4 ms·

A quick summary: iOS has very coarse-grained controls for app permissions to the contact list, either allowing all access to data about every contact, including

A quick summary: iOS has very coarse-grained controls for app permissions to the contact list, either allowing all access to data about every contact, including free-form text notes that could contain arbitrary sensitive information, or no contact list access at all. The App Store's policies controlling use of contact list data are too weak without technical enforcement. (It's also noted that Google has the same problem with Android and the Play Store, but the author argues that Apple is more hypocritical because of its public pro-privacy stance.) To correct the problem: > the first step is obvious: Restrict [apps] from getting any information from users' lists beyond phone numbers and email addresses. The next step is redesigning the controls of the list to allow users to encrypt or decline to share certain contacts. The names in a contact list could be benign, or they could be revealing—a doctor's patients, a dealmaker's network, a journalist's sources.

dogma1138 8y ago
While iOS can improve on a lot of things the biggest factor here is that Apple’s business model does not revolve around their user’s data. If I’m in all honest i don’t have that many apps on my iPhone and the same goes for most of the people I know the app craze has I think settled down quite a bit. I have 15 apps installed and only 3 have access to my contact list and those are Protonmail, Signal and WhatsApp which I would allow access too anyhow for convenience. Apple can and should improve permission granularity but as far as contacts go I’m not sure that it’s even a good idea. All or nothing seems like a good compromise to ensure that apps that you don’t want to have access to contacts don’t, how many usecases can you see when you’ll have to go to individual contacts and approve them one by one? The best thing beyond that that Apple can implement is per field permissions e.g. I would like ProtonMail to only have access to the contact name and email fields but not to phone number or address but this level of granularity isn’t available on any platform afaik.
- deleted 8y ago
  [deleted]
- LiweiZ 8y ago
  And consumers simply don't have any other options can match what Apple is offering. If an average cares about both product and service experience and data privacy, I don't see any alternative comes remotely close. That's the position Apple has been building for a few years and it's a clever move. This alone can make Apple a lot more attractive for data privacy concerned consumers. Apple doesn't have to worry about the decline of their software/hardware design/production level as before. Data privacy service can compensate those to a very big degree. Any alternative not more expensive, easy to use and not more burden on user's mind as a whole is welcomed. Am I trust Apple with my data? No, but that's my best choice for now and near future.
- 05 8y ago
  > only 3 have access to my contact list and those are Protonmail, Signal and WhatsApp Yeah, one of them shares your contacts with Facebook. Might as well given all 15 this permission..
  - Skunkleton 8y ago
    I avoid sharing data with FB, but personally I would rather share my contacts with FB than with some random app developers.
    - JKCalhoun 8y ago
      I'm the opposite.
    - ionised 8y ago
      Don't worry, FB will share it with random app developers on your behalf.
  - dogma1138 8y ago
    That’s not the point the point is that I would not go and mark individual contacts to share or not to share. W/A can function just as well without access to contacts I just don’t see the benefit of doing that considering that W/A has my details and likely my social network from the other end anyhow.
    - tlynchpin 8y ago
      Last I checked, you cannot originate a message on whatsapp on android without giving whatsapp permission to your contacts. Another user can originate a message to you and you can then reply while maintaining no permission for contacts. In my experience, whatsapp does not "function just as well without access to contacts."
      - dingaling 8y ago
        That is correct. The recent versions of WhatsApp rely entirely on the system contacts. My wife has to e-mail or text someone to ask them to initiate a conversation on WhatsApp because she denies Contacts permission. It used to be possible to add and initiate a contact within the app but that has been deprecated. Which leads to a terrible UX; why would I want to add a one-off contact like an airline or gig-organiser to my contacts just to ping them on WhatsApp? It just clutters my list, but of course Facebook loves it.
- laumars 8y ago
  The problem with service like Facebook is even if you're careful with your permissions, you out need one friend, relative or even work colleague to be lazy and you're details are no longer secured
charleslmunger 8y ago
On android, it's possible for apps to access contacts in a few ways: 1. Request permission to access all contacts at runtime - user chooses yes or no. 2. Ask the user to choose a specific contact. This pops up some system UI, and then relays back the information the app requested about the contact the user chose: public void pickContact(View v) { Intent contactPickerIntent = new Intent(Intent.ACTION_PICK, ContactsContract.CommonDataKinds.Phone.CONTENT_URI); startActivityForResult(contactPickerIntent, RESULT_PICK_CONTACT); } @Override protected void onActivityResult(int requestCode, int resultCode, Intent data) { if (resultCode == RESULT_OK) { switch (requestCode) { case RESULT_PICK_CONTACT: soSomethingWithContact(data); return; } } else { Log.e("MainActivity", "Failed to pick contact"); } } And for most cases, it's also fine to just use the "share" intent to send a link or similar via whatever app and whatever contact the user chooses, without any extra info leaking to the providing app. You can actually see this in action with the uber app - if you choose to share your ETA with someone, it first asks for permission to access all your contacts. If you deny it (which I do) then it follows up by having you send a link via the regular share intent.
- dep_b 8y ago
  It's the same on iOS: https://developer.apple.com/documentation/contactsui/cncontactviewcontroller https://developer.apple.com/documentation/contactsui/cnconta... I don't think I ever allowed any app to access my address book ever.
gerardnll 8y ago
A few months? weeks? (I've lost track of time) ago we all saw how much data Facebook was able to collect on Android, and how much from iOS. Calls, SMS for example, cannot be collected on iOS.
7402 8y ago
Well that would having been annoying in the days when I published a little iOS app that took all the information from a contact list and reformatted it into a pdf file so it could be printed out in a wallet-sized address book. My app had no web access and didn't transfer the information anywhere except over to the Mail app, which waited for you to enter the e-mail address for mailing the file.

dogma1138 8y ago

While iOS can improve on a lot of things the biggest factor here is that Apple’s business model does not revolve around their user’s data. If I’m in all honest i don’t have that many apps on my iPhone and the same goes for most of the people I know the app craze has I think settled down quite a bit. I have 15 apps installed and only 3 have access to my contact list and those are Protonmail, Signal and WhatsApp which I would allow access too anyhow for convenience. Apple can and should improve permission granularity but as far as contacts go I’m not sure that it’s even a good idea. All or nothing seems like a good compromise to ensure that apps that you don’t want to have access to contacts don’t, how many usecases can you see when you’ll have to go to individual contacts and approve them one by one? The best thing beyond that that Apple can implement is per field permissions e.g. I would like ProtonMail to only have access to the contact name and email fields but not to phone number or address but this level of granularity isn’t available on any platform afaik.

deleted 8y ago
[deleted]
LiweiZ 8y ago
And consumers simply don't have any other options can match what Apple is offering. If an average cares about both product and service experience and data privacy, I don't see any alternative comes remotely close. That's the position Apple has been building for a few years and it's a clever move. This alone can make Apple a lot more attractive for data privacy concerned consumers. Apple doesn't have to worry about the decline of their software/hardware design/production level as before. Data privacy service can compensate those to a very big degree. Any alternative not more expensive, easy to use and not more burden on user's mind as a whole is welcomed. Am I trust Apple with my data? No, but that's my best choice for now and near future.
05 8y ago
> only 3 have access to my contact list and those are Protonmail, Signal and WhatsApp Yeah, one of them shares your contacts with Facebook. Might as well given all 15 this permission..
- Skunkleton 8y ago
  I avoid sharing data with FB, but personally I would rather share my contacts with FB than with some random app developers.
  - JKCalhoun 8y ago
    I'm the opposite.
  - ionised 8y ago
    Don't worry, FB will share it with random app developers on your behalf.
- dogma1138 8y ago
  That’s not the point the point is that I would not go and mark individual contacts to share or not to share. W/A can function just as well without access to contacts I just don’t see the benefit of doing that considering that W/A has my details and likely my social network from the other end anyhow.
  - tlynchpin 8y ago
    Last I checked, you cannot originate a message on whatsapp on android without giving whatsapp permission to your contacts. Another user can originate a message to you and you can then reply while maintaining no permission for contacts. In my experience, whatsapp does not "function just as well without access to contacts."
    - dingaling 8y ago
      That is correct. The recent versions of WhatsApp rely entirely on the system contacts. My wife has to e-mail or text someone to ask them to initiate a conversation on WhatsApp because she denies Contacts permission. It used to be possible to add and initiate a contact within the app but that has been deprecated. Which leads to a terrible UX; why would I want to add a one-off contact like an airline or gig-organiser to my contacts just to ping them on WhatsApp? It just clutters my list, but of course Facebook loves it.
laumars 8y ago
The problem with service like Facebook is even if you're careful with your permissions, you out need one friend, relative or even work colleague to be lazy and you're details are no longer secured

charleslmunger 8y ago

On android, it's possible for apps to access contacts in a few ways: 1. Request permission to access all contacts at runtime - user chooses yes or no. 2. Ask the user to choose a specific contact. This pops up some system UI, and then relays back the information the app requested about the contact the user chose: public void pickContact(View v) { Intent contactPickerIntent = new Intent(Intent.ACTION_PICK, ContactsContract.CommonDataKinds.Phone.CONTENT_URI); startActivityForResult(contactPickerIntent, RESULT_PICK_CONTACT); } @Override protected void onActivityResult(int requestCode, int resultCode, Intent data) { if (resultCode == RESULT_OK) { switch (requestCode) { case RESULT_PICK_CONTACT: soSomethingWithContact(data); return; } } else { Log.e("MainActivity", "Failed to pick contact"); } } And for most cases, it's also fine to just use the "share" intent to send a link or similar via whatever app and whatever contact the user chooses, without any extra info leaking to the providing app. You can actually see this in action with the uber app - if you choose to share your ETA with someone, it first asks for permission to access all your contacts. If you deny it (which I do) then it follows up by having you send a link via the regular share intent.

dep_b 8y ago
It's the same on iOS: https://developer.apple.com/documentation/contactsui/cncontactviewcontroller https://developer.apple.com/documentation/contactsui/cnconta... I don't think I ever allowed any app to access my address book ever.

gerardnll 8y ago

A few months? weeks? (I've lost track of time) ago we all saw how much data Facebook was able to collect on Android, and how much from iOS. Calls, SMS for example, cannot be collected on iOS.

7402 8y ago

Well that would having been annoying in the days when I published a little iOS app that took all the information from a contact list and reformatted it into a pdf file so it could be printed out in a wallet-sized address book. My app had no web access and didn't transfer the information anywhere except over to the Mail app, which waited for you to enter the e-mail address for mailing the file.