There's a fine difference between uploading and storing, and uploading and not storing.
The issue with Path is that they stored the data. Instagram and 4Square do not. They have to re-crunch the "numbers."
Your address book is mine: Many iPhone apps take your data
31–40 of 56 posts
Re: Your address book is mine: Many iPhone apps take your data
#32Earlier quoted context omitted.
You're right in the case of SHA1. However, with a suitable work factor, you can't bruteforce bcrypt AFAIK
I'm pretty sure the parent meant "precompute" (e.g. a rainbow table), not "brute force".
Again: you're right in the case of SHA1, but rainbow tables don't apply to bcrypt because of the varying work factor, also you can use a different salt for each person.
Crypto is actually really cool these days, there's pretty much a solution to every weakness :)
Re: Your address book is mine: Many iPhone apps take your data
#33"All your address books are belong to us!"
Re: Your address book is mine: Many iPhone apps take your data
#34> On the web, Twitter informs its members that it stores contacts for up to 18 months, and may use contact information to make “Who To Follow” suggestions. Twitter is the only one of these services I use, and when I read that line it took me 5 minutes to decide whether to actually uninstall the Twitter client from my phone. I decided to try to get this bad news from the horse's mouth. https://twitter.com/privacy cont…
You think what you've quoted from their privacy policy exonerates Twitter, but you may simply be misinterpreting it.
Twitter Inc. has acknowledged that after mobile users tap the "Find friends" feature on its smartphone app, the company downloads users' entire address book, including names, email addresses and phone numbers, and keeps the data on its servers for 18 months. The company also said it plans to update its apps to clarify that user contacts are being transmitted and stored.
The company's current privacy policy does not explicitly disclose that Twitter downloads and stores user address books.
It does say that Twitter users "may customize your account with information such as a cellphone number for the delivery of SMS messages or your address book so that we can help you find Twitter users you know."
As with many online social services, Twitter allows users to look for friends that are also registered users. In the case of Twitter's iPhone app, users see a screen noting that the service will "Scan your Contacts for people you already know on Twitter." The short description of the feature does not mention that it also downloads every entry in the address book and stores it.
Twitter's current privacy policy notes that some categories of "Log Data" are stored for up to 18 months.
"Log Data may include information such as your IP address, browser type, the referring domain, pages visited, your mobile carrier, device and application IDs, and search terms," the policy says. "Other actions, such as interactions with our website, applications and advertisements, may also be included in Log Data."
http://www.latimes.com/business/technology/la-fi-tn-twitter-...
Re: Your address book is mine: Many iPhone apps take your data
#35Earlier quoted context omitted.
I'm pretty sure the parent meant "precompute" (e.g. a rainbow table), not "brute force".
Again: you're right in the case of SHA1, but rainbow tables don't apply to bcrypt because of the varying work factor, also you can use a different salt for each person. Crypto is actually really cool these days, there's pretty much a solution to every weakness :)
So your solution to providing a "secure" way to compare phone numbers, etc, between users is to make the hashes non-comparable? Remember, the goal is to make it so two people can come up with the same hash in order to "find" each other.
Re: Your address book is mine: Many iPhone apps take your data
#36Earlier quoted context omitted.
So send multiple hashes per contact! Feral, Chimp, myEmail, myDeskPhone, myCellPhone H1 = sha1(Feral-Chimp-myEmail-myDeskPhone-myCellPhone) H2 = sha1(F-Chimp-myEmail-myDeskPhone-myCellPhone) H3 = sha1(Feral-C-myEmail-myDeskPhone-myCellPhone) H4 = sha1(F-C-myEmail-VALUEOMITTED-VALUEOMITTED) ... ... So flexibility is available, it's just more computationally expensive for the server to do the extra comparisons. The has…
Not all names are simple or even computable transforms though. How do you deal with entries like "Mom" or "Steve," names like "St. Clair" that may be entered dozens of different ways, or non-English names like "姚明" that may have dozens or hundreds of different possible romanizations, anglicizations, francizations, and spellings under any other language? How much extra battery are you willing to spend, and more import…
[deleted]
Re: Your address book is mine: Many iPhone apps take your data
#37Earlier quoted context omitted.
So send multiple hashes per contact! Feral, Chimp, myEmail, myDeskPhone, myCellPhone H1 = sha1(Feral-Chimp-myEmail-myDeskPhone-myCellPhone) H2 = sha1(F-Chimp-myEmail-myDeskPhone-myCellPhone) H3 = sha1(Feral-C-myEmail-myDeskPhone-myCellPhone) H4 = sha1(F-C-myEmail-VALUEOMITTED-VALUEOMITTED) ... ... So flexibility is available, it's just more computationally expensive for the server to do the extra comparisons. The has…
Not all names are simple or even computable transforms though. How do you deal with entries like "Mom" or "Steve," names like "St. Clair" that may be entered dozens of different ways, or non-English names like "姚明" that may have dozens or hundreds of different possible romanizations, anglicizations, francizations, and spellings under any other language? How much extra battery are you willing to spend, and more import…
> How do you deal with entries like "Mom" or "Steve," names like "St. Clair" that may be entered dozens of different ways, or non-English names like "姚明" that may have dozens or hundreds of different possible romanizations, anglicizations, francizations, and spellings under any other language?
That's sort of beside the point, though. The question is: How does uploading my Address Book information provide a much more efficient or complete solution to that set of problems? I don't think that it does. In each case, you're dependent on heuristics and sometimes those heuristics are going to miss a match. If I were Twitter, I'd happily accept those misses in exchange for hitting the matches where people spell each other's first names and email addresses consistently (for example).
> how much effort are you willing to spend running your users' batteries down for something that you'd never yourself use?
You lost me there. My point was just that for Twitter, my iPhone CPU/battery are an "externality." So while they might spend more cycles doing server-side comparisons on the hashes my phone sends over, at least they're not paying to compute the hash values.
Re: Your address book is mine: Many iPhone apps take your data
#38Earlier quoted context omitted.
It would take laughably small time to bruteforce the phone number out of a hash. Knowing the algorithm I can compute all possible 10,000,000,000 combinations and store them in one file. Same goes for hashing IPv4 addresses. There is no way to make eitther one secure by hashing.
You're right in the case of SHA1. However, with a suitable work factor, you can't bruteforce bcrypt AFAIK
1) bcrypt uses salts so that won't work at all
2) if you use some other computationally expensive hash you run into the problem of low powered mobile hardware. Remember you're not hashing 1 thing, but dozens or hundreds of phone numbers or email addresses.
Re: Your address book is mine: Many iPhone apps take your data
#39Earlier quoted context omitted.
Concatenate FirstName+LastName+emailAddress+phoneNumber, then hash or HMAC that. Your lookup table just got a lot bigger.
And the likelihood that you'll match somebody got a lot smaller. Names have different spellings, phone numbers have different spellings (to say nothing of different numbers), people have multiple emails. You can't canonicalize some of these either.
The engineer in me says you could soundex/metaphone the names before adding them to the hash. The rest of me says apps just shouldn't be doing this.
Re: Your address book is mine: Many iPhone apps take your data
#40Upload or Store? Path stored the data but I know 4sq does a search against it but does not store it. That can make a huge difference...
How so? For one thing, there's no way to know if they're even being honest about whether they store the data.
That's certainly true, but at some level you have to trust us right? Consider that the whole basis of foursquare is that you're telling us where you're going or using us to figure out where to go next. That information is probably a lot more sensitive than your address book.
I think we've earned that trust over the past 3 years, and will continue to earn it over and over again into the future by sticking to our word and being transparent about what happens to your data when you send it to us.
I'm not sure how else it could work?