20 ms·
Fake_contacts: Android app to create fake phone contacts, to do data-poisoning
- aww_dang 6y agoImagine if your fake contact's randomly created email or phone number is on a terror watch list.
- corentin88 6y agoThe documentation states that it uses a non-allocated country code (+21). So it seems unlikely to happen.
- dustymcp 6y agoDoesnt this defeat the purpose tho as it could be filtered?
- 0x426577617265 6y agoYes, this data could be quickly mitigated.
- o-__-o 6y agoThe us government monitored all DC residents personal communication for over 2 years because they fat fingered the collection regex. The country code for Egypt is +20, the DC area code is 202.
- IAmGraydon 6y agoYou think that was a mistake, huh?
- grandinj 6y agoThat is a mistake that sounds suspiciously self serving, given how many powerful people live and work there
- toast0 6y ago+21 isn't allocated, but +211 South Sudan +212 Morocco +213 Algeria +216 Tunisia +218 Libya Someone putting random numbers after +21 because it's unallocated has a fundamental misunderstanding of international phone numbers. But also, the server side is likely to throw away invalid numbers to start with. It's simple and easy to do, and reduces the data storage by a lot (there's a lot of garbage in people's address books)
- praptak 6y agoI think that's exactly the point of this. I remember people on Usenet posting random shit like "construct bomb kill president" when the news about Echelon came out.
- rasse 6y agoThis makes me wonder if anyone has set up canary emails or phone numbers in their phone contacts.
- KirillPanov 6y agoThe robocall epidemic has pretty much made the notion of "canary phone numbers" useless.
- praptak 6y agoWhat do you mean by "canary" in this context? How do you detect that the canary is dead? I assume that the "canary being dead" ~= "an adversary added the contact to their watch list". But I don't think you can detect that. The best you could do is to add a random physical address hoping that you can detect physical surveillance (which is probably not realistic anyway).
- rzzzt 6y agoIt is like signing up with an e-mail +suffix for services, or the non-existent streets on digital maps; if you come across your fake contact elsewhere, you know that information has been shared.
- rasse 6y agoExactly!
- vmception 6y agoit is trivial to strip suffixes off of aliased email addresses
- kogir 6y agoIf you control your own email routing, by using your own mail server, Google Workspace, Microsoft 365, etc, you can choose whatever convention you want. How would you know to strip everything after my first name?
- bredren 6y agoClubhouse requires contact list in order to get invites, which are required to sign up right now. I get why they are doing this, and it caused me to share my contacts with them. However, I resented it and it put me immediately in a defensive posture with the product and company. There is no possible way to trust a company with your contact list and Apple should make it how Photos works now--where you can select which data to share. There are some folks I don't even want to possibly find in a social app.
- post_break 6y agoI mean this is why they do it. You knew it was wrong, you knew they were going to take that data and mine it, and you still said sure.
- arkitaip 6y agoFomo is a helluva drug.
- bogwog 6y agoIn my case, I don't even remember giving them permission to use my contacts, yet I got accepted because one of my contacts sent me an invite. I might have given them permission without realizing it, but what could've also happened is that they saw my phone number in someone else's contact list, and assumed we were contacts.
- evanmoran 6y agoYou probably didn’t share, as I didn’t. I believe the contacts permission is only required if you want to share an invite, not to accept one.
- ganstyles 6y agoCorrect. I've been a member for going on a year now and I have scores of invites I don't appear to be able to send because I won't share my contacts. Not that I care enough to invite people, but it's a dark pattern to even require it. I have heard there's a way to share invites without sharing contacts, but I haven't cared enough to even do a cursory search on that.
- adsharma 6y agoI wonder if people have thought about another variant of this. An app that maintains two address books and switches between them based on context.
- tanelpoder 6y agoOr just some form of "share only these contacts with app X" option at the device system/OS level.
- adsharma 6y agoGiven the tracking cookie situation, apps could refuse to install if that option is turned on. They can easily detect if they see a small number of contacts relative to average. With the two address book solution, they should have no way of telling which one is the real address book.
- neilv 6y ago> The app is designed to be very simple and fail silently. If you deny permission to access contacts, the app will not complain, it just will not work. I don't understand the reason behind "designed to...fail silently" in this way, in a privacy&security measure.
- ketamine__ 6y agoIs there a limit on the number of contacts Clubhouse would sync?
- CharlesW 6y agoIt's incredibly unlikely. This kind of social graph information is gold.
- lanstin 6y agoI suspect it is less valuable than call logs. I have never deleted contacts so I have over twenty years of entries with pretty low value (e.g. call this number to find out about this real estate offering; my old mechanics for on 2003 old phone number) or accuracy. I only call about seven people but those are significant links.
- jpmattia 6y agoNot exactly on topic, but historical context maybe: Long ago (early 90s?) when it was guessed/assumed that intelligence agencies were scanning emails, emacs was still among the best ways to read and send email. So emacs provided a handy function to append a random list of "hot" words to each outgoing email in the signature, just to degrade the signal-to-noise of such surveillance. It's still there today, and you can see the output via M-x spook.
- ianmcgowan 6y agoThat used to be the case on usenet too - people would put attention-grabbing words in .signature as "NSA Food" - to overwhelm the NSA data capture algos. It seemed like a futile gesture even at the time, but particularly poignant looking back from a post-Snowden world.
- eternalban 6y agoThe real poignancy is the shift in hacker political views. Call it post-software-is-sexy world. Those usenet sigs were by hackers who lived in a world where software engineer or programmer were social reject code words. That world changed after geeks came into money. Suddenly but soon thereafter, paranoia about privacy was rewarded by tinfoil hats. (And then yes, years later, came along this guy called Snowden.)
- shervinafshar 6y agoSuch an interesting context. Thanks for sharing this. I appreciate the nostalgia poetics of this today.
- Waterluvian 6y agoApps using contacts is a $#%$ing anxiety attack for me. The scum companies don't care. They just want more leads. But for me, it's this fear that they're going to spam my exes and old roommates and bosses and professors and landlords and everyone who ends up added to my contacts. Signal did that to me last week. This person I'm not on speaking terms with got Signal and it added us and announced to each other we were on it and put our empty conversation onto my list of convos. Phone contact lists are a complete $&^*ing disaster and Apple needs to make it far more clear what specific contacts I share access to.
- carmen_sandiego 6y agoNot to be unkind but I suppose most people are not really traumatised by merely seeing someone's name, even if they're not on speaking terms with that person. It probably falls on the side of convenience for the vast majority. For the Signal org, it's possibly even an existential issue, since it helps them counter network effects in the incumbents. It's hard to expect them not to do it, then. Having said that, I think it would be nice for Apple to implement what you describe.
- Waterluvian 6y agoYep. I can't claim to know how everyone else responds to these things. The Signal example isn't the worst. It's a mutual connection. It's not like they're emailing hundreds of people saying "Waterluvian wants you to get on signal!" What's to stop them from doing that when they get sufficiently desperate? I don't even own my contact lists. They seem to grow on their own with anyone I've ever emailed.
- sneak 6y agoSignal does it for anyone in your address book, not just mutuals. Your "anyone I've emailed" example is a great reason not to use the same service you use to host your email to host your contacts. Personally I would never in a million years sync my contacts to Google, which I assume is what you mean here (most people use gmail).
- nom 6y agoHm can it be estimated / is there public information about how many phone numbers are taken? E.g. I generate a valid number for one country or state, how likely is it that the number is in use or registered? I once got a phone call from a university student for a survey for their project and they told me they generate them randomly which makes me really wonder, how likely is it?
- otterley 6y agoRecently Apple added a feature to iOS that allows you only to allow selected photos to be accessible by an app. This allows the user to respond positively to an access request, but allow the app to see only a subset (or zero) actual photos. It would be a very useful feature for Apple to do the same for contacts: the app would think it's getting access to your contacts, but would only actually receive a subset of them, and be none the wiser. This would be a tremendous boon for privacy.
- rsync 6y ago"Recently Apple added a feature to iOS that allows you only to allow selected photos to be accessible by an app." What we really need to see from Apple is a permissions index in the app store that allows me to inspect, and consider, the permissions that an app will request before installing that app. I shouldn't have to install the app (or do laborious research online) to discover what permissions it will attempt to utilize and which of them are required to function. It would be trivially easy to list that in the app store, for each app.
- l8rpeace 6y ago+1 and a filter you can use on related permissions when searching for apps
- lanstin 6y agoAll these permission choices should be invisible to the app. If I say no contacts the call should succeed but with a zero Len response. It shouldn’t be possible for apps to say you have to agree to this or I won’t run. I can run the software and as the root user control what data the software can use.
- lanstin 6y agoOr even as a a service fake data - feed fake location data and fake contact list. Full of 202-555-1234 type numbers. I always put fake data into web forms and it is a sign that I don’t truly own the phone that I can’t do the same for local software.
- vmception 6y agoTo everyone talking about Clubhouse, there isn't an android version so this code is not useful as it is only for android
- throwawei369 6y agoTIL The vast userbase of HN is 95% Apple, 3% Android, 0.0005% Pinephone. The remaining ~1% don't even make a digital footprint since they use the old Nokia 3310 type phones.
- cyberlab 6y agoRemember: some apps check for what apps are installed on the device, and if they see this installed they can deduce you're poisoning the well. Also if you want to research obfuscation and how it thwarts surveillance, check these: https://www.schneier.com/blog/archives/2019/11/obfuscation_as_.html https://www.schneier.com/blog/archives/2019/11/obfuscation_a... https://www.science20.com/news_articles/obfuscation_how_to_hide_from_online_surveillance-164418 https://www.science20.com/news_articles/obfuscation_how_to_h... https://www.theguardian.com/technology/2015/oct/24/obfuscation-users-guide-for-privacy-and-protest-online-surveillance https://www.theguardian.com/technology/2015/oct/24/obfuscati... https://adnauseam.io/ https://adnauseam.io/ https://bengrosser.com/projects/go-rando/ https://bengrosser.com/projects/go-rando/
- artwork159 6y agoIf they saw this app installed, what might they actually do about me or my contact list?
- speedgoose 6y agoI guess they may decide to not sell your data. Which is actually a good thing.
- cyberlab 6y agoThey could just flag you as someone who poisoned the well and ignore you I suppose. Remember: bad actors go after low hanging fruit and tend to ignore privacy-aware folk and those doing anti-surveillance.
- sopromo 6y agoRemove all contacts that first name and last name start with Z. Docs say that they prefix every first & last name with Z so that would be a start.
- cyberlab 6y agoAlso: check for contacts with weird country-code prefixes that don't match the country the user is based in
- aboringusername 6y agoCan someone please explain to me how the collection of contact data is in any way legal under the GDPR and why Microsoft (Windows), Apple/Google haven't been required to make changes to prevent abuse of this permission (such as selecting specific contacts). I'd also like to not know why if my contact data is shared, I am not informed of this. If my data is uploaded by Google to their servers, I should know. If somebody chooses to share my data with $app I should know, and, be able to "opt-out" of being included, perhaps (although it should be opt-in!) Being able to mass collect what is often the most sensitive information means that consistent data is now a liability; keeping the same number/email can be useful for cross-referencing. Ideally you should rotate what data you can (physical address/location is obviously extremely difficult). Everything else is possible (browsers/IP addresses/emails/User Agent strings, phone numbers etc etc) The best idea is to "troll" with your data; put insane items in your logged in basket (ebay/amazon etc), like sex toys. You can even make an order (and refund it) to further poison the well. Log in to Google and do some disgusting searches, and train algorithms to have the "wrong idea" about you, this is a reality we're now facing as this data can (and will) be used against you at any opportunity.
- JCDenton2052 6y agoThe best idea is to not use their services. Switch from Windows to Linux, de-google and if you must use Android keep the data on your phone to a minimum.
- djrogers 6y ago> and why Microsoft (Windows), Apple/Google haven't been required to make changes I don't believe there's anything in the GDPR that gives it the ability to regulate entities several steps removed from the violations. If company A uses a posted letter to ask for PII then stores it in violation of the GDPR, would you then regulate the post office?
- Nextgrid 6y agoThe data protection agencies who are given the power to enforce the GDPR are completely incompetent at doing so, or are corrupt and silently benefit from the status-quo. The web is filled with various dark patterns (and even companies whose entire business is to provide such dark patterns as a service) that would fall afoul of the GDPR, and yet nothing is being done. Google and Facebook - part of the most popular websites worldwide, and with business presence in all the major EU countries - have had a non-compliant cookie/tracking consent flow for over a year now and nothing is being done. If even blatantly obvious breaches (which would be trivial to litigate) are ignored, something more murky like Apple (a neutral third-party) merely providing a tool that can be used to violate the GDPR (but also can be used legitimately) has no chance of making any progress.
- williesleg 6y agoGive me your data now!
- sanxiyn 6y agoWhat a great idea. Let's do more of these.
- crazygringo 6y agoI don't see what the point is. "Data poisoning" gives companies a bunch of fake contacts... on top of all your real ones? Who cares? So they send some e-mails to addresses that don't exist or something? So it takes up an extra 1% of disk space in their database? If you could share an empty address book then that would actually preserve the privacy of your contacts. But this doesn't do that. I don't get it.
- shervinafshar 6y agoNot an expert on guerilla cyber-warfare, but isn't it the whole point of this sort of poisoning? If enough people do this the cost of those bouncing emails would become prohibitive. That's my speculation. Would be great to know more from someone who knows the domain better.
- jmatthews 6y agoYou don't bounce emails you prebounce them and clean up your list. This is part of any sensible data engineers process.
- jmatthews 6y agoMore helpfully, salting their db with real emails but fake contact info requires a more durable hygiene process and often isn't worth the effort for data driven shops. You serve a variety of email domains that validate as deliverable, then you accept emails and report the sender, which hurts their deliverability.
- TedDoesntTalk 6y agowhat is prebounce?
- shervinafshar 6y agoMy guess was they are referring to one of these services that check the validity of any email address. A false signal from one of these services prevented me from signing up for some random website with a .name domain the other day.
- naebother 6y agoHow does this help me? Malicious apps are still going to scoop up my real contacts, right? What if one of the random phone numbers belongs to someone deemed a "terrorist" by one the imperial powers and I'm judged guilty by association?
- paulie_a 6y agoData poisoning needs to become a standard practice. Make the "valuable" ad data useless
- throwawei369 6y agoCouldn't agree more. It's a far better approach as a cloaking technique. Reason I use privacy-possum addon on Firefox.
- tjpnz 6y agoFrom an economics perspective it seems like a more viable approach. Most of the techniques considered state of the art now are likely easily detectable by Google and other ad tech companies - they have a very good idea of which data can be safely discarded. Rather than blocking Google Analytics I wonder what would happen if browsers started responding with garbage.
- sixstringtheory 6y agoSounds like https://adnauseum.io https://adnauseum.io
- atum47 6y agoYou can always use bash or python to create vcards and import them in your phone. I've used this technique once to generate a bunch of numbers to find the whatsapp of a person, works just fine
- jp57 6y agoCan we get little Bobby Tables in there? https://xkcd.com/327/ https://xkcd.com/327/
- championrunner 6y agoDo you have a running APK ?
- ccleve 6y agoThis is a common technique in the mailing list industry. It's called "salting". You add fake names, but real email addresses, street addresses, or post office boxes. You then monitor what shows up in these places addressed to "Mr. Fake Name". It's how mailing list companies monitor who is using their lists and helps control misuse.
- bredren 6y agoHave you worked in this industry? Curious about more details of tricks from various list makers/sellers.
- ccleve 6y agoI have bought lists. I'm working on a system to manage lists.
- sleavey 6y agoA general term for this is a "copyright trap" [1]. Map makers for example often add small, fake features to be able to tell if another map was copied from theirs. [1] https://en.wikipedia.org/wiki/Fictitious_entry https://en.wikipedia.org/wiki/Fictitious_entry
- ficklepickle 6y agoSad state of affairs. AOL couldn't kill the open web, but "apps" have. The user agent should respect your wishes, but instead we are reduced to this insane work-around. Surveillance capitalism needs to die in a fire. To anybody working on that shit: I hate you. Personally, as an individual, I wish you harm. OK, that was hyperbole, but I do love the open web. RIP.
- antihacker_team 6y agoVulnerabilities research. OWASP, PTES, NIST SP800-115. You pay only for the found bug, depending on the criticality. Over than 6 years of experience. email: info@antihacker.pw
- nvoid 6y agoI was looking through my contacts the other day, deleting some people I don't speak to any more. Its interesting that with 5 or so unique enough contacts I could be identified. If they were sufficiently unique, no one in the world could possible know those 5 people. Scary thought.
- 0df8dkdf 6y agoThat is why we should have a custom app for contacts with custom encryption (like keepass) to store our real contact. So not any app or apple or google has access them. For some ppl like political of activist fundraisers, contact info privacy are utter most important. In fact some of them still store it on rolodex, and will not put any of that into digital form. And as a software developer I actually support that tremendously.
- allurbase 6y agoTake me to your leader.... I don’t like thieves!
- nbzso 6y agoAll the shady data schemes and dark patterns in todays idea of software business motivated me to look to my phone as an enemy and using the web cautiously all the time. Actually the idea of hyperconnected future in which 24/7 monitoring of the individuals will be normalised and mandatory makes me cringe. The Internet from force of good is turning to dystopian toolchain by the hour. And all is because we as society cannot find an effective way to limit the greed.
- federona 6y agoSociety, current society also called capitalism, is designed not for greed but constant growth. When your goal is not satisfaction but constant growth and you already are a billion dollar company, then it makes you look at all the shady shit you can still do and get away with in order to grow. These companies don't need to grow, if anything they actually should be growing smaller and sustainable if we actually wanted to engineer towards goodness rather than money. The fact that the rich are getting richer while having absolutely no need for it says to me our prerogatives are wrong and our engineering about business is wrong. A lot of the common laws rules and norms around which business is built are insane. That is to say that if the economy is a mirror of nature, then businesses should be engineered to die. Not to be a going concern forever. After a certain amount of profit is extracted and life is lived, into the grave they should go. Not just as a result of competition, but as a result of system design. This would then lead to a more evolutionary world and better distribution of power and resources rather than continuous monopolizing and consolidation. Also a different mentality of you can't take it with you to the grave, rather than infinite mindset. It would be a cyclical mindset about finite things, not infinite things. Corporations want to be people, so engineer them like people and less like machines.
- throwawei369 6y agoWait until iot becomes mainstream. I foresee tiny chips creating mass scale mutiny against their creators and colonizing us (best case scenario)
- shervinafshar 6y agoI wonder how dystopian sci-fi would read in such future? I mean...what would be their parable of The Matrix?
- annoyingnoob 6y agoI'm of the opinion that personal data is not like a currency and should not be seen as a form of currency. If you want to barter then I want to negotiate, no one sided contracts. Can't make a deal? Your loss then.
- deleted 6y ago[deleted]
- yalogin 6y agoThis is not achieving anything positive. I don’t which privacy threat it’s fixing, other than adding a new app into the mix that could at some point in the future suck up the contacts itself:)
- fsflover 6y agoOr just stop using operating systems and apps which you don’t trust and switch to GNU/Linux phones.
- aasasd 6y agoOn Android, IIRC I've seen a dialer app that stores contacts in its own database instead of the system thing. Seems to be a better approach than this—at least if other apps also don't write to the shared contacts. (It was probably an open-source dialer on F-Droid, but don't remember exactly which one.) Anyway, an even better approach of course is to tell data-slurping apps to bugger off. Edit: come to think of it, maybe alternative Android ROMs could fence the contacts so that an app only sees its own unless the user specifically selects someone. I guess this is similar to Apple's trick with Photos.
- parkingpete 6y agoHmmm, not good
- floatingatoll 6y agoIs it possible to create a network of contacts that triggers worst-case memory and cpu scenarios when the network is reconstructed from contacts? Or, put another way, can a collection of people doing this construct a set of synthetic contacts spread out in various ways across their devices, such that anyone doing contact analysis sees their analyses slow down, drain resources, or crash altogether due to network structure?
- alcover 6y agoWouldn't any worthy graph explorer handle cycles ?
- floatingatoll 6y agoIf I had a nickel for every time an algorithm was found to have an exploitable weakness due to unforeseen alignments of input, I’d certainly have some nickels. We know what the common screwups in crypto are, and we could know what common screwups in network graphs are. I’m just wondering if anyone actually does know of any of those.
- the_local_host 6y agoI have to say the spirit of this fake_contacts app is very appealing. Why stop at defending your data, when you can attack?
- throwawei369 6y agoOffence is the best defence
- heavyset_go 6y agoThis can be easily bypassed by cross referencing contact lists on the backend.
- _trampeltier 6y agoI have no contacts at all on my phone, I created something by myself. Now I think it would be funny to brute force Androids contacts and just add every number of my countrys phone providers :-)
- GekkePrutser 6y agoI wonder if this works at all.. These companies simply use your contacts to do contact mapping to other users. Including fake ones will do nothing as they don't point anywhere. Big Data will just filter them out.
- washadjeffmad 6y agoI seem to remember CyanogenMod having a per-app sandbox feature around 2013 that returned blank info from a virtual root. Like many point out, this isn't data poisoning, especially if there aren't metric-breaking honeypots around the web seeding these services with enough noise to make these collection practices useless, which there are not. A more effective alternative might be hashing real contacts to generate seeds of complete but false profile information. Apps thinking they got the mother lode wouldn't be able to assign confidence to any results they didn't have duplicates of, and slowly over time, groups who used this would become worthless.
- sleavey 6y agoI remember that too; it was great. That feature disappeared at some point though - it's not in Lineage OS these days as far as I've found. I recall it made some apps crash, but only as far as I could tell those that weren't robust enough to handle being fed junk data. I'm not sure why that feature disappeared. EDIT: my guess is that a later Android update broke the existing Cyanogenmod code and no one was maintaining it.
- dmt0 6y agoThere's XPrivacy framework that runs on top of Magisk or XPosed (not sure how it works now). I remember it allowed you to give very fine-grained permissions to apps and poison the data as well, with fake contacts, location, etc. Back in the day it required a lot of tinkering to set it up, and would likely make your OS pretty unstable.
- bschne 6y agoThe problem with this approach is twofold: a) At the margin, a few people doing this does _nothing_ to mess with big companies' data collection & analysis. But opting out also has the same problem, obviously, so at least it's not doing worse. b) In the absence of sandbox / selective sharing features like other commenters have mentioned, or you going so far as to _only_ keep fake contacts in your phone, using this approach requires you to also share your actual contacts with the app, thus giving away PII of unconsenting third parties. Yes, I'd rather blame the app developers for collecting this data in the first place, but I'd still prefer not to give my contacts away whenever I can reasonably withhold them.
- tyingq 6y agoBsd style globbing is handy for this sort of thing. Like in Perl: use File::Glob qw/bsd_glob/; my @list = bsd_glob('This is nested {{very,quite} deeply,deep}');
- andix 6y agoJust don't share your contacts with apps that steal them and use them for marketing purposes. It is also illegal to do it (GDPR), if you don't have the permission of every single person in your contacts.
- collaborative 6y agoPhone numbers are too public. The reason why they're used by messaging apps is that they are a goldmine to have. They actually make it harder to chat (ever tried using Whatsapp/Signal on a PC? Yes, you'll need to have it installed on your phone first (and have given over your contacts)) That's why I chose to set (masked) emails as the primary id on groupsapp.online and even these can't be seen publicly unless you share a "group". Others will just see XXXX@gmail.com
- Scaless 6y agoAt that point why even show the masked emails at all? All you're doing is leaking people who use their own custom domains (e.g. XXXX@myname.com), and XXXX@gmail.com isn't going to help me know who that person is either.
- collaborative 6y agoTouche. I shall also hide the domain then, thx for the tip
- ezconnect 6y agoWhy not jut create a contacts app and use that as your private contact apps.
- ianlevesque 6y agoOr click “Don’t allow”? What’s the point?
- I_am_tiberius 6y agoJust reading the headline and thinking: Providers (like google) may still be able to filter out fake profiles if those fake contacts don't have relations to each other. Meaning that if only you have a contact with a random number, and nobody else has, it's most likely fake.
- augstein 6y agoHow far have we come to even consider poisoning the data on our own devices, because we know it will be harvested and resold by 3rd parties.
- ckgjm 6y agoThings might change big time in this space. Apple and Facebook are slugging it out on tracking personal data. https://www.cnet.com/news/facebook-vs-apple-heres-what-you-need-to-know-about-their-privacy-feud/ https://www.cnet.com/news/facebook-vs-apple-heres-what-you-n...
- 867-5309 6y agoslightly increased anonymity through user-fed obfuscation? if you don't want an app to access your contacts, deny it. if it insists, delete it. the only app on my phone which has access to contacts is.. Contacts
- 2Gkashmiri 6y agoEver since ios 5 I think, there has been permission control behind a separate password. Why cant android replicate that? Nowadays, there seems to be one "permissions protection" but sadly all apps say "you seem to have contacts protection enabled. Please disable for best results". Whats the point?
- IncRnd 6y agoIf real problem is that your contacts can be stolen, it makes no sense to add noise to them instead of securing them. Do you install lots of trivial apps, which you give permission to access your contacts?
- purpmint008 6y agoThis is getting out of hand.
- geniium 6y agoIt's pretty sad that we get to this point. Creating fake contact in our phones to create "data-poisoning". Where the hell are we going?
- anotherfish 6y agoGoing by the canary email addresses I put into my devices from time to time... nowhere good. Those email addresses receive spam despite never sending or being signed up to anything. Apps are actively uploading and selling email addresses. I'd not be surprised if some Big Data company has a massive graph of mobile numbers / email addresses sourced purely from app uploads, let alone reasonable signups. Then its all correlated with other sources like linkedin. Yay! Profit!
- neonihil 6y agoI love this! We need more of this. Let’s poison every data that is collected!
- dredmorbius 6y agoData-poisoning is an attractive approach (and one I've considered and occasionally practiced) but it does relatively little as a practical matter. @cyberlab posted some good links here: https://news.ycombinator.com/item?id=26286686 https://news.ycombinator.com/item?id=26286686 Cory Doctorow also addressed this in a recent Reddit AMA: https://old.reddit.com/r/privacy/comments/j444u4/how_to_destroy_surveillance_capitalism_an_ama/g7jf6sf/?context=3 https://old.reddit.com/r/privacy/comments/j444u4/how_to_dest... From the harvesters' perspective, a long list of pattern-matching identifiers with no visible history anywhere else online ... will tend to get junked fairly readily. A small increase in undeliverable addresses from a swipe ... won't increase costs much. Creating wholesale online personas (effectively: bots and troll farms writ large) might start posing a challenge, but those would still likely give off a strong signal of falseness due to lack of correlation with other identifiers, most notably devices of their own, credit cards or other payments data, other data-linked services (transit or toll passes, etc.). Ultimately the question is why are you doing this and what do you hope to accomplish? (Though I've salivated a few times contemplating a system that would stream endless bits as responses to cookie or similar requests, just for shins and grits.)
- ouromoros 6y agoI recall the article that said obfuscation is the final solution to our privacy. But do we really want this solution?