5 ms·

My wife installed TrueCaller on her phone. She is technical but not a developer. I asked if she knows they steal your contact list and spy on you and her answe

by inglor 5y ago

My wife installed TrueCaller on her phone. She is technical but not a developer. I asked if she knows they steal your contact list and spy on you and her answer was “so? It’s just phone numbers and names and they need to get the data somewhere as they are providing the service for free” I live in a developed country and we have a high standard of living. Giving this anecdote to illustrate many people genuinely don’t see TrueCaller’s spying as a big deal. This is unfortunate but it’s how things often are.

digitallyfree 5y ago
Honestly it's the same thing with the (well-educated) people who have their entire lives on the Google cloud and don't have an issue with the privacy practices of Facebook and Tiktok. They know the companies use their data and they don't mind or care - all they want are their free services. To them features/functionality/cost is first, and privacy is an afterthought. I see this view in a lot of people nowadays.
amelius 5y ago
We definitely need some scenarios where this kind of spying plays out badly for the user, so we can use them in arguments against these practices. Without examples, I can't blame users for calling these dangers hypothetical, really.
- dankboys 5y ago
  Perhaps too niche, but Bellingcat have used these sort of apps in the past to identify Russian officers
lelandfe 5y ago
It's worth noting that Instagram does this too, under the guise of "Find Your Friends." When you sign up for a new account, they aggressively prompt you to sync your contacts list with the app, and will continually prompt you in the future if you choose not to. Nearly all of my friends have this enabled. This is not a one-time sync, either. It will upload future new contacts and changes. And, finally, if you manage to create a new account without a phone number, Instagram appears to flag your account for suspicious activity at some point and mandates that you do. They can then correspond your phone number with other users' contact lists to determine your identity. It can even suss out if you provided a Google Voice/VOIP number and require a "real" one instead. https://help.instagram.com/195069860617299 https://help.instagram.com/195069860617299
- thelittleone 5y ago
  Contact lists should be treated like PII and have laws and technical controls against sharing them without the permission of the contact. Incredibly difficult to do no doubt. But if people are ok to share their contact let them. Let others opt out.
- techsupporter 5y ago
  > When you sign up for a new account, they aggressively prompt you to sync your contacts list with the app, and will continually prompt you in the future if you choose not to. Even everyone's much-loved Signal does this. Contacts sync is presented as "not now" or "yes forever." The "not now" message even explicitly says they'll bug you again.
  - tompagenet2 5y ago
    Are you sure? This page [1] says this is not the case [1] https://support.signal.org/hc/en-us/articles/360007061452-Does-Signal-send-my-number-to-my-contacts- https://support.signal.org/hc/en-us/articles/360007061452-Do...
    - Groxx 5y ago
      No, they're still uploading the same data as they did before (last I looked into it, it was still enough data to rather easily reverse and get pretty good accuracy. if it wasn't accurate, it would have unacceptably many false-positives, so it's a necessary quality of the system). Regardless of how you hash them, it needs to work on a phone, and it needs to be reasonably unique... so you can just enumerate literally every phone number ever on a decent computer in a few seconds and, if combined with basically any other information at all (like an area code), that's enough to figure out many or most contacts trivially. The difference, which that article goes into, is that now they're going all-in on you also trusting Intel's SGX and thus every single thing in between you, them, their hardware delivery pipelines, etc. Which makes collecting that data completely ok (it's done securely now thanks to SGX!), because you should obviously trust Intel because CPU vendors have had such a fantastic track record in their on-chip security systems. (</sarcasm> in case that wasn't clear) There's a lot to like about Signal's privacy, both in isolation and in comparison to other messengers. They're doing great work. But I have absolutely no idea why they persist in this data collection. Their bull-headedness on zero options around it for years on end smells more suspicious than anything else at this point tbh. About 3/4 of the people I've known who installed Signal immediately left forever because someone they knew contacted them to say "welcome" and they got super creeped out wondering how they knew they had joined. And then the contact-er frequently left too because they had no idea it wasn't consensual, and were creeped out as well.
websap 5y ago
India has a huge problem with spam / robo callers. Also its common for individuals to have more than 1 phone number, see how popular dual sim phones are. Also true caller adds security when you're from an under represented or a minority groups. I especially know women who use Truecaller to make sure they know who is calling / texting them from new numbers.
- Pxtl 5y ago
  > India has a huge problem with spam / robo callers That's everywhere, not just India.
  - edgyquant 5y ago
    You’re playing coy, India is a source of a huge number of the worlds phone scams. With Brazil being the “most spammed.” As a slightly related caveat, with how frustrating the scammers are for me in the Us I can only imagine Brazil. Their phones must ring 24/7.
    - unmole 5y ago
      And do you think Truecaller has anything to do with that?
      - edgyquant 5y ago
        Probably not. But their job is to keep track of all of this, they’ve clearly made a healthy premium, so I do believe they have a part in both not preventing it at this time and helping to prevent some of it going forward. Not sure what that entails but I get a dozen calls a day and need someone to yell at.
    - Pxtl 5y ago
      Yes, but aren't we talking about which country is the target of the scams, not the source?
  - websap 5y ago
aldebran 5y ago
I’ve gone a few steps further and answered the “So?”. My wife thinks I’m a conspiracy nut even though I’ve provided proof of things that have happened. She thinks if it was that wide spread it would have been stopped already. Fortunately we’ve agreed on not sharing kids pics and information on places like FB insta etc.
- deleted 5y ago
  [deleted]
KingOfCoders 5y ago
Not that someone cares, but in the EU she would be responsible for violating the GDPR. Many people don't know that they are responsible as private citizens.
- Kiro 5y ago
  Only true if she violates a national law. GDPR itself does not apply to private citizens.
  - KingOfCoders 5y ago
    GDPR does apply to private citizens. It does not apply to private citizens doing private things only eg with their phone.
jabroni_salad 5y ago
I think a lot of that comes from the fact that phone numbers being private at all is not a universal consideration. My town still, every year, sends me a paper book full of every resident's address and landline telephone.
- _jal 5y ago
  And here's where how something is used makes all the difference. I have zero issues with my neighbors having my phone number. If I lived in a smallish place, extending that would be fine. I have huge issues with spammers and con artists having it. A locally distributed physical book works great for the first and, at the very least, makes the second work for it. Online databases are basically made to order for the second, and are far more extensive than needed for the first. It is just another example where adding automation and cheap storage actively makes a situation worse.
  - Kiro 5y ago
    In my country the same physical book has been available online for decades.
adolph 5y ago
It used to be that the phone company would annually throw a book on your porch with everyone in your town's name, phone and address. I can see how someone with that as a mental model for contact lists wouldn't see a problem.
unmole 5y ago
I'm old enough to remember telephone directories. Phone companies would publish listings of name, phone numbers and addresses of everyone who had a phone. Fun fact: Elector rolls are public record. Your address is already out in the open. > Giving this anecdote to illustrate many people genuinely don’t see TrueCaller’s spying as a big deal. That's because it makes no material difference to them.
- ehPReth 5y ago
  me too! I'm glad it's no longer the case though personally, if you've ditched "land lines" (at least in Canada?)

by inglor 5y ago

digitallyfree 5y ago

Honestly it's the same thing with the (well-educated) people who have their entire lives on the Google cloud and don't have an issue with the privacy practices of Facebook and Tiktok. They know the companies use their data and they don't mind or care - all they want are their free services. To them features/functionality/cost is first, and privacy is an afterthought. I see this view in a lot of people nowadays.

amelius 5y ago

We definitely need some scenarios where this kind of spying plays out badly for the user, so we can use them in arguments against these practices. Without examples, I can't blame users for calling these dangers hypothetical, really.

dankboys 5y ago
Perhaps too niche, but Bellingcat have used these sort of apps in the past to identify Russian officers

lelandfe 5y ago

It's worth noting that Instagram does this too, under the guise of "Find Your Friends." When you sign up for a new account, they aggressively prompt you to sync your contacts list with the app, and will continually prompt you in the future if you choose not to. Nearly all of my friends have this enabled. This is not a one-time sync, either. It will upload future new contacts and changes. And, finally, if you manage to create a new account without a phone number, Instagram appears to flag your account for suspicious activity at some point and mandates that you do. They can then correspond your phone number with other users' contact lists to determine your identity. It can even suss out if you provided a Google Voice/VOIP number and require a "real" one instead. https://help.instagram.com/195069860617299 https://help.instagram.com/195069860617299

thelittleone 5y ago
Contact lists should be treated like PII and have laws and technical controls against sharing them without the permission of the contact. Incredibly difficult to do no doubt. But if people are ok to share their contact let them. Let others opt out.
techsupporter 5y ago
> When you sign up for a new account, they aggressively prompt you to sync your contacts list with the app, and will continually prompt you in the future if you choose not to. Even everyone's much-loved Signal does this. Contacts sync is presented as "not now" or "yes forever." The "not now" message even explicitly says they'll bug you again.
- tompagenet2 5y ago
  Are you sure? This page [1] says this is not the case [1] https://support.signal.org/hc/en-us/articles/360007061452-Does-Signal-send-my-number-to-my-contacts- https://support.signal.org/hc/en-us/articles/360007061452-Do...
  - Groxx 5y ago
    No, they're still uploading the same data as they did before (last I looked into it, it was still enough data to rather easily reverse and get pretty good accuracy. if it wasn't accurate, it would have unacceptably many false-positives, so it's a necessary quality of the system). Regardless of how you hash them, it needs to work on a phone, and it needs to be reasonably unique... so you can just enumerate literally every phone number ever on a decent computer in a few seconds and, if combined with basically any other information at all (like an area code), that's enough to figure out many or most contacts trivially. The difference, which that article goes into, is that now they're going all-in on you also trusting Intel's SGX and thus every single thing in between you, them, their hardware delivery pipelines, etc. Which makes collecting that data completely ok (it's done securely now thanks to SGX!), because you should obviously trust Intel because CPU vendors have had such a fantastic track record in their on-chip security systems. (</sarcasm> in case that wasn't clear) There's a lot to like about Signal's privacy, both in isolation and in comparison to other messengers. They're doing great work. But I have absolutely no idea why they persist in this data collection. Their bull-headedness on zero options around it for years on end smells more suspicious than anything else at this point tbh. About 3/4 of the people I've known who installed Signal immediately left forever because someone they knew contacted them to say "welcome" and they got super creeped out wondering how they knew they had joined. And then the contact-er frequently left too because they had no idea it wasn't consensual, and were creeped out as well.

websap 5y ago

India has a huge problem with spam / robo callers. Also its common for individuals to have more than 1 phone number, see how popular dual sim phones are. Also true caller adds security when you're from an under represented or a minority groups. I especially know women who use Truecaller to make sure they know who is calling / texting them from new numbers.

Pxtl 5y ago
> India has a huge problem with spam / robo callers That's everywhere, not just India.
- edgyquant 5y ago
  You’re playing coy, India is a source of a huge number of the worlds phone scams. With Brazil being the “most spammed.” As a slightly related caveat, with how frustrating the scammers are for me in the Us I can only imagine Brazil. Their phones must ring 24/7.
  - unmole 5y ago
    And do you think Truecaller has anything to do with that?
    - edgyquant 5y ago
      Probably not. But their job is to keep track of all of this, they’ve clearly made a healthy premium, so I do believe they have a part in both not preventing it at this time and helping to prevent some of it going forward. Not sure what that entails but I get a dozen calls a day and need someone to yell at.
  - Pxtl 5y ago
    Yes, but aren't we talking about which country is the target of the scams, not the source?
- websap 5y ago

aldebran 5y ago

I’ve gone a few steps further and answered the “So?”. My wife thinks I’m a conspiracy nut even though I’ve provided proof of things that have happened. She thinks if it was that wide spread it would have been stopped already. Fortunately we’ve agreed on not sharing kids pics and information on places like FB insta etc.

deleted 5y ago
[deleted]

KingOfCoders 5y ago

Not that someone cares, but in the EU she would be responsible for violating the GDPR. Many people don't know that they are responsible as private citizens.

Kiro 5y ago
Only true if she violates a national law. GDPR itself does not apply to private citizens.
- KingOfCoders 5y ago
  GDPR does apply to private citizens. It does not apply to private citizens doing private things only eg with their phone.

jabroni_salad 5y ago

I think a lot of that comes from the fact that phone numbers being private at all is not a universal consideration. My town still, every year, sends me a paper book full of every resident's address and landline telephone.

_jal 5y ago
And here's where how something is used makes all the difference. I have zero issues with my neighbors having my phone number. If I lived in a smallish place, extending that would be fine. I have huge issues with spammers and con artists having it. A locally distributed physical book works great for the first and, at the very least, makes the second work for it. Online databases are basically made to order for the second, and are far more extensive than needed for the first. It is just another example where adding automation and cheap storage actively makes a situation worse.
- Kiro 5y ago
  In my country the same physical book has been available online for decades.

adolph 5y ago

It used to be that the phone company would annually throw a book on your porch with everyone in your town's name, phone and address. I can see how someone with that as a mental model for contact lists wouldn't see a problem.

unmole 5y ago

I'm old enough to remember telephone directories. Phone companies would publish listings of name, phone numbers and addresses of everyone who had a phone. Fun fact: Elector rolls are public record. Your address is already out in the open. > Giving this anecdote to illustrate many people genuinely don’t see TrueCaller’s spying as a big deal. That's because it makes no material difference to them.

ehPReth 5y ago
me too! I'm glad it's no longer the case though personally, if you've ditched "land lines" (at least in Canada?)