4 ms·

It's worth noting that Instagram does this too, under the guise of "Find Your Friends." When you sign up for a new account, they aggressively prompt you to sync

It's worth noting that Instagram does this too, under the guise of "Find Your Friends." When you sign up for a new account, they aggressively prompt you to sync your contacts list with the app, and will continually prompt you in the future if you choose not to. Nearly all of my friends have this enabled. This is not a one-time sync, either. It will upload future new contacts and changes. And, finally, if you manage to create a new account without a phone number, Instagram appears to flag your account for suspicious activity at some point and mandates that you do. They can then correspond your phone number with other users' contact lists to determine your identity. It can even suss out if you provided a Google Voice/VOIP number and require a "real" one instead. https://help.instagram.com/195069860617299 https://help.instagram.com/195069860617299

thelittleone 5y ago
Contact lists should be treated like PII and have laws and technical controls against sharing them without the permission of the contact. Incredibly difficult to do no doubt. But if people are ok to share their contact let them. Let others opt out.
techsupporter 5y ago
> When you sign up for a new account, they aggressively prompt you to sync your contacts list with the app, and will continually prompt you in the future if you choose not to. Even everyone's much-loved Signal does this. Contacts sync is presented as "not now" or "yes forever." The "not now" message even explicitly says they'll bug you again.
- tompagenet2 5y ago
  Are you sure? This page [1] says this is not the case [1] https://support.signal.org/hc/en-us/articles/360007061452-Does-Signal-send-my-number-to-my-contacts- https://support.signal.org/hc/en-us/articles/360007061452-Do...
  - Groxx 5y ago
    No, they're still uploading the same data as they did before (last I looked into it, it was still enough data to rather easily reverse and get pretty good accuracy. if it wasn't accurate, it would have unacceptably many false-positives, so it's a necessary quality of the system). Regardless of how you hash them, it needs to work on a phone, and it needs to be reasonably unique... so you can just enumerate literally every phone number ever on a decent computer in a few seconds and, if combined with basically any other information at all (like an area code), that's enough to figure out many or most contacts trivially. The difference, which that article goes into, is that now they're going all-in on you also trusting Intel's SGX and thus every single thing in between you, them, their hardware delivery pipelines, etc. Which makes collecting that data completely ok (it's done securely now thanks to SGX!), because you should obviously trust Intel because CPU vendors have had such a fantastic track record in their on-chip security systems. (</sarcasm> in case that wasn't clear) There's a lot to like about Signal's privacy, both in isolation and in comparison to other messengers. They're doing great work. But I have absolutely no idea why they persist in this data collection. Their bull-headedness on zero options around it for years on end smells more suspicious than anything else at this point tbh. About 3/4 of the people I've known who installed Signal immediately left forever because someone they knew contacted them to say "welcome" and they got super creeped out wondering how they knew they had joined. And then the contact-er frequently left too because they had no idea it wasn't consensual, and were creeped out as well.
- nathancahill 5y ago
  Signal is worse, because when you sign up with a phone number, everyone that has your number in their address book gets a notification from Signal that you signed up.
  - amitport 5y ago
    They claim it is done without revealing these contact to signal. Assuming they are telling the truth, why would you care that your contacts know you also use signal (like them)?
vmception 5y ago
Facebook has done this periodically over the years as well. So I'm not surprised they ported that feature over or independently evolved to it on Instagram. I had caught on to the concept of breaking the social graph by using a virgin email and never putting in a phone number not even for 2-factor even once. But then there is a great risk that they flag you for "spam" within days or minutes! Honestly, Apple needs to get in front of this on iOS just like they've done partially with Location data, Photos/Videos, and data brokering. They need to let you select shareable contacts. Kind of like the Circles that Google Wave had. Instead of letting apps force you into an all or nothing approach.

thelittleone 5y ago

Contact lists should be treated like PII and have laws and technical controls against sharing them without the permission of the contact. Incredibly difficult to do no doubt. But if people are ok to share their contact let them. Let others opt out.

techsupporter 5y ago

> When you sign up for a new account, they aggressively prompt you to sync your contacts list with the app, and will continually prompt you in the future if you choose not to. Even everyone's much-loved Signal does this. Contacts sync is presented as "not now" or "yes forever." The "not now" message even explicitly says they'll bug you again.

tompagenet2 5y ago
Are you sure? This page [1] says this is not the case [1] https://support.signal.org/hc/en-us/articles/360007061452-Does-Signal-send-my-number-to-my-contacts- https://support.signal.org/hc/en-us/articles/360007061452-Do...
- Groxx 5y ago
  No, they're still uploading the same data as they did before (last I looked into it, it was still enough data to rather easily reverse and get pretty good accuracy. if it wasn't accurate, it would have unacceptably many false-positives, so it's a necessary quality of the system). Regardless of how you hash them, it needs to work on a phone, and it needs to be reasonably unique... so you can just enumerate literally every phone number ever on a decent computer in a few seconds and, if combined with basically any other information at all (like an area code), that's enough to figure out many or most contacts trivially. The difference, which that article goes into, is that now they're going all-in on you also trusting Intel's SGX and thus every single thing in between you, them, their hardware delivery pipelines, etc. Which makes collecting that data completely ok (it's done securely now thanks to SGX!), because you should obviously trust Intel because CPU vendors have had such a fantastic track record in their on-chip security systems. (</sarcasm> in case that wasn't clear) There's a lot to like about Signal's privacy, both in isolation and in comparison to other messengers. They're doing great work. But I have absolutely no idea why they persist in this data collection. Their bull-headedness on zero options around it for years on end smells more suspicious than anything else at this point tbh. About 3/4 of the people I've known who installed Signal immediately left forever because someone they knew contacted them to say "welcome" and they got super creeped out wondering how they knew they had joined. And then the contact-er frequently left too because they had no idea it wasn't consensual, and were creeped out as well.
nathancahill 5y ago
Signal is worse, because when you sign up with a phone number, everyone that has your number in their address book gets a notification from Signal that you signed up.
- amitport 5y ago
  They claim it is done without revealing these contact to signal. Assuming they are telling the truth, why would you care that your contacts know you also use signal (like them)?

vmception 5y ago

Facebook has done this periodically over the years as well. So I'm not surprised they ported that feature over or independently evolved to it on Instagram. I had caught on to the concept of breaking the social graph by using a virgin email and never putting in a phone number not even for 2-factor even once. But then there is a great risk that they flag you for "spam" within days or minutes! Honestly, Apple needs to get in front of this on iOS just like they've done partially with Location data, Photos/Videos, and data brokering. They need to let you select shareable contacts. Kind of like the Circles that Google Wave had. Instead of letting apps force you into an all or nothing approach.