Your address book is mine: Many iPhone apps take your data • Hacker News Board

Re: Your address book is mine: Many iPhone apps take your data

#21

Post by dcosson » Wed, Feb 15, 2012, 3:07 AM UTC

feral wrote: post #15

dcosson wrote: post #13

Honestly, I don't understand the fuss. I thought everyone had figured out and come to terms with the fact years ago that social media is all about gathering as much data as possible. The degree of precision with which Facebook, Twitter, Linkedin, etc. recommend "people I might know" makes it pretty obvious that they know a lot about me, regardless of where they got the information from. And I don't blame them in the…

If you come home from work some day, to find Facebook employees going through your dumpster, are you going to be ok with that? Probably not, right? You know they want to gather as much data as possible, but you are angry, because you never gave them permission to go through your thrash. I think thats how some people feel if an application goes through their phonebook, when they didn't give it permission to; the phone…

That's a reasonable analogy, but I still think the anger should be directed at apple. The way I see it, it's like I told my friend to watch my sandwich for a minute and I come back and someone else is eating it because my friend had handed it to him. I'm going to be mad at my friend; the other guy took advantage of an opportunity to get a free sandwich, which I can hardly blame him for.

Re: Your address book is mine: Many iPhone apps take your data

#22

Post by feralchimp » Wed, Feb 15, 2012, 3:08 AM UTC

> On the web, Twitter informs its members that it stores contacts for up to 18 months, and may use contact information to make “Who To Follow” suggestions.

Twitter is the only one of these services I use, and when I read that line it took me 5 minutes to decide whether to actually uninstall the Twitter client from my phone. I decided to try to get this bad news from the horse's mouth.

https://twitter.com/privacy contains Twitter's privacy policy. Does it actually say what the article claims?

TL;DR: No.

The number '18' occurs exactly once. It is used in this context:

Log Data: Our servers automatically record information ("Log Data") created by your use of the Services. Log Data may include information such as your IP address, browser type, the referring domain, pages visited, your mobile carrier, device and application IDs, and search terms. Other actions, such as interactions with our website, applications and advertisements, may also be included in Log Data. If we haven’t already deleted the Log Data earlier, we will either delete it or remove any common account identifiers, such as your username, full IP address, or email address, after 18 months.

The word 'contact' appears 5 times, in these contexts:

1. If you have any questions or comments about this Privacy Policy, please contact us at privacy@twitter.com.

2. We may use your contact information to send you information about our Services or to market to you.

3. If you email us, we may keep your message, email address and contact information to respond to your request.

4. If you become aware that your child has provided us with personal information without your consent, please contact us at privacy@twitter.com.

The phrase 'address book' appears once, in this context:

Additional Information: You may provide us with additional information to make public, such as a short biography, your location, or a picture. You may customize your account with information such as a cell phone number for the delivery of SMS messages or your address book so that we can help you find Twitter users you know.

Re: Your address book is mine: Many iPhone apps take your data

#23

Post by feralchimp » Wed, Feb 15, 2012, 3:19 AM UTC

bonzoesc wrote: post #20

feralchimp wrote: post #17

Earlier quoted context omitted.

Concatenate FirstName+LastName+emailAddress+phoneNumber, then hash or HMAC that. Your lookup table just got a lot bigger.

And the likelihood that you'll match somebody got a lot smaller. Names have different spellings, phone numbers have different spellings (to say nothing of different numbers), people have multiple emails. You can't canonicalize some of these either.

So send multiple hashes per contact!

Feral, Chimp, myEmail, myDeskPhone, myCellPhone

H1 = sha1(Feral-Chimp-myEmail-myDeskPhone-myCellPhone)

H2 = sha1(F-Chimp-myEmail-myDeskPhone-myCellPhone)

H3 = sha1(Feral-C-myEmail-myDeskPhone-myCellPhone)

H4 = sha1(F-C-myEmail-VALUEOMITTED-VALUEOMITTED)

...

So flexibility is available, it's just more computationally expensive for the server to do the extra comparisons. The hash calcs use a little extra battery per user, but I'm much happier to donate some of my processor/battery than I am my Address Book contents.

Re: Your address book is mine: Many iPhone apps take your data

#24

Post by loceng » Wed, Feb 15, 2012, 3:36 AM UTC

itg wrote: post #6

I really think Apple needs to do something here with their next update. For every company that does the right thing by asking permission first, who knows how many are being sneaky.

That would hurt the virality of their apps, and therefore not make their app ecosystem as useful (or as competitive, if competing with apps on other platforms).

Re: Your address book is mine: Many iPhone apps take your data

#25

Post by extension » Wed, Feb 15, 2012, 3:39 AM UTC

feral wrote: post #11

chubs wrote: post #10

What if your address book was hashed (sha1, bcrypt) and then uploaded? In that case, all that would be uploaded is a list of hashes for the email addresses or phone numbers of people i know. Then, when another person signs up for an account, it's easy to see who they should suggest they should join, but nowhere is any personal data being stored. Sounds like it'd work to me?

What problem would this solve? If my problem is that I don't want Facebook to have the phone numbers in my address book, then surely I don't want them to have the SHA1 of each of the numbers in my address book, either? Isn't it going to be easy for an organisation with Facebook's resources to build a dictionary of the space of SHA1s of phone numbers? And if they salt the numbers, first, then they can't be compared wi…

Facebook only knows the contacts that match i.e. are already on Facebook. And that's exactly what the user wanted to find out.

It's true that they could store the hashes and build a graph of mystery contacts, but that's still not as bad as taking the actual contact info.

Re: Your address book is mine: Many iPhone apps take your data

#26

Post by chubs » Wed, Feb 15, 2012, 3:44 AM UTC

DenisM wrote: post #12

chubs wrote: post #10

What if your address book was hashed (sha1, bcrypt) and then uploaded? In that case, all that would be uploaded is a list of hashes for the email addresses or phone numbers of people i know. Then, when another person signs up for an account, it's easy to see who they should suggest they should join, but nowhere is any personal data being stored. Sounds like it'd work to me?

It would take laughably small time to bruteforce the phone number out of a hash. Knowing the algorithm I can compute all possible 10,000,000,000 combinations and store them in one file. Same goes for hashing IPv4 addresses. There is no way to make eitther one secure by hashing.

You're right in the case of SHA1. However, with a suitable work factor, you can't bruteforce bcrypt AFAIK

Re: Your address book is mine: Many iPhone apps take your data

#27

Post by bonzoesc » Wed, Feb 15, 2012, 3:44 AM UTC

feralchimp wrote: post #23

bonzoesc wrote: post #20

Earlier quoted context omitted.

And the likelihood that you'll match somebody got a lot smaller. Names have different spellings, phone numbers have different spellings (to say nothing of different numbers), people have multiple emails. You can't canonicalize some of these either.

So send multiple hashes per contact! Feral, Chimp, myEmail, myDeskPhone, myCellPhone H1 = sha1(Feral-Chimp-myEmail-myDeskPhone-myCellPhone) H2 = sha1(F-Chimp-myEmail-myDeskPhone-myCellPhone) H3 = sha1(Feral-C-myEmail-myDeskPhone-myCellPhone) H4 = sha1(F-C-myEmail-VALUEOMITTED-VALUEOMITTED) ... ... So flexibility is available, it's just more computationally expensive for the server to do the extra comparisons. The has…

Not all names are simple or even computable transforms though. How do you deal with entries like "Mom" or "Steve," names like "St. Clair" that may be entered dozens of different ways, or non-English names like "姚明" that may have dozens or hundreds of different possible romanizations, anglicizations, francizations, and spellings under any other language?

How much extra battery are you willing to spend, and more importantly, how much effort are you willing to spend running your users' batteries down for something that you'd never yourself use?

Re: Your address book is mine: Many iPhone apps take your data

#28

Post by mattgreenrocks » Wed, Feb 15, 2012, 4:00 AM UTC

loceng wrote: post #24

itg wrote: post #6

I really think Apple needs to do something here with their next update. For every company that does the right thing by asking permission first, who knows how many are being sneaky.

That would hurt the virality of their apps, and therefore not make their app ecosystem as useful (or as competitive, if competing with apps on other platforms).

"Virality" of apps is not a problem users should bear. Good apps will be evangelized by users if they are genuinely useful. I'm suspicious of the utility* of apps that need to goad non-users into joining.

* Usually, 'utility' is not the primary driver of these apps, it is more in building a large userbase quickly so VC attention can be garnered.

Re: Your address book is mine: Many iPhone apps take your data

#29

Post by quesera » Wed, Feb 15, 2012, 4:04 AM UTC

chubs wrote: post #26

DenisM wrote: post #12

Earlier quoted context omitted.

It would take laughably small time to bruteforce the phone number out of a hash. Knowing the algorithm I can compute all possible 10,000,000,000 combinations and store them in one file. Same goes for hashing IPv4 addresses. There is no way to make eitther one secure by hashing.

You're right in the case of SHA1. However, with a suitable work factor, you can't bruteforce bcrypt AFAIK

I'm pretty sure the parent meant "precompute" (e.g. a rainbow table), not "brute force".

Re: Your address book is mine: Many iPhone apps take your data

#30

Post by quesera » Wed, Feb 15, 2012, 4:09 AM UTC

dcosson wrote: post #16

DenisM wrote: post #12

Earlier quoted context omitted.

It would take laughably small time to bruteforce the phone number out of a hash. Knowing the algorithm I can compute all possible 10,000,000,000 combinations and store them in one file. Same goes for hashing IPv4 addresses. There is no way to make eitther one secure by hashing.

But all we care about is making it look secure for the hobbyist packet sniffers, right? (kidding) Although what about hardcoding a salt into the app to hash with?

Salting wouldn't help. The data is collected to match it to other users' data, so the salt would have to be identical for all hashes for all users. An attacker would just precompute the dictionary with the hard coded salt, nullifying its purpose.