Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Path uploads your entire iPhone address book to its servers

mclov.in

Post reply on HN
Print view View original

131–140 of 283 posts

Re: Path uploads your entire iPhone address book to its servers

#131

Post by drunkenmasta »

pclark wrote: post #103

I find it mind blowing that (in the comments of the blog post) someone asked the Path CEO: > Why wasn't this [sending all the contacts to your servers without users knowing] an opt-in situation to begin with? Isn't that against Apple's own T&Cs? and the Path CEO replied: > This is currently the industry best practice and the App Store guidelines do not specifically discuss contact information. However, as mentioned,…

Your message was not lost on me. The mind blowing part (to me) is that it takes years before some average Joe (not necessarily security "expert" by profession) decides to take a look at the logs to see what is REALLY going on behind the curtains - revealing something huge like this. Like you write, unless explicitly stated, companies will default to whatever is in their best interests, which is why Facebook going public should be a worrying thing for those users. As someone wrote, "if you are getting something for free you are not the customer, you are the product."

Re: Path uploads your entire iPhone address book to its servers

#132

Post by bri3d »

This sounds like a wonderful Cydia / iOS Jailbreak app opportunity. MobileSubstrate allows easily hooking system methods. An app which replaces the Address Book API with something returning empty data for all non-system apps seems pretty easy and quite urgent.

Morin and company need to provide an "opt-out and wipe all of my contact data now" option if they don't want legal action and backlash, as well. Simply making the app require opt-in to share this data in the future isn't nearly enough (and, especially in the EU, isn't legal).

Update: I'm working on a MobileSubstrate tweak to neuter AB* functions in non-Apple apps, and it's now possible to get your information wiped from Path... by emailing service@path.com.

Re: Path uploads your entire iPhone address book to its servers

#133

Post by reidmain »

spullara wrote: post #125
reidmain wrote: post #58

Earlier quoted context omitted.

Really? It asks for location access to get access to your asset library? That is pretty stupid. Thanks for the heads up. I was unaware of the AssetLibrary framework.

This is because the photos contain GPS data about where they were taken.

Ah that would make sense. So that would mean that if you turn off location services any app could access your asset library without any prompt then. Good to know.

Re: Path uploads your entire iPhone address book to its servers

#134

Post by masonlee »

frederickcook wrote: post #36
dsplittgerber wrote: post #13

Earlier quoted context omitted.

Which apps do that? Do you have a list? Can anything be done about the data after-the-fact?

Facebook, Foursquare, Twitter, basically any app that allows you to "search my address book for friends" will do this. All these services require either a email or phone number to sign up, so to search for friends who have also signed up for the service, you need to compare two data sets: emails or phone numbers of users you already have, and those in the person's address book. You obviously wouldn't download your en…

The addresses from the user's address book should be hashed before sending to the server and compared to hashed addresses on the server. Then only positive matches are registered, and the server doesn't see more private information than it needs.

Re: Path uploads your entire iPhone address book to its servers

#135

Post by renegadedev »

> industry best practice

Did he say that with a straight face? Heard a lot of corporate BS in my time but this takes the cake.

This is Apple's fault for allowing all apps access to the address book. But there is a deeper issue here, trust. Just because I leave my office unlocked doesn't mean my colleagues can steal from it.

I love this app and had great hopes for it but trust is a limited commodity and Path just lost mine.

Re: Path uploads your entire iPhone address book to its servers

#136

Post by dumdumacct »

pclark wrote: post #103

I find it mind blowing that (in the comments of the blog post) someone asked the Path CEO: > Why wasn't this [sending all the contacts to your servers without users knowing] an opt-in situation to begin with? Isn't that against Apple's own T&Cs? and the Path CEO replied: > This is currently the industry best practice and the App Store guidelines do not specifically discuss contact information. However, as mentioned,…

Really? Apple would never do this? http://radar.oreilly.com/2011/04/apple-location-tracking.htm...

Re: Path uploads your entire iPhone address book to its servers

#137

Post by gmac »

maxerickson wrote: post #77
jd wrote: post #67

Earlier quoted context omitted.

Not that small. It's comparable to a weak password. There are about 5 billion active phone numbers in the world [1]. Besides, a small search space can only be searched quickly if it takes little time to a hash a phone number. Doing a few billion MD5-sums is not so difficult. If the hashes are computed with an expensive bcrypt then it's just a matter of increasing the number of iterations to make brute force attacks u…

The client could do 'signed' hashes using the local phone number and the friend number (sending the server both the local:friend pair and the friend:local pair). That wouldn't really stop anybody from reversing the hashes, but it would make a global rainbow table useless.

It would make reversing the hashes substantially harder for any given hash function, though, right? Thanks very much for this idea. I'd thought about tracking social connections by sending hashes (on an explicit and opt-in basis) for my research app, Mappiness[1], but gave up the idea mainly because hashing seemed so hopelessly weak. But I think this + bcrypt might make it workable.

1. mappiness.org.uk

Re: Path uploads your entire iPhone address book to its servers

#138

Post by mishmash »

AJ007 wrote: post #126
United857 wrote: post #120

Earlier quoted context omitted.

While I still support Path, the best PR move they could do right now is to pro-actively wipe all non-members' contact info from their servers, and then fast-track approval of the new "opt-in" version to the App Store, so that users can re-upload. Played right, this episode could actually give them free publicity. Companies like Facebook and Zynga have been embroiled in far worse controversies, and they've all blown o…

That's not a PR move, that's what you do while crossing your fingers that state attorney generals and the FTC doesn't come after you.

I've just:

  1) saved their Privacy Policy and Terms of Use
  2) requested a complete deletion of our family's account
  3) requested deletion of any/all stored information
  4) considering contacting our lawyer
As I emailed to Path's support, our 3-4 year old children's schools, bus companies, physicians, pharmacies and our family lawyer were in that contact list - that's an insane, willful, and quite unexpected violation of our privacy.

Worse, it could have easily been solved by adding an entry to their Privacy Policy (under the "What Personal Information Do We Collect?" section) and/or a simple dialog prompt.

Unbelievable.

Re: Path uploads your entire iPhone address book to its servers

#139

Post by mishmash »

unreal37 wrote: post #118
mishmash wrote: post #42

It would be nice to go a single week without seeing how utterly complete the notion of privacy has been destroyed.

Here's a question: was there a concept of privacy 100 years ago? Or 500? Whenever someone had a baby, or bought a cow, or had an affair on their spouse, didn't everyone in town know about it? Did they ask people's permission when the first telephone book was published? Or was the first response, "hey, that's an invasion of my privacy!" I doubt anyone said that before the 1950's. I think privacy is an invention of the…

Your comment seems trollishly silly, but... the internet and residential electricity are also both inventions of the 20th century - I guess we could destroy those too without bothering you?

Re: Path uploads your entire iPhone address book to its servers

#140

Post by thought_alarm »

Has anyone looked at Path's privacy policy?

Do they explicitly state that what personal information they download to their servers, what they use it for, and how long they retain it?

If not then they're breaking the law in many countries, regardless of what Apple's current developer guidelines happen to be.

Post reply on HN