Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Path uploads your entire iPhone address book to its servers

mclov.in

Post reply on HN
Print view View original

171–180 of 283 posts

Re: Path uploads your entire iPhone address book to its servers

#171

Post by vectorpush »

steve8918 wrote: post #167
pclark wrote: post #103

I find it mind blowing that (in the comments of the blog post) someone asked the Path CEO: > Why wasn't this [sending all the contacts to your servers without users knowing] an opt-in situation to begin with? Isn't that against Apple's own T&Cs? and the Path CEO replied: > This is currently the industry best practice and the App Store guidelines do not specifically discuss contact information. However, as mentioned,…

Wait: What about MY INFORMATION if I've never installed Path? If someone I know with my contact information installs Path, does that mean that my information is stored on their servers? How can I remove my information if I've never installed Path before? It doesn't seem right that my contact information, which I have kept private, because someone I know has uploaded that information. Do I not have a right to keep tha…

This is an important point, but it's an issue that would arise even if Path allowed voluntary opt-in for contact scraping.

Re: Path uploads your entire iPhone address book to its servers

#172

Post by munin »

nl wrote: post #166
munin wrote: post #121

Earlier quoted context omitted.

open source software can collect exactly the same information on you. there was a furor recently where it was revealed that OS X and Windows collect data on what access points you have associated with. what was omitted was that linux does exactly the same thing: the wireless subsystem has a debug print (at a debug info level turned on in all major distributions) that will log the MAC address of the AP you just associ…

I think I'm missing something. You think people should be upset because a Linux computer knows the MAC address of the AP you are associated with? If that is a problem, then imagine what people will think when they realize that the computer knows what keys you press on the keyboard (!!??) There is only a problem if the operating system shares information with 3rd parties without authorization.

the furor (at least, that I saw) was that the devices stored this information and would potentially let others look at it later.

it shouldn't be upsetting that your computer knows what keys you're pressing or what network you are affiliating with. recording that information permanently could be bad.

if you have an ubuntu laptop with wireless handy, run the following command:

sudo grep AssocResp /var/log/syslog

Re: Path uploads your entire iPhone address book to its servers

#173

Post by mikeash »

shalmanese wrote: post #162
mikeash wrote: post #158

Earlier quoted context omitted.

Don't forget about the possibility of Path's data being stolen. Your contacts probably contain enough info for a criminal to carry outa pretty good phishing expedition, for example.

My Facebook friends list is already public. Seems like a motivated criminal already has more than enough info to carry out a phishing expedition. I've never really seen targeted, personalized phishing though, most phishing seems to be broad and generic "enter your bank info here" style.

This common travel scam relies on knowing of at least a pair of friends:

http://www.lastminutetravel.com/blog/index.php/2010/01/08/tr...

More details would probably make it work better, too.

Re: Path uploads your entire iPhone address book to its servers

#174

Post by slykat »

I feel like this is [unfortunately] a regular practice of app makers nowadays. I'd love to abide by "let the industry govern itself" but I don't think that's realistic. I've seen so many apps that have abusive and opaque permissions.

Is there any regulation to protect consumers here? If not, are any legislators drafting any? Would the FTC step in or does this only happen when a giant like MSFT/GOOG/FB makes a mis-step?

Re: Path uploads your entire iPhone address book to its servers

#175

Post by biafra »

aw3c2 wrote: post #107
lurker17 wrote: post #95

Earlier quoted context omitted.

CyanogenMod allows the user to remove specific permissions frmo specific apps. If more users used CyanogenMod, more app developers would become compatible.

From what I have seen you can only remove those permissions "late". Ie you have to black list permissions, you cannot deny them right away. From my understanding this would not protect me fully since apps could do their thing before I disabled it.

As I understand it: They can't.

If you do not open them manually or restart you phone (if they have the permission RECEIVE_BOOT_COMPLETED) They are not executing. You can install them and revoke certain permissions before they are running for the first time.

Re: Path uploads your entire iPhone address book to its servers

#176

Post by CoreyReese2012 »

Path is a incredibly well designed product. Facebook mobile is a piece of s$$t product that i would never use. If the VCs are happy then it doesn't matter what you guys think. Path is incredibly well designed product, Dave Morin is a hero. You guys should stop complaining and go use the product.

Re: Path uploads your entire iPhone address book to its servers

#177

Post by LaGrange »

The fact that address-book upload should be opt-in is obvious, and was stated so many times here it was boring. But, there's also the other side: me, and quite a few of people I know, have good reasons to have an opt-out from being discoverable this way. If someone knows my email address, let them send me an email with an invitation code. They shouldn't even know I'm signed up until I accept.

Though I also don't really think it's something private companies should solve. Now, I can of course avoid services that let me be too easily findable, but the proper solution is to make said opt-out required by law. Otherwise it's just not beneficial for the company to provide it.

Re: Path uploads your entire iPhone address book to its servers

#178

Post by [deleted] »

jpmc wrote: post #94
encoderer wrote: post #87

Earlier quoted context omitted.

As an engineer at a different social network -- not Facebook, but not small, about 30 million users -- he's right. That fuNctionality is important. But we do it in way that preserves privacy. IMO this is just sloppy...

Are you in a position to elaborate on your method? Does it involve hash comparisons?

[deleted]

Re: Path uploads your entire iPhone address book to its servers

#179

Post by damptrousers »

mishmash wrote: post #138
AJ007 wrote: post #126

Earlier quoted context omitted.

That's not a PR move, that's what you do while crossing your fingers that state attorney generals and the FTC doesn't come after you.

I've just: 1) saved their Privacy Policy and Terms of Use 2) requested a complete deletion of our family's account 3) requested deletion of any/all stored information 4) considering contacting our lawyer As I emailed to Path's support, our 3-4 year old children's schools, bus companies, physicians, pharmacies and our family lawyer were in that contact list - that's an insane, willful, and quite unexpected violation o…

Lawyer? God, get a fucking grip. No wonder companies treat their users like morons.
Post reply on HN