Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hipster (like Path) uploads your address book emails to its servers

markchang.tumblr.com

Post reply on HN
Print view View original

71–80 of 81 posts

Re: Hipster (like Path) uploads your address book emails to its servers

#71

Post by mike-cardwell »

FourSquareToo wrote: post #28

FourSquare Too. Here was their response to my complaint. Subject: Do you store my contacts? ------------------------------------------------------------------------------------------------------------------- ✆ via gmail.com 17/07/2011 to privacy Hi. I recently downloaded the Android Foursquare application. It automatically started scanning the contacts on my phone. Questions: 1. Does the application upload my contact…

From my perspective, after reading the above conversation, FourSquare provided a good level of support, and you were a rude and unnecessarily confrontational user.

Re: Hipster (like Path) uploads your address book emails to its servers

#72

Post by mike-cardwell »

alastairpat wrote: post #67
Greenisus wrote: post #7

As an iOS developer, I've been surprised all along that the SDK gives you full access to the address book without asking for permission (like Core Location and the Apple Push Notification Service). I've always thought that would one day change, and I suspect that posts like this and the one about Path will make that happen.

The problem is that making a change like requiring authorisation (à la Core Location) for Address Book would cause backwards compatibility hell.

iOS could prompt the user for permission when the contact list is accessed, with temporarily/permanently allow/deny options. If the user says yes, the app gets access, if the user says no, the app gets "spoofed" access, to an empty contact list.

Re: Hipster (like Path) uploads your address book emails to its servers

#73

Post by reidmain »

LaGrange wrote: post #69
jazzychad wrote: post #10

Surprise! Likewise, Instagram uploads your contact list to their servers (phone numbers, names, emails) to help find friends (confirmed with mitmproxy as well). At least you have to click "Find from my contact list" first. This practice is super-common. The last ordeal around this was a year or so ago with Kik, but then everyone stopped caring. At least Instagram is over https.

Uh, if they do it after clicking "Find from my contact list", this is totally different, that's opt-in. I do think it should be possible to opt-out from being findable this way, but that's a separate, if related issue.

There is also a difference between "uploads" and "sends".

If they send my address book to their servers, compare it with current users and then discard it that is pretty good for an opt-in process.

A lot of this seems to be they upload the address book to their servers and store it permanently. The fact that they don't state this and don't ask for permission is disturbing.

Re: Hipster (like Path) uploads your address book emails to its servers

#74

Post by reidmain »

FourSquareToo wrote: post #28

FourSquare Too. Here was their response to my complaint. Subject: Do you store my contacts? ------------------------------------------------------------------------------------------------------------------- ✆ via gmail.com 17/07/2011 to privacy Hi. I recently downloaded the Android Foursquare application. It automatically started scanning the contacts on my phone. Questions: 1. Does the application upload my contact…

The Foursquare app says that is wants the ability to access your address book and you gave it permission to do this by installing it.

You then press the "find my friends" button and are surprised by the fact that it sends information about your friends to Foursquare?

The only valid complaint you could have is if they stored the information on their server permanently but based on this conversation they don't which is the best procedure.

The second you click "find my friends" you've opted into this. How the hell do you think they are finding out who your friends are? Magic?

There is a fine line between annoying the user and doing things without their permission and in this scenario Foursquare is better than the majority of other applications out there.

Re: Hipster (like Path) uploads your address book emails to its servers

#75

Post by cbs »

jacobolus wrote: post #63
mahmud wrote: post #56

Earlier quoted context omitted.

Stop being such a zuck[1], calling security-consciouness "neckbearding". [1] A zuck: someone who, due to a combination of ignorance and malice, is dismissive of others' efforts to improve their security and protect their privacy.

I believe the “neckbearding” referred to berating this poor support staffer for his/her lack of technical expertise. The guy/gal was pretty clearly doing the best he/she could, and the responses from the “security conscious” user could have conveyed the same message with a lot less condescension.

The guy/gal was pretty clearly doing the best he/she could

Awww... The little guy was doing his best. Oh, wait. You're not talking about a puppy? but the customer-facing front of a company?

Re: Hipster (like Path) uploads your address book emails to its servers

#76

Post by cbs »

benologist wrote: post #9
zackzackzack wrote: post #3

Making a prediction: When you wake up tomorrow morning, the front page will be filled with stories like these about every type of app you can think of. It will only get worse from here.

Worse is an interesting choice of words .... if a bunch of companies get shamed into respecting people's privacy then that's great, and if it gets the ball rolling and triggers the wrath of app stores ... that's even better.

If companies could get shamed into doing anything, the world would be a different place. But to a company there is no such thing as shame, there is only the fear that public reaction will negatively impact their bottom line.

Re: Hipster (like Path) uploads your address book emails to its servers

#77

Post by pork »

cbs wrote: post #75
jacobolus wrote: post #63

Earlier quoted context omitted.

I believe the “neckbearding” referred to berating this poor support staffer for his/her lack of technical expertise. The guy/gal was pretty clearly doing the best he/she could, and the responses from the “security conscious” user could have conveyed the same message with a lot less condescension.

The guy/gal was pretty clearly doing the best he/she could Awww... The little guy was doing his best. Oh, wait. You're not talking about a puppy? but the customer-facing front of a company?

Strangely, qualified engineers and security experts keep turning down the consumer-facing support jobs.

Re: Hipster (like Path) uploads your address book emails to its servers

#78

Post by bri3d »

ryanpetrich wrote: post #47
bri3d wrote: post #14

I wrote a little MobileSubstrate (Jailbroken iPhone) shim to intercept the most common API used to access this data, block its use, and alert the user when it's happening. https://github.com/bri3d/AddressBookPrivacy/downloads It should be available in the BigBoss repository as "Address Book Privacy" sometime tomorrow. My tweak catches and displays the use of address book data as it happens, and based on my observatio…

ABAddressBookCopyArrayOfAllPeople is implemented as a direct branch to ABCCopyArrayOfAllPeople. Right after that are the ABAddressBookGetPersonWithRecordID and ABAddressBookGetPersonCountShowingLinks functions and they will be wiped out by the closure generated by MSHookFunction. The proper function to hook is ABCCopyArrayOfAllPeopleInSourceWithSortOrdering. See my similar package for an example: https://github.com/r…

This version is substantially better than mine - in addition to the correct hook mentioned in the parent comment, ryanpetrich's code uses a private CoreFoundation API rather than UIAlert which is both safe to access from non-main threads and blocking, making the tweak both simpler (no dispatch or blocks) and allowing it to pop up a "yes/no" dialog.

I've updated the README in my GitHub repo to point here and I'm considering ContactPrivacy a better replacement for AddressBookPrivacy at this time.

Here's to hoping Apple does something like this in a future release of iOS.

Post reply on HN