5 ms·
You got the better way already. It's not being uploaded into a database.
by Sunspark 6y ago
You got the better way already. It's not being uploaded into a database.
- hunter2_ 6y agoIf a delivery pipeline is compromised such that the APK received through automatic updates in the Play Store no longer matches the published source code, the Contacts permission we already granted allows the app to start exfiltrating our contact lists. People who build from source (or regularly compare Play Store APKs to vetted builds before installing/updating) are the only ones who really have the assurance you're describing. (Substitute other OSes as able.)
- XorNot 6y agoAnd if the same thing happened to your banking app, or a root level CA... At some point it's a problem I'd like someone to be working on, but taking on a huge amount of individual burden for a low probability scenario isn't anyway to live life. Heck, switching to Signal wasn't high on my agenda list until the Whatsapp TC change suddenly made my entire Facebook Messenger contact list worry about these things - and now I'm completely off Messenger, but it took collective engagement.
- hunter2_ 6y agoI agree completely and I give Signal permission to use my contacts without the due diligence I wrote about. Just treating this more like a logic problem than an advice column, FWIW which isn't much I suppose.