Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are sorry

blog.path.com

Post reply on HN
Print view View original

41–50 of 220 posts

Re: We are sorry

#41

Post by k-mcgrady »

I was very critical of Path yesterday. Their initial response didn't really address the issue and was basically an excuse. But this has restored my faith. I never believed they were doing anything malicious with the data but the fact that they bill themselves as a trusted/private social network leads me to want to hold them to a higher standard.

The big thing in this apology is that they have deleted all the data. That was a good move and shows they listened to complaints. The app update is also smart. Hopefully they will implement a better friend finding system soon (maybe using the hashing ideas put forward in yesterdays HN thread).

Re: We are sorry

#43

Post by cdh »

mistermann wrote: post #11
josegonzalez wrote: post #8

Earlier quoted context omitted.

"So, as a clear signal of our commitment to your privacy, we’ve deleted the entire collection of user uploaded contact information from our servers." That sounds like exactly what you were hoping for.

Except for the "and then implement hashing from here on out." part. So, they haven't changed their implementation, they've just added the ability to opt out of the poor implementation.

So you can opt out then, since they're not doing enough to address your concerns. They're being upfront about it, though, and putting that choice in your hands.

Re: We are sorry

#44

Post by thought_alarm »

They really need to update their privacy policy, which is currently mostly generic nonsense. https://path.com/privacy

Regardless of whether they throw up a confirmation prompt, their privacy policy needs to clearly describe what information is scraped from your phone, how it's used, and how long it's retained.

Re: We are sorry

#45

Post by r00fus »

unreal37 wrote: post #35
lopatin wrote: post #2

I have a question about how they store the contacts. Can't they encrypt each of the phone numbers before they get sent to the server? This way there's no breach of privacy and the friend suggestion feature still works for everyone.

That wouldn't add any real protection. Phone numbers is a very small set (100 million possible in the U.S. and Canada). A rainbow table of all possible combinations can be created in only a week or two.

However, phonenumber+userid creates lots of nice unique hashes.

If they are going to hash the data, they should salt it (and possibly use key strengthening a la bcrypt, etc).

Re: We are sorry

#47

Post by benwerd »

It's not a perfect solution, but I don't understand why Path don't hash the contact details before uploading them, and check against the hashes. You can still infer all kinds of social graph information, of course, but they're at least not consuming raw contact details.

Re: We are sorry

#48

Post by jfarmer »

Give credit where credit is due. Zynga would never in a million years do this. Facebook probably wouldn't, either.

Dave's message is straightforward and sincere.

Re: We are sorry

#49

Post by forgotAgain »

If you accept and later decide you would like to revoke this access, please send an email to service@path.com and we will promptly see to it that your contact information is removed.

My only qualm is that you can't revoke the permission from within the app. The opt-out should be as easy as the opt-in.

Re: We are sorry

#50

Post by gaving »

Not bad, but could have done without the "As we continue to expand and grow we will make some mistakes along the way." sentence.
Post reply on HN