Your address book is mine: Many iPhone apps take your data • Hacker News Board

Re: Your address book is mine: Many iPhone apps take your data

#11

Post by feral » Wed, Feb 15, 2012, 2:29 AM UTC

chubs wrote: post #10

What if your address book was hashed (sha1, bcrypt) and then uploaded? In that case, all that would be uploaded is a list of hashes for the email addresses or phone numbers of people i know. Then, when another person signs up for an account, it's easy to see who they should suggest they should join, but nowhere is any personal data being stored. Sounds like it'd work to me?

What problem would this solve?

If my problem is that I don't want Facebook to have the phone numbers in my address book, then surely I don't want them to have the SHA1 of each of the numbers in my address book, either?

Isn't it going to be easy for an organisation with Facebook's resources to build a dictionary of the space of SHA1s of phone numbers?

And if they salt the numbers, first, then they can't be compared with each other for suggestions? So whats the point?

Have I overlooked something?

Re: Your address book is mine: Many iPhone apps take your data

#12

Post by DenisM » Wed, Feb 15, 2012, 2:31 AM UTC

chubs wrote: post #10

What if your address book was hashed (sha1, bcrypt) and then uploaded? In that case, all that would be uploaded is a list of hashes for the email addresses or phone numbers of people i know. Then, when another person signs up for an account, it's easy to see who they should suggest they should join, but nowhere is any personal data being stored. Sounds like it'd work to me?

It would take laughably small time to bruteforce the phone number out of a hash. Knowing the algorithm I can compute all possible 10,000,000,000 combinations and store them in one file.

Same goes for hashing IPv4 addresses. There is no way to make eitther one secure by hashing.

Re: Your address book is mine: Many iPhone apps take your data

#13

Post by dcosson » Wed, Feb 15, 2012, 2:32 AM UTC

Honestly, I don't understand the fuss. I thought everyone had figured out and come to terms with the fact years ago that social media is all about gathering as much data as possible. The degree of precision with which Facebook, Twitter, Linkedin, etc. recommend "people I might know" makes it pretty obvious that they know a lot about me, regardless of where they got the information from. And I don't blame them in the least - these are all free consumer apps that can only exist by having a lot of users, so if they can get a few more by utilizing data that is right in front of them they'd be crazy not to use it. If anything, people should be angry at Apple. Considering how notoriously annoying their approval process is for the sole purpose of protecting their users, they probably should have made app permissions more explicit or let users opt out of individual permissions like facebook recently started allowing.

Additionally, nobody has touched on the fact that companies can use address books to prevent fraudulent use. For most of the companies listed there isn't too much to be gained from fraudulent use. But you can imagine for services that frequently have to address fraud and, say, don't want a single user to have multiple accounts or that want to make sure all their accounts are owned by real people, doing things like cross-validating address books can be very useful. This can still be done if you hash the names and phone numbers before uploading them, though, which is maybe what everyone should be doing.

tl;dr Data is money/power these days, it's strange that people are shocked by companies making use of all the data they have access to.

Re: Your address book is mine: Many iPhone apps take your data

#14

Post by yuhao » Wed, Feb 15, 2012, 2:39 AM UTC

That instagram screenshot clearly shows that the transmission is over https, which means that the whole "susceptible to would-be interceptors" thing invalid. That is, unless you're under attack by a man-in-the-middle proxy. If this is the case, then you have bigger issues on your hands. The foodspotting screenshot is over plain http, though, so it IS susceptible to a normal eavesdropping attack.

Re: Your address book is mine: Many iPhone apps take your data

#15

Post by feral » Wed, Feb 15, 2012, 2:40 AM UTC

dcosson wrote: post #13

Honestly, I don't understand the fuss. I thought everyone had figured out and come to terms with the fact years ago that social media is all about gathering as much data as possible. The degree of precision with which Facebook, Twitter, Linkedin, etc. recommend "people I might know" makes it pretty obvious that they know a lot about me, regardless of where they got the information from. And I don't blame them in the…

If you come home from work some day, to find Facebook employees going through your dumpster, are you going to be ok with that?

Probably not, right? You know they want to gather as much data as possible, but you are angry, because you never gave them permission to go through your thrash.

I think thats how some people feel if an application goes through their phonebook, when they didn't give it permission to; the phonebook is not information people consider public; its privileged. Thats where there's a fuss.

Re: Your address book is mine: Many iPhone apps take your data

#16

Post by dcosson » Wed, Feb 15, 2012, 2:46 AM UTC

DenisM wrote: post #12

chubs wrote: post #10

What if your address book was hashed (sha1, bcrypt) and then uploaded? In that case, all that would be uploaded is a list of hashes for the email addresses or phone numbers of people i know. Then, when another person signs up for an account, it's easy to see who they should suggest they should join, but nowhere is any personal data being stored. Sounds like it'd work to me?

It would take laughably small time to bruteforce the phone number out of a hash. Knowing the algorithm I can compute all possible 10,000,000,000 combinations and store them in one file. Same goes for hashing IPv4 addresses. There is no way to make eitther one secure by hashing.

But all we care about is making it look secure for the hobbyist packet sniffers, right? (kidding)

Although what about hardcoding a salt into the app to hash with?

Re: Your address book is mine: Many iPhone apps take your data

#17

Post by feralchimp » Wed, Feb 15, 2012, 2:53 AM UTC

DenisM wrote: post #12

chubs wrote: post #10

What if your address book was hashed (sha1, bcrypt) and then uploaded? In that case, all that would be uploaded is a list of hashes for the email addresses or phone numbers of people i know. Then, when another person signs up for an account, it's easy to see who they should suggest they should join, but nowhere is any personal data being stored. Sounds like it'd work to me?

It would take laughably small time to bruteforce the phone number out of a hash. Knowing the algorithm I can compute all possible 10,000,000,000 combinations and store them in one file. Same goes for hashing IPv4 addresses. There is no way to make eitther one secure by hashing.

Concatenate FirstName+LastName+emailAddress+phoneNumber, then hash or HMAC that.

Your lookup table just got a lot bigger.

Re: Your address book is mine: Many iPhone apps take your data

#18

Post by skybrian » Wed, Feb 15, 2012, 2:54 AM UTC

feral wrote: post #11

chubs wrote: post #10

What if your address book was hashed (sha1, bcrypt) and then uploaded? In that case, all that would be uploaded is a list of hashes for the email addresses or phone numbers of people i know. Then, when another person signs up for an account, it's easy to see who they should suggest they should join, but nowhere is any personal data being stored. Sounds like it'd work to me?

What problem would this solve? If my problem is that I don't want Facebook to have the phone numbers in my address book, then surely I don't want them to have the SHA1 of each of the numbers in my address book, either? Isn't it going to be easy for an organisation with Facebook's resources to build a dictionary of the space of SHA1s of phone numbers? And if they salt the numbers, first, then they can't be compared wi…

It avoids accidents. With plain text data, there is a lot of room for accidentally leaking private data (for example, to server logs). Building a sha1 dictionary isn't something you do by accident.

Re: Your address book is mine: Many iPhone apps take your data

#19

Post by uptown » Wed, Feb 15, 2012, 2:58 AM UTC

dcosson wrote: post #13

Honestly, I don't understand the fuss. I thought everyone had figured out and come to terms with the fact years ago that social media is all about gathering as much data as possible. The degree of precision with which Facebook, Twitter, Linkedin, etc. recommend "people I might know" makes it pretty obvious that they know a lot about me, regardless of where they got the information from. And I don't blame them in the…

What this whole line of stories has forced me to think more about than I had in the past is the question: "Why do these companies even exist? Why'd they even create the app they created?". Take Path ... what's its purpose? Are they developing it because they want to give people a better way of sharing photos with their friends? What's in it for them? Why would they even care? Furthermore, why does that information even matter? Ultimately, the only answer I keep coming back to is that the only reason these companies exist is to collect information, and re-purpose that information in the form of intelligent advertising, or other revenue-generation relationships they have with partner companies that find value in knowing as much about someone as possible in order to generate some portion of their overall revenue by using that information to their advantage. Same goes for FB, or any other social service.

I guess I'm just deflated in that while some aspects of these services enrich my life in some way by exposing me to information I might not otherwise have easy access to ... their primary reason for existence seems misguided from the start. A service built just to advance the quest towards personal or shared wealth feels unnecessarily shallow to me when the ingredients used to generate that wealth are of such a personal nature.

Re: Your address book is mine: Many iPhone apps take your data

#20

Post by bonzoesc » Wed, Feb 15, 2012, 2:59 AM UTC

feralchimp wrote: post #17

DenisM wrote: post #12

Earlier quoted context omitted.

It would take laughably small time to bruteforce the phone number out of a hash. Knowing the algorithm I can compute all possible 10,000,000,000 combinations and store them in one file. Same goes for hashing IPv4 addresses. There is no way to make eitther one secure by hashing.

Concatenate FirstName+LastName+emailAddress+phoneNumber, then hash or HMAC that. Your lookup table just got a lot bigger.

And the likelihood that you'll match somebody got a lot smaller. Names have different spellings, phone numbers have different spellings (to say nothing of different numbers), people have multiple emails. You can't canonicalize some of these either.