You should dispatch_async() that alert over to the main thread.

Re: Hipster (like Path) uploads your address book emails to its servers

#23
post #14

I wrote a little MobileSubstrate (Jailbroken iPhone) shim to intercept the most common API used to access this data, block its use, and alert the user when it's happening. https://github.com/bri3d/AddressBookPrivacy/downloads It should be available in the BigBoss repository as "Address Book Privacy" sometime tomorrow. My tweak catches and displays the use of address book data as it happens, and based on my observatio…

This is huge. Thanks bri3d.

Re: Hipster (like Path) uploads your address book emails to its servers

#24
post #22
post #14

I wrote a little MobileSubstrate (Jailbroken iPhone) shim to intercept the most common API used to access this data, block its use, and alert the user when it's happening. https://github.com/bri3d/AddressBookPrivacy/downloads It should be available in the BigBoss repository as "Address Book Privacy" sometime tomorrow. My tweak catches and displays the use of address book data as it happens, and based on my observatio…

Random observation from reading the source: your tweak is going to cause issues (possibly crashes) if the application is accessing the address book on a non-main thread. You should dispatch_async() that alert over to the main thread.

It actually just causes CoreAnimation fence issues and messy animations as far as I can tell, but you're entirely right. Fixing in my next commit (which also fixes some other brokenness). Even had a note in the TODO about it.

This is the first time I've used MobileSubstrate and Logos, so I'm having a lot of fun :)

update: fixed.

Re: Hipster (like Path) uploads your address book emails to its servers

#25

Earlier quoted context omitted.

Beluga, Kik Messenger, Path, Hipster... Who else?

I am thinking of precise reasons why these services want the e-mail addresses in the first place. Is it to create a social network graph of the email addresses? Does this mean that all of these small services have a social graph? That doesn't seem so bad given that most people have already given that to one very large institution.

If registration requires an email, they can help you find your friends using the app.

Re: Hipster (like Path) uploads your address book emails to its servers

#26

Earlier quoted context omitted.

I am thinking of precise reasons why these services want the e-mail addresses in the first place. Is it to create a social network graph of the email addresses? Does this mean that all of these small services have a social graph? That doesn't seem so bad given that most people have already given that to one very large institution.

If registration requires an email, they can help you find your friends using the app.

Ah. right. Probably shows I'm still practicing abstinence i.e. no smart phone with 3G plan yet. Still seems its a lot less to be concerned about in comparison to what other organizations own. I suppose the sneaky under the hood part is what's jarring.

Re: Hipster (like Path) uploads your address book emails to its servers

#27

Surprise! Likewise, Instagram uploads your contact list to their servers (phone numbers, names, emails) to help find friends (confirmed with mitmproxy as well). At least you have to click "Find from my contact list" first. This practice is super-common. The last ordeal around this was a year or so ago with Kik, but then everyone stopped caring. At least Instagram is over https.

Right. Kik did it without having an opt-out. At least Instagram does it after you tell it to. Path and Hipster? They just do it. Hipster, to a lesser degree.

Re: Hipster (like Path) uploads your address book emails to its servers

#28
FourSquare Too.

Here was their response to my complaint.

Subject: Do you store my contacts?

------------------------------------------------------------------------------------------------------------------- ✆ via gmail.com

17/07/2011

to privacy Hi.

I recently downloaded the Android Foursquare application. It automatically started scanning the contacts on my phone.

Questions: 1. Does the application upload my contacts to FourSquare?

2. If so, does FourSquare store my contacts?

------------------------------------------------------------------------------------------------------------------- ✆

18/07/2011

to We do not store or upload contacts! It's a one-time search of your phone's contacts to find friends to add on foursquare.

See more information at foursquare.com/privacy/grid and https://foursquare.com/legal/terms

------------------------------------------------------------------------------------------------------------------- ✆ via gmail.com

19/07/2011

to Hi,

I think you must upload my contacts to your servers to identify which ones are on foursquare.

When you upload them, do you send them in plaintext or encrypted?

------------------------------------------------------------------------------------------------------------------- ✆

19/07/2011

to Right, yes, we do send info to the server but do not save anything. All foursquare pages are encrypted as of April 6. ✆ via gmail.com

20/07/2011

to It's nice to know your pages are encrypted, but my question relates to when you sent all my contacts to your server from your mobile app. Did it use an encrypted connection to do this?

Thanks,

------------------------------------------------------------------------------------------------------------------- ✆

20/07/2011

to yes, any information sent via any foursquare page, mobile or otherwise, is encrypted.

------------------------------------------------------------------------------------------------------------------- ✆ via gmail.com

20/07/2011

to Thanks for the confirmation.

One final thing - it would be polite for your app to request permission before scanning my phone and uploading all my contacts to your server. Please consider it a complaint that it did not ask permission.

------------------------------------------------------------------------------------------------------------------- ✆

20/07/2011

to We totally agree! When you download foursquare, we list the permissions that you are giving us, including scanning your contacts list (which we do not save or store). See here: http://cl.ly/18433L2s3g1T13070y0X.

------------------------------------------------------------------------------------------------------------------- ✆ via gmail.com

21/07/2011

to We don't agree.

It is not made clear that you are going to scan for my contacts and upload them.

You should explicitly make me aware and ask for permission in advance of doing that.

Furthermore, your tone and wilfully ignoring my legitimate complaint is annoying.

------------------------------------------------------------------------------------------------------------------- ✆

21/07/2011

to , I'm sorry you feel that way! I have spent time talking to four different engineers (two server engineers about what info is stored and how information is transferred, and two Android developers) about your questions out of respect and concern for you as a user with a valid query. I take all user questions and concerns seriously and as a member of the Product team, pass on this sort of complaint so that we can be sensitive to that fact that if one person is asking/upset about something, there are probably others. Sorry if I did not do a good job of conveying the way I run community and support for foursquare in my tone. Sometimes email is hard in that sense. I hope you know that we care and appreciate your emails.

Best,

------------------------------------------------------------------------------------------------------------------- ✆

21/07/2011

to Also, since we don't save your contacts in anyway, I'm not sure that we are actually "uploading" them. Is there something else that is bothering you? Perhaps I'm not understanding your concern completely--we aren't telling your contacts that you are using foursquare nor are we automatically adding them as your friends, we're merely searching your phone's contacts for other people you know who are also using foursquare so that you can then decide which of those you'd like to send a friend request to. Can you please let me know what part of this you find troubling so I can pass on your concerns? Thank you! ✆ via gmail.com

21/07/2011

to Uploading means essentially the same thing as sending for the purposes of this complaint.

uploading: present participle of up·load Verb: Transfer (data) to a larger computer system.

As for my concern, I can only repeat myself. It is disappointing that you don't immediately understand why this is a problem.

------------------------------------------------------------------------------------------------------------------- ✆

21/07/2011

to Thanks for voicing your concern. I'm passing it on.

Re: Hipster (like Path) uploads your address book emails to its servers

#29
post #14

I wrote a little MobileSubstrate (Jailbroken iPhone) shim to intercept the most common API used to access this data, block its use, and alert the user when it's happening. https://github.com/bri3d/AddressBookPrivacy/downloads It should be available in the BigBoss repository as "Address Book Privacy" sometime tomorrow. My tweak catches and displays the use of address book data as it happens, and based on my observatio…

Nice work! However, you seemed to have forgotten to add theos as a submodule. Without it, people cannot build this on their own if they chose to do so..

Re: Hipster (like Path) uploads your address book emails to its servers

#30
If apps spelled everything they were doing out for you all as you seem to want, you'd have something equivalent to a TOS to read. Only instead of legal jargon it would be technical jargon. You'd never read it. And then when it came out that the app was doing something that was described in it, you'd bitch and moan and complain just like you are doing now.

I would venture to guess that a large majority of apps in the app store (iOS and Android) do the same thing Hipster, Path and other mentioned in this thread do and you don't even know. I don't even what to know what Google and Apple themselves are doing without telling anyone.

TL;DR: Get over it. Move on.

Post reply on HN