Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hipster (like Path) uploads your address book emails to its servers

markchang.tumblr.com

Post reply on HN
Print view View original

41–50 of 81 posts

Re: Hipster (like Path) uploads your address book emails to its servers

#41

Post by DHowett »

bri3d wrote: post #32
conradev wrote: post #29

Earlier quoted context omitted.

Nice work! However, you seemed to have forgotten to add theos as a submodule. Without it, people cannot build this on their own if they chose to do so..

Good point, although most of the tweaks I've seen on GitHub seem to omit theos and assume the user can find and install it. I'm not a tremendous fan of submodules but this is a good use case for one; I'll add theos as a submodule and push a commit in a second. Edit: Done, but users have to manually download ldid (presumably due to licensing issues) anyway. Thank you for the feedback and advice!

Users have to manually download ldid only because I aspire to keep Theos a binary-free distribution: it's totally cross-platform where you have GNU make and bash (and, for Logos, perl).

Re: Hipster (like Path) uploads your address book emails to its servers

#42

Post by bri3d »

DHowett wrote: post #38
bri3d wrote: post #14

I wrote a little MobileSubstrate (Jailbroken iPhone) shim to intercept the most common API used to access this data, block its use, and alert the user when it's happening. https://github.com/bri3d/AddressBookPrivacy/downloads It should be available in the BigBoss repository as "Address Book Privacy" sometime tomorrow. My tweak catches and displays the use of address book data as it happens, and based on my observatio…

This is an awesome little tweak. I'm really glad to see more competent people using Theos and Logos to implement useful things! I've got one minor nit to pick, and that's that you're using Logos, but only for its %ctor directive! Not that that's a bad thing, it gets more language coverage! You could possibly extend this to hook those parts of those apps individually or on a case-by-case basis, and present a different…

Great to hear you like the tweak. Theos and Logos made the whole process a lot easier, so thank you!

I plan to use Logos to add a delegate class for the UIAlert such that I can pop up an "allow/deny" dialog, to start, and then to move on to a more full-featured preference system. I'm just thinking about how to block the thread requesting the address book information while I wait for the user to dismiss the alert.

I've been poking around at various Logos + Theos projects on GitHub and I'm impressed at what a little Perl magic can do - I'm definitely excited to dive deeper as I add features.

Re: Hipster (like Path) uploads your address book emails to its servers

#43

Post by dumdumacct »

k-mcgrady wrote: post #37
dumdumacct wrote: post #30

If apps spelled everything they were doing out for you all as you seem to want, you'd have something equivalent to a TOS to read. Only instead of legal jargon it would be technical jargon. You'd never read it. And then when it came out that the app was doing something that was described in it, you'd bitch and moan and complain just like you are doing now. I would venture to guess that a large majority of apps in the…

>> "Get over it." What a stupid response. I'm not a huge privacy advocate but this is a massive breach of trust/privacy. Not only are apps taking your personal contact information but the contact information of everyone you have in your address book. So regardless of your stance on privacy, the privacy of all of your contacts is also at stake.

If I thought these companies were going to do something malicious with the data then it would be an issue. These companies aren't spammers. They aren't criminals. They don't plan to do anything malicious with the data. Your privacy, my privacy or any of my contacts privacy isn't at risk. It's not at risk but I don't think someone at Hipster is going through the data and using it in any way.

Re: Hipster (like Path) uploads your address book emails to its servers

#44

Post by conradev »

bri3d wrote: post #32
conradev wrote: post #29

Earlier quoted context omitted.

Nice work! However, you seemed to have forgotten to add theos as a submodule. Without it, people cannot build this on their own if they chose to do so..

Good point, although most of the tweaks I've seen on GitHub seem to omit theos and assume the user can find and install it. I'm not a tremendous fan of submodules but this is a good use case for one; I'll add theos as a submodule and push a commit in a second. Edit: Done, but users have to manually download ldid (presumably due to licensing issues) anyway. Thank you for the feedback and advice!

I guess it is a matter of personal preference, but I see it as "why not?", especially because the THEOS environment variable is respected.

Re: Hipster (like Path) uploads your address book emails to its servers

#45

Post by mdonahoe »

Uchikoma wrote: post #34

One has to ask, why don't they upload hashes? This would be sufficient to check for friends (email,telephone). Why do they upload real data? Do they sell it? What happens when they go bankrupt?

It's slightly more work, and devs are lazy?

Hashing doesn't really solve the entire problem, though it does prevent the service from getting addresses it doesn't already know. Allowing an app to see your contact list is an act of faith.

Maybe bloom filters can save us? :)

Re: Hipster (like Path) uploads your address book emails to its servers

#46

Post by k-mcgrady »

dumdumacct wrote: post #43
k-mcgrady wrote: post #37

Earlier quoted context omitted.

>> "Get over it." What a stupid response. I'm not a huge privacy advocate but this is a massive breach of trust/privacy. Not only are apps taking your personal contact information but the contact information of everyone you have in your address book. So regardless of your stance on privacy, the privacy of all of your contacts is also at stake.

If I thought these companies were going to do something malicious with the data then it would be an issue. These companies aren't spammers. They aren't criminals. They don't plan to do anything malicious with the data. Your privacy, my privacy or any of my contacts privacy isn't at risk. It's not at risk but I don't think someone at Hipster is going through the data and using it in any way.

hey may not be using it maliciously (I don't think they are either) but they should be handling our data more carefully. And it's possible that they may use this data in the future.

The part you should be worried about is the fact that they are taking the contact info of your friends and family. People who trusted you enough to give you their data. You/we the users should not get to make the judgement call as to whether or not we are going to give their data up.

Re: Hipster (like Path) uploads your address book emails to its servers

#47

Post by ryanpetrich »

bri3d wrote: post #14

I wrote a little MobileSubstrate (Jailbroken iPhone) shim to intercept the most common API used to access this data, block its use, and alert the user when it's happening. https://github.com/bri3d/AddressBookPrivacy/downloads It should be available in the BigBoss repository as "Address Book Privacy" sometime tomorrow. My tweak catches and displays the use of address book data as it happens, and based on my observatio…

ABAddressBookCopyArrayOfAllPeople is implemented as a direct branch to ABCCopyArrayOfAllPeople. Right after that are the ABAddressBookGetPersonWithRecordID and ABAddressBookGetPersonCountShowingLinks functions and they will be wiped out by the closure generated by MSHookFunction. The proper function to hook is ABCCopyArrayOfAllPeopleInSourceWithSortOrdering. See my similar package for an example: https://github.com/rpetrich/ContactPrivacy

Kudos to beating me to a release.

Re: Hipster (like Path) uploads your address book emails to its servers

#48

Post by eridius »

bri3d wrote: post #24
eridius wrote: post #22

Earlier quoted context omitted.

Random observation from reading the source: your tweak is going to cause issues (possibly crashes) if the application is accessing the address book on a non-main thread. You should dispatch_async() that alert over to the main thread.

It actually just causes CoreAnimation fence issues and messy animations as far as I can tell, but you're entirely right. Fixing in my next commit (which also fixes some other brokenness). Even had a note in the TODO about it. This is the first time I've used MobileSubstrate and Logos, so I'm having a lot of fun :) update: fixed.

You may only be seeing CoreAnimation fencing issues, but the fact is, you're accessing main-thread-only classes from a background thread, and it has the potential to corrupt data structures which can lead to crashes and other bad behavior.

Glad to see you fixed it though.

Re: Hipster (like Path) uploads your address book emails to its servers

#49

Post by markchang »

DHowett wrote: post #40
markchang wrote: post #21

Earlier quoted context omitted.

Cool. Too bad about the jailbreak requirement :). Hipster doesn't leak as much information, but it is almost just as persistent. You can uncheck the "Contacts" button when you enter that preference, but only after the app sends your data. Also, if you come back to the screen, it reverts to checked. They are really filter buttons, and not stateful, apparently. But yes, it doesn't happen every time.

"Too bad about the jailbreak requirement :)" :( Jailbreaking means so many different things to different people. I know it causes issues with Apple-sanctioned updates, but sometimes those issues are just plain worth it. All the stability issues, all the battery life issues, and all of the downsides apart from a more complicated update process are first and foremost effectively made-up. There's no solid data to back t…

I only meant that it wouldn't improve the lives of the vast majority of iPhone users. No complaints about jailbreaking from me! :)

Re: Hipster (like Path) uploads your address book emails to its servers

#50

Post by mdonahoe »

baddox wrote: post #20

I do not understand why anyone is complaining about anything other than perhaps Apple's choice to make this an app-level permission rather than a "one-off" permission.

Other reasons: 1. We are publicly shaming these apps to promote better behavior. 2. We are educating each other to be careful when using these apps.
Post reply on HN