Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your address book is mine: Many iPhone apps take your data

venturebeat.com

Post reply on HN
Print view View original

41–50 of 56 posts

Re: Your address book is mine: Many iPhone apps take your data

#41

Post by feralchimp »

hammock wrote: post #34
feralchimp wrote: post #22

> On the web, Twitter informs its members that it stores contacts for up to 18 months, and may use contact information to make “Who To Follow” suggestions. Twitter is the only one of these services I use, and when I read that line it took me 5 minutes to decide whether to actually uninstall the Twitter client from my phone. I decided to try to get this bad news from the horse's mouth. https://twitter.com/privacy cont…

You think what you've quoted from their privacy policy exonerates Twitter, but you may simply be misinterpreting it. Twitter Inc. has acknowledged that after mobile users tap the "Find friends" feature on its smartphone app, the company downloads users' entire address book, including names, email addresses and phone numbers, and keeps the data on its servers for 18 months. The company also said it plans to update its…

> You think what you've quoted from their privacy policy exonerates Twitter, but you may simply be misinterpreting it.

Exonerates? Not at all!

My point was just that (contrary to the article) Twitter doesn't make any claims whatsoever about how long they hold your Address Book data.

In fact, since it's mentioned along with other "data with which users may customize their account," that sort of implies that they consider it an integral and permanent part of your customized account profile. If someone told me that the data stays around until I choose to delete my account, I don't see anything in the privacy policy that would contradict that.

Re: Your address book is mine: Many iPhone apps take your data

#42

Post by baddox »

chubs wrote: post #10

What if your address book was hashed (sha1, bcrypt) and then uploaded? In that case, all that would be uploaded is a list of hashes for the email addresses or phone numbers of people i know. Then, when another person signs up for an account, it's easy to see who they should suggest they should join, but nowhere is any personal data being stored. Sounds like it'd work to me?

If users aren't asked for access to their address book, this is still a potential public relations nightmare, since many people will inevitably be distressed that a company will be able to know who was in your address book even if they don't know those people's phone numbers.

Re: Your address book is mine: Many iPhone apps take your data

#43

Post by unfletch »

shalmanese wrote: post #7

I don't think anyone has ever had a problem with explicitly asking and allowing users to opt-out. Apps that do that shouldn't be lumped in with the other ones.

Which ones are lumped in? Facebook and Instapaper are explicitly mentioned as examples of apps that prompt for permission before accessing the address book. Instagram, Foursquare and Path's prompts are only mentioned in passing, but those apps only added a prompt after the original story broke a week or so ago.

Re: Your address book is mine: Many iPhone apps take your data

#44

Post by baddox »

harryh wrote: post #40
baddox wrote: post #9

Earlier quoted context omitted.

How so? For one thing, there's no way to know if they're even being honest about whether they store the data.

That's certainly true, but at some level you have to trust us right? Consider that the whole basis of foursquare is that you're telling us where you're going or using us to figure out where to go next. That information is probably a lot more sensitive than your address book. I think we've earned that trust over the past 3 years, and will continue to earn it over and over again into the future by sticking to our word…

That's essentially what I'm saying. Installing an app on a phone with personally information is implicitly trusting the developers of that app. A least for technical people, it would be foolish to blindly trust a phone manufacturer's sandboxing and policies.

Re: Your address book is mine: Many iPhone apps take your data

#45

Post by Intermernet »

Just wondering if you could:

1. Hash first on the device (SHA-2, no salt) after converting to common case and removing extraneous characters from contact data. 2. Send hashes over secure connection (SSL, TLS). 3. Hash again on the server (SHA-2, salted with value known only to service provider) 4. Delete all data a reasonable time after comparison / mapping is done.

This way, although it's not unbreakable, there are the advantages of:

- Encrypted, pre-hashed data over the wire. - Easily comparable data on the server. - Reasonably secure server side storage as long as the salt is secured.

Dumb idea?

Re: Your address book is mine: Many iPhone apps take your data

#46

Post by chubs »

harryh wrote: post #38
chubs wrote: post #26

Earlier quoted context omitted.

You're right in the case of SHA1. However, with a suitable work factor, you can't bruteforce bcrypt AFAIK

1) bcrypt uses salts so that won't work at all 2) if you use some other computationally expensive hash you run into the problem of low powered mobile hardware. Remember you're not hashing 1 thing, but dozens or hundreds of phone numbers or email addresses.

You know, i think you're right - if we use different salts for each emails/phones, there'd be no way of ensuring that different users use the same salts, or even if we stored the salt along with the hash, it wouldn't be much use. Hmm this is a tricky problem!

Re: Your address book is mine: Many iPhone apps take your data

#47

Post by ChrisLTD »

itg wrote: post #6

I really think Apple needs to do something here with their next update. For every company that does the right thing by asking permission first, who knows how many are being sneaky.

Yes. The API should be updated now to require a permissions modal before an app can access your address book. I'm actually shocked this wasn't built in to the SDK from day one.

Re: Your address book is mine: Many iPhone apps take your data

#48

Post by BillPosters »

dcosson wrote: post #21
feral wrote: post #15

Earlier quoted context omitted.

If you come home from work some day, to find Facebook employees going through your dumpster, are you going to be ok with that? Probably not, right? You know they want to gather as much data as possible, but you are angry, because you never gave them permission to go through your thrash. I think thats how some people feel if an application goes through their phonebook, when they didn't give it permission to; the phone…

That's a reasonable analogy, but I still think the anger should be directed at apple. The way I see it, it's like I told my friend to watch my sandwich for a minute and I come back and someone else is eating it because my friend had handed it to him. I'm going to be mad at my friend; the other guy took advantage of an opportunity to get a free sandwich, which I can hardly blame him for.

Analogy isn't needed at all. Address book uploaded without permission... enough said. To your second point, I agree, Apple should have a setting on the iPhone that denies ANYONE but the owner of the iPhone access to the address book. In addition, each app should be forced to ask for permission to use contacts. The ball is in Apple's court to explain.

Re: Your address book is mine: Many iPhone apps take your data

#49

Post by BillPosters »

itg wrote: post #6

I really think Apple needs to do something here with their next update. For every company that does the right thing by asking permission first, who knows how many are being sneaky.

Agreed. But you're being too kind on Apple. This is the worst privacy breach from Apple in iPhone's history.

No point blaming app programmers. The functionality for apps to acquire the address book without asking shouldn't exist.

Dear Apple, thank you for protecting me from adult material in the app store. But, can you... er, this is awkward... can you NOT GIVE MY ADDRESS BOOK AWAY WITHOUT MY PERMISSION? Thanks. And sorry for yelling, it's just, y'know, my address book and all.

Re: Your address book is mine: Many iPhone apps take your data

#50

Post by dedward »

dcosson wrote: post #13

Honestly, I don't understand the fuss. I thought everyone had figured out and come to terms with the fact years ago that social media is all about gathering as much data as possible. The degree of precision with which Facebook, Twitter, Linkedin, etc. recommend "people I might know" makes it pretty obvious that they know a lot about me, regardless of where they got the information from. And I don't blame them in the…

THe thing we're shocked about is that apps could access our address book and upload them wholesale to their servers without our knowledge or permission. That's a huge privacy violation.

Facebook knows about the connections I've told it about, or others have requested and I've approved.

Yes, it may be useful - but the address book on my phone is quite personal, and not something I would hand over to a 3rd party readily. There are people in there, let's say, who I wouldn't WANT people to know are in there. There may be people in there who hate other people in there.

So.. they can take my address book and do what they want with it? No amount of "cool stuff" adds up to allowing a 3rd party company to have the contents of my personal contact list, sorry. This is really bad.

Post reply on HN