4 ms·

Knowing someone's email can effectively be the keys to the kingdom. I noticed recently on gmail with some XHR lookups they do when you hover over people's emai

Knowing someone's email can effectively be the keys to the kingdom. I noticed recently on gmail with some XHR lookups they do when you hover over people's email addresses, it fetches their email, name and a couple of other datapoints. You can tweak the request to enter any other email address to discover those details about them. Then there's the social networks. They do mitigate how easy it is to bulk upload contacts and correlate email addresses (or phone numbers) to profiles, but it's certainly not impossible- and people who are making it their business to data mine will exploit all these kinds of 'opportunities'.

varispeed 6y ago
I remember the days where social networks would have a form where you entered your email details (including password) and they would log in as you and retrieve all contacts to include in the network. I was shocked. I was more shocked that I saw people actually giving up all their details... That was like 15 years ago, so probably wouldn't fly today though.
- ricardo81 6y ago
  I remember Facebook doing that.
- parliament32 6y ago
  Today, the app just request the Contacts permission on your phone and vacuums them all up that way. Every social media app does this, FB (including WhatsApp/IG), Snapchat, Linkedin, etc.
  - varispeed 6y ago
    This should be improved to give more granular control - for example an app would not be allowed to leak contacts outside of the phone.
- c22 6y ago
  I tried to link a new bank account to paypal recently and they tried to get me to let some third-party log into my bank's website on my behalf. After finding the tiny "No thanks" option (which inexplicably required running said third-party's JavaScript on my device) I was ultimately able to do it the old fashioned way but this process, as they warned, took 4 days rather than being "instantaneous." I think a lot of people are still bullied/tricked into sharing credentials with all manner of skeezy websites.
  - varispeed 6y ago
    I saw this as well, very sketchy. I'd rather not use a feature that requires me to give out banking details - I don't think that even is allowed in bank's T&C. Probably if a 3rd party stolen your money because you give them your details, you won't be covered. I was asked this once and I refused. I'd rather enter things manually than let someone "have a peek".

varispeed 6y ago

I remember the days where social networks would have a form where you entered your email details (including password) and they would log in as you and retrieve all contacts to include in the network. I was shocked. I was more shocked that I saw people actually giving up all their details... That was like 15 years ago, so probably wouldn't fly today though.

ricardo81 6y ago
I remember Facebook doing that.
parliament32 6y ago
Today, the app just request the Contacts permission on your phone and vacuums them all up that way. Every social media app does this, FB (including WhatsApp/IG), Snapchat, Linkedin, etc.
- varispeed 6y ago
  This should be improved to give more granular control - for example an app would not be allowed to leak contacts outside of the phone.
c22 6y ago
I tried to link a new bank account to paypal recently and they tried to get me to let some third-party log into my bank's website on my behalf. After finding the tiny "No thanks" option (which inexplicably required running said third-party's JavaScript on my device) I was ultimately able to do it the old fashioned way but this process, as they warned, took 4 days rather than being "instantaneous." I think a lot of people are still bullied/tricked into sharing credentials with all manner of skeezy websites.
- varispeed 6y ago
  I saw this as well, very sketchy. I'd rather not use a feature that requires me to give out banking details - I don't think that even is allowed in bank's T&C. Probably if a 3rd party stolen your money because you give them your details, you won't be covered. I was asked this once and I refused. I'd rather enter things manually than let someone "have a peek".