Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hipster (like Path) uploads your address book emails to its servers

markchang.tumblr.com

Post reply on HN
Print view View original

31–40 of 81 posts

Re: Hipster (like Path) uploads your address book emails to its servers

#31

Post by bigiain »

Greenisus wrote: post #7

As an iOS developer, I've been surprised all along that the SDK gives you full access to the address book without asking for permission (like Core Location and the Apple Push Notification Service). I've always thought that would one day change, and I suspect that posts like this and the one about Path will make that happen.

I can see a good argument in favour of it - of _course_ I want non-apple apps to be able to autocomplete friends names/emails as I start typing them. And of _course_ apps need to be able to send a bunch of data "back home". Making sure that apps don't send the addressbook data from sentence 1 in a data block from sentence 2 is the problem...

Re: Hipster (like Path) uploads your address book emails to its servers

#32

Post by bri3d »

conradev wrote: post #29
bri3d wrote: post #14

I wrote a little MobileSubstrate (Jailbroken iPhone) shim to intercept the most common API used to access this data, block its use, and alert the user when it's happening. https://github.com/bri3d/AddressBookPrivacy/downloads It should be available in the BigBoss repository as "Address Book Privacy" sometime tomorrow. My tweak catches and displays the use of address book data as it happens, and based on my observatio…

Nice work! However, you seemed to have forgotten to add theos as a submodule. Without it, people cannot build this on their own if they chose to do so..

Good point, although most of the tweaks I've seen on GitHub seem to omit theos and assume the user can find and install it.

I'm not a tremendous fan of submodules but this is a good use case for one; I'll add theos as a submodule and push a commit in a second.

Edit: Done, but users have to manually download ldid (presumably due to licensing issues) anyway.

Thank you for the feedback and advice!

Re: Hipster (like Path) uploads your address book emails to its servers

#33

Post by k-mcgrady »

Greenisus wrote: post #7

As an iOS developer, I've been surprised all along that the SDK gives you full access to the address book without asking for permission (like Core Location and the Apple Push Notification Service). I've always thought that would one day change, and I suspect that posts like this and the one about Path will make that happen.

I'm also an iOS developer although I've never needed to use the Address Book API's. I always presumed that some sort of permission was required I'm really surprised it isn't. I actually think this is a bigger privacy concern than location access as not only are you giving away access to your contact details but everyone who has trusted you with theirs.

Re: Hipster (like Path) uploads your address book emails to its servers

#35

Post by conradev »

bri3d wrote: post #24
eridius wrote: post #22

Earlier quoted context omitted.

Random observation from reading the source: your tweak is going to cause issues (possibly crashes) if the application is accessing the address book on a non-main thread. You should dispatch_async() that alert over to the main thread.

It actually just causes CoreAnimation fence issues and messy animations as far as I can tell, but you're entirely right. Fixing in my next commit (which also fixes some other brokenness). Even had a note in the TODO about it. This is the first time I've used MobileSubstrate and Logos, so I'm having a lot of fun :) update: fixed.

Since you seem to be enjoying the experience, feel free to join #theos on irc.saurik.com, it's all we discuss!

Re: Hipster (like Path) uploads your address book emails to its servers

#37

Post by k-mcgrady »

dumdumacct wrote: post #30

If apps spelled everything they were doing out for you all as you seem to want, you'd have something equivalent to a TOS to read. Only instead of legal jargon it would be technical jargon. You'd never read it. And then when it came out that the app was doing something that was described in it, you'd bitch and moan and complain just like you are doing now. I would venture to guess that a large majority of apps in the…

>> "Get over it."

What a stupid response. I'm not a huge privacy advocate but this is a massive breach of trust/privacy. Not only are apps taking your personal contact information but the contact information of everyone you have in your address book. So regardless of your stance on privacy, the privacy of all of your contacts is also at stake.

Re: Hipster (like Path) uploads your address book emails to its servers

#38

Post by DHowett »

bri3d wrote: post #14

I wrote a little MobileSubstrate (Jailbroken iPhone) shim to intercept the most common API used to access this data, block its use, and alert the user when it's happening. https://github.com/bri3d/AddressBookPrivacy/downloads It should be available in the BigBoss repository as "Address Book Privacy" sometime tomorrow. My tweak catches and displays the use of address book data as it happens, and based on my observatio…

This is an awesome little tweak. I'm really glad to see more competent people using Theos and Logos to implement useful things!

I've got one minor nit to pick, and that's that you're using Logos, but only for its %ctor directive! Not that that's a bad thing, it gets more language coverage!

You could possibly extend this to hook those parts of those apps individually or on a case-by-case basis, and present a different/better UI for them in particular.

Re: Hipster (like Path) uploads your address book emails to its servers

#39

Post by bryne »

FourSquareToo wrote: post #28

FourSquare Too. Here was their response to my complaint. Subject: Do you store my contacts? ------------------------------------------------------------------------------------------------------------------- ✆ via gmail.com 17/07/2011 to privacy Hi. I recently downloaded the Android Foursquare application. It automatically started scanning the contacts on my phone. Questions: 1. Does the application upload my contact…

I think they answered your question pretty thoroughly and promptly, despite your intense neckbearding.

Certainly more thoroughly than the Path guys.

Re: Hipster (like Path) uploads your address book emails to its servers

#40

Post by DHowett »

markchang wrote: post #21
bri3d wrote: post #14

I wrote a little MobileSubstrate (Jailbroken iPhone) shim to intercept the most common API used to access this data, block its use, and alert the user when it's happening. https://github.com/bri3d/AddressBookPrivacy/downloads It should be available in the BigBoss repository as "Address Book Privacy" sometime tomorrow. My tweak catches and displays the use of address book data as it happens, and based on my observatio…

Cool. Too bad about the jailbreak requirement :). Hipster doesn't leak as much information, but it is almost just as persistent. You can uncheck the "Contacts" button when you enter that preference, but only after the app sends your data. Also, if you come back to the screen, it reverts to checked. They are really filter buttons, and not stateful, apparently. But yes, it doesn't happen every time.

"Too bad about the jailbreak requirement :)" :(

Jailbreaking means so many different things to different people. I know it causes issues with Apple-sanctioned updates, but sometimes those issues are just plain worth it.

All the stability issues, all the battery life issues, and all of the downsides apart from a more complicated update process are first and foremost effectively made-up. There's no solid data to back those things.

Jailbreaking has time and time again patched vulnerabilities that Apple didn't (in a timely manner), and proven that it is a valuable part of the ecosystem.

Post reply on HN