Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Path uploads your entire iPhone address book to its servers

mclov.in

Post reply on HN
Print view View original

41–50 of 283 posts

Re: Path uploads your entire iPhone address book to its servers

#41

Post by phuff »

epaga wrote: post #23
brudgers wrote: post #15

From the Wikipedia entry [ http://en.wikipedia.org/wiki/Path_%28social_network%29 ]: "Contacts are suggested from among persons in a user's electronic address book, as well as people with whom the user is communicating by email." It's been there for over a year. http://en.wikipedia.org/w/index.php?title=Path_%28social_net...

Though it's quite a difference whether the contacts are checked client-side or all sent over to THEIR server including all (unnecessary) info.

How do you propose to check them client side? :) You still have to send each contact over to the server...

Re: Path uploads your entire iPhone address book to its servers

#44

Post by danso »

Dave Morin, Path's CEO just responded in a comment: http://mclov.in/2012/02/08/path-uploads-your-entire-address-...

>Arun, thanks for pointing this out. We actually think this is an important conversation and take this very seriously. We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends and family join Path. Nothing more.

>We believe that this type of friend finding & matching is important to the industry and that it is important that users clearly understand it, so we proactively rolled out an opt-in for this on our Android client a few weeks ago and are rolling out the opt-in for this in 2.0.6 of our iOS Client, pending App Store approval.

edit: Morin responds to a response http://mclov.in/2012/02/08/path-uploads-your-entire-address-...

To the suggestion that they just hash the addressbook entries:

> 1. This is a good alternative solution which we'll look into. Thanks for the idea.

Re: Path uploads your entire iPhone address book to its servers

#45

Post by vm »

Dave Morin's (Path CEO) response:

Arun, thanks for pointing this out. We actually think this is an important conversation and take this very seriously. We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends and family join Path. Nothing more.

We believe that this type of friend finding & matching is important to the industry and that it is important that users clearly understand it, so we proactively rolled out an opt-in for this on our Android client a few weeks ago and are rolling out the opt-in for this in 2.0.6 of our iOS Client, pending App Store approval.

Dave Morin Co-Founder and CEO of Path

Re: Path uploads your entire iPhone address book to its servers

#46

Post by tlrobinson »

0x0 wrote: post #39
trotsky wrote: post #9

Honest question: Isn't this within the kind of behavior that AppStore reviews are supposed to prevent, at least if there isn't an app specific functional explanation for it? Does Apple have a list of what kind of behavior like this is tolerated or does word just get out about what they don't reject?

Well, since you only ever only submit the compiled application binary to Apple, it'd be pretty darn hard for them to detect behaviour like this. Especially if the code to do so is obfuscated, and/or the data is smuggled out via SSL (or worse, steganography-style piggy-backed on to other data). Sometimes it's tempting to speculate whether the real purpose of the app store review team is just to ensure developers aren'…

They could do the same thing this guy did in an automated way (seed the device with unique data, sniff traffic for that that data), but as you said there are many ways to obfuscate it.

Re: Path uploads your entire iPhone address book to its servers

#47

Post by pashields »

I'm at a loss as to how this is surprising anyone. How did people think that these apps found other users you know? This is built to support: A) finding existing people on the service and B) so they can (theoretically) send you notifications if a friend joins. If you want those features (and it seems that users do), this is the only way to do it. Admittedly, most apps are more explicit about it with a "find friends from address book," but if you want to lower the friction as much as possible, this is the way to do it.

Re: Path uploads your entire iPhone address book to its servers

#48

Post by DrJokepu »

jonknee wrote: post #16
timjahn wrote: post #4

Earlier quoted context omitted.

If no explicit permission is given by the user, how is this practice not illegal?

Apple doesn't prompt the user to ask for permission when the APIs are used (like what happens with location), so this is the desired behavior. It's very simple: https://developer.apple.com/library/ios/#documentation/Addre...

However:

17.1 Apps cannot transmit data about a user without obtaining the user's prior permission and providing the user with access to information about how and where the data will be used

It's likely that this app will be pulled from the App Store within the next few hours.

Re: Path uploads your entire iPhone address book to its servers

#49

Post by Vitaly »

danso wrote: post #44

Dave Morin, Path's CEO just responded in a comment: http://mclov.in/2012/02/08/path-uploads-your-entire-address-... > Arun, thanks for pointing this out. We actually think this is an important conversation and take this very seriously. We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends…

You really don't need to upload address book for that. Sending just hash sum of each of phone, address, name, and email would be enough to make the matching.

Re: Path uploads your entire iPhone address book to its servers

#50

Post by tlrobinson »

danso wrote: post #44

Dave Morin, Path's CEO just responded in a comment: http://mclov.in/2012/02/08/path-uploads-your-entire-address-... > Arun, thanks for pointing this out. We actually think this is an important conversation and take this very seriously. We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends…

If all they care about is matching users up, couldn't they just use hashes of the relevant data?

EDIT: possibly even better, they could use a Bloom filter, similarly to how Chrome uses them to filter malicious websites without sharing your entire browsing history with Google.

Post reply on HN