Path uploads your entire iPhone address book to its servers

Post by phuff » Tue, Feb 07, 2012, 7:50 PM UTC

Vitaly wrote: post #49

danso wrote: post #44

Dave Morin, Path's CEO just responded in a comment: http://mclov.in/2012/02/08/path-uploads-your-entire-address-... > Arun, thanks for pointing this out. We actually think this is an important conversation and take this very seriously. We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends…

You really don't need to upload address book for that. Sending just hash sum of each of phone, address, name, and email would be enough to make the matching.

Post by 0x0 » Tue, Feb 07, 2012, 7:52 PM UTC

tlrobinson wrote: post #46

0x0 wrote: post #39

Earlier quoted context omitted.

Well, since you only ever only submit the compiled application binary to Apple, it'd be pretty darn hard for them to detect behaviour like this. Especially if the code to do so is obfuscated, and/or the data is smuggled out via SSL (or worse, steganography-style piggy-backed on to other data). Sometimes it's tempting to speculate whether the real purpose of the app store review team is just to ensure developers aren'…

They could do the same thing this guy did in an automated way (seed the device with unique data, sniff traffic for that that data), but as you said there are many ways to obfuscate it.

Post by harold » Tue, Feb 07, 2012, 7:55 PM UTC

Post by brador » Tue, Feb 07, 2012, 7:58 PM UTC

Terretta wrote: post #27

ajross wrote: post #21

Earlier quoted context omitted.

Android apps must explicitly request a READ_CONTACTS permission. But even there, no one actually reads those permissions lists, and apps routinely ask for far more than they need. User authorization is a very weak security mechanism in the consumer space.

Like FB apps, even legit Android apps ask for the moon, with no option to dole out granular permissions. "The Weather Channel" is a default icon suggesting a free download on the Kindle Fire. It asks for: Set the wallpaper Send SMS messages Write to external storage Access info about Wi-Fi networks Access coarse location Initiate a phone call without going through the Dialer user interface for the user to confirm the…

Post by jonknee » Tue, Feb 07, 2012, 7:59 PM UTC

DrJokepu wrote: post #48

jonknee wrote: post #16

Earlier quoted context omitted.

Apple doesn't prompt the user to ask for permission when the APIs are used (like what happens with location), so this is the desired behavior. It's very simple: https://developer.apple.com/library/ios/#documentation/Addre...

However: 17.1 Apps cannot transmit data about a user without obtaining the user's prior permission and providing the user with access to information about how and where the data will be used It's likely that this app will be pulled from the App Store within the next few hours.