9 ms·

‘Anonymous’ Chat App Hijacks Contact Data

73 points by dsr12 9y ago

GrumpyNl 9y ago
What did you expect? Its in their terms, but nobody reads them.
tobyhinloopen 9y ago
"Never Attribute to Malice That Which Is Adequately Explained by Stupidity" or something like that
- friendzis 9y ago
  The further into the future we are, the more I start to believe inverse to be true in general, not only in security world. For some reason in security world a neat extra breaking security is treated as possible intentional backdoor. Without treating mistakes, incompetencies, outright stupidities as malicious, we grow a new generation of technologists (including me, sadly), who do not bother to become adept in problem domain, consult with experts, perform strict analysis, cause tons of technical debt for the sake of moving fast. Good enough is the norm. We still see plain text, hashed without salt, hashed with the same salt password databases leaked. Maybe it was incompetence. Maybe it was stupidity. Maybe it was FIXME. Maybe the loaded gun was left on dinner table near a toddler because "I'm only going to bathroom". This is rhetoric question: can this stupidity be seen as malicious?
- bjt2n3904 9y ago
  Oops. We accidentally wrote our app to send your contacts list to our servers, to a URL which handled the incoming data.
- squarefoot 9y ago
  True but errors due to stupidity should distribute randomly. When they do the damage in one direction only, I smell malice.
nthcolumn 9y ago
From the FAQ: "Is Sarahah a hacker?! Sarahah doesn't steal data but websites and apps impersonating Sarahah could do that". Just weird. Why would a 'personal suggestion box' app need your contacts anyway apart from the developer's own dastardly plans? It seems they are sent in the clear as well. I think this upsets me the most. How did she expect to get away with it?
McPepper 9y ago
Access and hijacks are two different terms, one implies to use and the other implies to sell customer data. What the article says that the app accesses contacts for a future 'find your friend' feature. What really bothers me is when the author says ' it’s possible Sarahah has harvested hundreds of millions of names, phone numbers, and email addresses ". I believe I remember Snapchat and other social media apps done before. What Sarahah should have done is to communicate with their users about what their data and how they plan their security (being an anonymous messaging platform). But, let's not forget how Snapchat dealt with their security and data at its rise.
trdtaylor1 9y ago
Signal uses the same process. When you first install, it uploads all your contacts to 'see' which of your contacts are Signal users. It then defaults to Signal messages to that contact. Any new Signal user on your contact list alerts you to the fact they are now using Signal and helpfully defaults to Signal messaging. When you uninstall, you have to remove your number from their central DB using their web-app to prevent your friends from sending you Signal messages you won't be able to open. An implied "find my friend" feature that I assume Sarahah uses.
- tgragnato 9y ago
  Signal truncates the hashed phone numbers, before sending them to the server. The server responds with the contacts that you have in common.
  - StavrosK 9y ago
    Does it really? I suggested that exact scheme months ago, but moxie rejected it as "not meaningfully privacy-preserving" (probably not his exact words), IIRC. Edit: Here: https://github.com/WhisperSystems/Signal-Android/issues/4726 https://github.com/WhisperSystems/Signal-Android/issues/4726
    - epipping 9y ago
      Here’s what moxie said: „[..] Signal has always done contact intersection with an ephemeral query of truncated hashes of phone numbers.„ See also https://news.ycombinator.com/item?id=11979748 https://news.ycombinator.com/item?id=11979748
    - Canada 9y ago
      Yes, it really does. Signal takes the first 10 bytes of a SHA1 hash of the e164 number, base64s it. An array of these "tokens" are sent to the server at registration time and every 12 hours thereafter. You can confirm this on both client and server code on Github. The problem, which no one denies, is that the small number of possible valid e164 values leaves the scheme vulnerable. Also, last time I checked you could submit like 10k tokens at once, so using a modest amount of IP addresses and phone numbers to bypass the rate limiting it is feasible to determine every registered number in a city. Restricting this is hard because some people have huge address books. The Silent Circle method is slightly better in my opinion, but not by much so I understand why Moxie doesn't want to bother changing it. Back when Redphone was a separate app it used a bloom filter scheme. There are really no good solutions to this problem. The safer ones currently know just don't scale.
rvanmil 9y ago
I think we need more fine-grained contact permission options. Here's what an app on iOS can read and modify (!) when you allow it to access your contacts: https://developer.apple.com/documentation/contacts/contacts_constants https://developer.apple.com/documentation/contacts/contacts_...
- oliv__ 9y ago
  Wow. That's a lot of data!
- jordansmithnz 9y ago
  First time I looked at the framework, I expected to be able to read existing contacts, and create new contacts. I was a little surprised at editing existing contacts. Nothing is really stopping an app with permission switching all of your contact numbers so they point to someone else, whether by accident, or on purpose. It seems like something waiting to go wrong...
  - imaffett 9y ago
    Facebook did this years ago. It went through your contacts and updated any info (pictures, phone, email) to match what they had in Facebook.
- hakcermani 9y ago
  Yes! Its high time. Need read-only, specific groups only, read only a public profile. Of course that will be the end of these find your friends feature.
- calvinbhai 9y ago
  I'm working on an app that makes use of this in a good way (to add new contacts and remove duplicates with explicit action by the user). While doing some research on similar apps, I didn't find a single app that does not give the user an option to not upload the contacts to the app's servers. Basically if use doesn't give this permission, app is useless. I'm hoping the app I build will get a sustainable revenue without needing to uploading all contacts. But in the long run, for contact management apps, there's exponentially more value in handling the contacts data in the cloud, so that its users get the max benefit. But imo any app that's not for contact management (e.g., Facebook etc) should have limited read only access to the contacts data.
fareesh 9y ago
I simply assume they are going to upload my contact data whenever they prompt me for the permission. Not sure how iOS does permissions these days - do they also have runtime permissions like Android? I know that a lot of companies here in India skip the runtime permissions system entirely and ask for them all at install time to handle fewer edge cases in the code, and make the user less likely to be suspicious.
- lambada 9y ago
  iOS has had runtime permissions for far longer than android :) Some apps will even explain what they (claim to) need the permission for before triggering the permission authorisation pop up.
spacemonkey92 9y ago
One of the ios App I built needed contacts permission, but it's only within the app and never sent to my server. When I submitted it for review to Apple, they didn't approve the app asking the reason why I was accessing the contacts and if sending them to the server. Only if they are happy with the answer they will approve your app. So in a way, iOS apps are much secure than Android.
- bert_ 9y ago
  Ok, and what if you just lie in your answer?
  - sigzero 9y ago
    Nobody can do anything about that. That company ends up getting called out just like this one did or just like Accuweather did.
altotrees 9y ago
This is why you should always read the terms and conditions of an app. I'm always shocked at how many people do not take this seriously. In this age of "data sharing" it is super important to take extra caution.
- ceejayoz 9y ago
  That's not a solution. T&Cs are written as vaguely as possible to permit as much flexibility as possible, and nothing stops a malicious actor from violating their public privacy claims.
  - altotrees 9y ago
    It may not be a solution, but it's a smart thing to do and at least a step in the right direction, no?
    - ceejayoz 9y ago
      Not really. I tend to skim T&Cs and virtually every one I've seen has language that would probably permit this sort of behavior.
spacemanmatt 9y ago
ISTR LinkedIn did this, too.
Moru 9y ago
I often meet people that has a secret identity because a former boyfriend/girlfriend threatens them. They never know about apps harvesting their contacts and connecting them to common friends until their ex suddenly shows up again. This mindset of "If you havent done anything bad you dont have to worry" is so sad and ignorant of others situation.
- technofiend 9y ago
  This is the problem with an app assuming it understands your web of trust. There's no way to signal a toxic, unwanted or compartmentalized connection. It's also why I use multiple profiles in Android to force that compartmentalization since the snoopy apps have no context it's better to just deny them the data entirely.
robotbikes 9y ago
Facebook messenger does this as well, yet most people aren't aware of it, nor do they consent. There definitely should be much finer grain controls over this type of thing. Imagine how violated people would feel if they had to have someone take pictures of their address book (back when they were physical) just to enter the mall, yet this occurs every day and most are unaware.
fiatjaf 9y ago
Since no relationship is expected to last more than a few years these modern days, perhaps people should be educated to choose better their boy/girlfriends in view of what will happen after the breakup.
- bfred_it 9y ago
  Yes because the first thing people show on dates is their dark side. /s
- Can_Not 9y ago
  This is a really good example of cruel unjustified victim blaming and "sad and ignorant of others situation". We are all in awe of your high horse of hindsight.
- sctb 9y ago
  We detached this subthread from https://news.ycombinator.com/item?id=15139790 https://news.ycombinator.com/item?id=15139790 and marked it off-topic.
ap46 9y ago
Kind of a r/ShowerThoughts, we should maybe make an app & voluntarily fill our Contacts app with specific human like crap values & then sync all major apps with it thus peppering their gold-pots with waste contacts & by the time they catch up, the damage is already done. Rinse & repeat with slightly different values.
- xenopticon 9y ago
  The problem is that the big companies are not interested in phone numbers and names. The real gold are the connections - who you talk to more frequently, who are your real friends vs. random people you added, etc.
twsted 9y ago
Wasn't it what WhatsApp did years ago? And then Facebook acquired it and was able to complete its database of world's relationships.
yladiz 9y ago
One thing I hate is when apps do this to get information about your contacts, not only because they get who you personally know (and their phone number, email, other info in the contact) but also contacts for businesses you regularly might interact with, meaning they can potentially create a pretty detailed web of your life. For example, it's a dark pattern when you use Messenger, at least on iOS, for the first time and it says "Upload your contacts to find friends" with an "OK" button or "Learn More" button, and only after you click "Learn More" can you ignore it. WhatsApp does something worse; you can't initialize a message with anyone without allowing contacts, and the only way to add a contact is thru the phone app (the web app definitely doesn't, and I'm pretty certain the desktop app doesn't have the functionality to add a contact). I have to go thru great pains to prevent WhatsApp from getting my contact info, just to be able to add a new friend (turn off iCloud contacts, enable WhatsApp to see my contacts, then add the contact). Maybe I am paranoid, but I really, really want Facebook to only have the information I give it, and I don't trust WhatsApp at all. At least WhatsApp encrypts the messages. I really hate this pattern in apps, and I wish there was some way to give it some kind of "blank canvas" without any real contacts in it. Thankfully apps don't lock you completely out if you don't provide contact info, yet, but I fear it may happen soon.
- deleted 9y ago
  [deleted]
mmagin 9y ago
It's really sad that the ios/android model COULD be more secure than the traditional desktop software model, but at the same time it has normalized all sorts of creepy snooping behavior on the part of apps.

73 points by dsr12 9y ago

GrumpyNl 9y ago

What did you expect? Its in their terms, but nobody reads them.

tobyhinloopen 9y ago

"Never Attribute to Malice That Which Is Adequately Explained by Stupidity" or something like that

friendzis 9y ago
The further into the future we are, the more I start to believe inverse to be true in general, not only in security world. For some reason in security world a neat extra breaking security is treated as possible intentional backdoor. Without treating mistakes, incompetencies, outright stupidities as malicious, we grow a new generation of technologists (including me, sadly), who do not bother to become adept in problem domain, consult with experts, perform strict analysis, cause tons of technical debt for the sake of moving fast. Good enough is the norm. We still see plain text, hashed without salt, hashed with the same salt password databases leaked. Maybe it was incompetence. Maybe it was stupidity. Maybe it was FIXME. Maybe the loaded gun was left on dinner table near a toddler because "I'm only going to bathroom". This is rhetoric question: can this stupidity be seen as malicious?
bjt2n3904 9y ago
Oops. We accidentally wrote our app to send your contacts list to our servers, to a URL which handled the incoming data.
squarefoot 9y ago
True but errors due to stupidity should distribute randomly. When they do the damage in one direction only, I smell malice.

nthcolumn 9y ago

From the FAQ: "Is Sarahah a hacker?! Sarahah doesn't steal data but websites and apps impersonating Sarahah could do that". Just weird. Why would a 'personal suggestion box' app need your contacts anyway apart from the developer's own dastardly plans? It seems they are sent in the clear as well. I think this upsets me the most. How did she expect to get away with it?

McPepper 9y ago

Access and hijacks are two different terms, one implies to use and the other implies to sell customer data. What the article says that the app accesses contacts for a future 'find your friend' feature. What really bothers me is when the author says ' it’s possible Sarahah has harvested hundreds of millions of names, phone numbers, and email addresses ". I believe I remember Snapchat and other social media apps done before. What Sarahah should have done is to communicate with their users about what their data and how they plan their security (being an anonymous messaging platform). But, let's not forget how Snapchat dealt with their security and data at its rise.

trdtaylor1 9y ago

Signal uses the same process. When you first install, it uploads all your contacts to 'see' which of your contacts are Signal users. It then defaults to Signal messages to that contact. Any new Signal user on your contact list alerts you to the fact they are now using Signal and helpfully defaults to Signal messaging. When you uninstall, you have to remove your number from their central DB using their web-app to prevent your friends from sending you Signal messages you won't be able to open. An implied "find my friend" feature that I assume Sarahah uses.

tgragnato 9y ago
Signal truncates the hashed phone numbers, before sending them to the server. The server responds with the contacts that you have in common.
- StavrosK 9y ago
  Does it really? I suggested that exact scheme months ago, but moxie rejected it as "not meaningfully privacy-preserving" (probably not his exact words), IIRC. Edit: Here: https://github.com/WhisperSystems/Signal-Android/issues/4726 https://github.com/WhisperSystems/Signal-Android/issues/4726
  - epipping 9y ago
    Here’s what moxie said: „[..] Signal has always done contact intersection with an ephemeral query of truncated hashes of phone numbers.„ See also https://news.ycombinator.com/item?id=11979748 https://news.ycombinator.com/item?id=11979748
  - Canada 9y ago
    Yes, it really does. Signal takes the first 10 bytes of a SHA1 hash of the e164 number, base64s it. An array of these "tokens" are sent to the server at registration time and every 12 hours thereafter. You can confirm this on both client and server code on Github. The problem, which no one denies, is that the small number of possible valid e164 values leaves the scheme vulnerable. Also, last time I checked you could submit like 10k tokens at once, so using a modest amount of IP addresses and phone numbers to bypass the rate limiting it is feasible to determine every registered number in a city. Restricting this is hard because some people have huge address books. The Silent Circle method is slightly better in my opinion, but not by much so I understand why Moxie doesn't want to bother changing it. Back when Redphone was a separate app it used a bloom filter scheme. There are really no good solutions to this problem. The safer ones currently know just don't scale.

rvanmil 9y ago

I think we need more fine-grained contact permission options. Here's what an app on iOS can read and modify (!) when you allow it to access your contacts: https://developer.apple.com/documentation/contacts/contacts_constants https://developer.apple.com/documentation/contacts/contacts_...

oliv__ 9y ago
Wow. That's a lot of data!
jordansmithnz 9y ago
First time I looked at the framework, I expected to be able to read existing contacts, and create new contacts. I was a little surprised at editing existing contacts. Nothing is really stopping an app with permission switching all of your contact numbers so they point to someone else, whether by accident, or on purpose. It seems like something waiting to go wrong...
- imaffett 9y ago
  Facebook did this years ago. It went through your contacts and updated any info (pictures, phone, email) to match what they had in Facebook.
hakcermani 9y ago
Yes! Its high time. Need read-only, specific groups only, read only a public profile. Of course that will be the end of these find your friends feature.
calvinbhai 9y ago
I'm working on an app that makes use of this in a good way (to add new contacts and remove duplicates with explicit action by the user). While doing some research on similar apps, I didn't find a single app that does not give the user an option to not upload the contacts to the app's servers. Basically if use doesn't give this permission, app is useless. I'm hoping the app I build will get a sustainable revenue without needing to uploading all contacts. But in the long run, for contact management apps, there's exponentially more value in handling the contacts data in the cloud, so that its users get the max benefit. But imo any app that's not for contact management (e.g., Facebook etc) should have limited read only access to the contacts data.

fareesh 9y ago

I simply assume they are going to upload my contact data whenever they prompt me for the permission. Not sure how iOS does permissions these days - do they also have runtime permissions like Android? I know that a lot of companies here in India skip the runtime permissions system entirely and ask for them all at install time to handle fewer edge cases in the code, and make the user less likely to be suspicious.

lambada 9y ago
iOS has had runtime permissions for far longer than android :) Some apps will even explain what they (claim to) need the permission for before triggering the permission authorisation pop up.

spacemonkey92 9y ago

One of the ios App I built needed contacts permission, but it's only within the app and never sent to my server. When I submitted it for review to Apple, they didn't approve the app asking the reason why I was accessing the contacts and if sending them to the server. Only if they are happy with the answer they will approve your app. So in a way, iOS apps are much secure than Android.

bert_ 9y ago
Ok, and what if you just lie in your answer?
- sigzero 9y ago
  Nobody can do anything about that. That company ends up getting called out just like this one did or just like Accuweather did.

altotrees 9y ago

This is why you should always read the terms and conditions of an app. I'm always shocked at how many people do not take this seriously. In this age of "data sharing" it is super important to take extra caution.

ceejayoz 9y ago
That's not a solution. T&Cs are written as vaguely as possible to permit as much flexibility as possible, and nothing stops a malicious actor from violating their public privacy claims.
- altotrees 9y ago
  It may not be a solution, but it's a smart thing to do and at least a step in the right direction, no?
  - ceejayoz 9y ago
    Not really. I tend to skim T&Cs and virtually every one I've seen has language that would probably permit this sort of behavior.

spacemanmatt 9y ago

ISTR LinkedIn did this, too.

Moru 9y ago

I often meet people that has a secret identity because a former boyfriend/girlfriend threatens them. They never know about apps harvesting their contacts and connecting them to common friends until their ex suddenly shows up again. This mindset of "If you havent done anything bad you dont have to worry" is so sad and ignorant of others situation.

technofiend 9y ago
This is the problem with an app assuming it understands your web of trust. There's no way to signal a toxic, unwanted or compartmentalized connection. It's also why I use multiple profiles in Android to force that compartmentalization since the snoopy apps have no context it's better to just deny them the data entirely.

robotbikes 9y ago

Facebook messenger does this as well, yet most people aren't aware of it, nor do they consent. There definitely should be much finer grain controls over this type of thing. Imagine how violated people would feel if they had to have someone take pictures of their address book (back when they were physical) just to enter the mall, yet this occurs every day and most are unaware.

fiatjaf 9y ago

Since no relationship is expected to last more than a few years these modern days, perhaps people should be educated to choose better their boy/girlfriends in view of what will happen after the breakup.

bfred_it 9y ago
Yes because the first thing people show on dates is their dark side. /s
Can_Not 9y ago
This is a really good example of cruel unjustified victim blaming and "sad and ignorant of others situation". We are all in awe of your high horse of hindsight.
sctb 9y ago
We detached this subthread from https://news.ycombinator.com/item?id=15139790 https://news.ycombinator.com/item?id=15139790 and marked it off-topic.

ap46 9y ago

Kind of a r/ShowerThoughts, we should maybe make an app & voluntarily fill our Contacts app with specific human like crap values & then sync all major apps with it thus peppering their gold-pots with waste contacts & by the time they catch up, the damage is already done. Rinse & repeat with slightly different values.

xenopticon 9y ago
The problem is that the big companies are not interested in phone numbers and names. The real gold are the connections - who you talk to more frequently, who are your real friends vs. random people you added, etc.

twsted 9y ago

Wasn't it what WhatsApp did years ago? And then Facebook acquired it and was able to complete its database of world's relationships.

yladiz 9y ago

One thing I hate is when apps do this to get information about your contacts, not only because they get who you personally know (and their phone number, email, other info in the contact) but also contacts for businesses you regularly might interact with, meaning they can potentially create a pretty detailed web of your life. For example, it's a dark pattern when you use Messenger, at least on iOS, for the first time and it says "Upload your contacts to find friends" with an "OK" button or "Learn More" button, and only after you click "Learn More" can you ignore it. WhatsApp does something worse; you can't initialize a message with anyone without allowing contacts, and the only way to add a contact is thru the phone app (the web app definitely doesn't, and I'm pretty certain the desktop app doesn't have the functionality to add a contact). I have to go thru great pains to prevent WhatsApp from getting my contact info, just to be able to add a new friend (turn off iCloud contacts, enable WhatsApp to see my contacts, then add the contact). Maybe I am paranoid, but I really, really want Facebook to only have the information I give it, and I don't trust WhatsApp at all. At least WhatsApp encrypts the messages. I really hate this pattern in apps, and I wish there was some way to give it some kind of "blank canvas" without any real contacts in it. Thankfully apps don't lock you completely out if you don't provide contact info, yet, but I fear it may happen soon.

deleted 9y ago
[deleted]

mmagin 9y ago

It's really sad that the ios/android model COULD be more secure than the traditional desktop software model, but at the same time it has normalized all sorts of creepy snooping behavior on the part of apps.