3 ms·

> He then repeatedly refused to fix the issue. I'm not too sure if that is actually the case. I'm only going on what the developer has mentioned in the forum

> He then repeatedly refused to fix the issue. I'm not too sure if that is actually the case. I'm only going on what the developer has mentioned in the forum about it, specifically here : https://forum.xda-developers.com/t/app-5-0-fairemail-fully-featured-open-source-privacy-oriented-email-app.3824168/page-1087#post-86909853 https://forum.xda-developers.com/t/app-5-0-fairemail-fully-f... From his own words : > The app most certainly doesn't upload any contact info, unless maybe your email address to login to the email server. > but they don't provide any details about what the app presumably is doing wrong. Where are you getting the info that it was scraping contact lists and sending it to 3rd party ?

tonmoy 4y ago
He may not be intentionally “uploading” contact info, but the HTTP server could be configured to keep log of all the contacts email addresses.
- bilekas 4y ago
  Yeah I read the runthrough here : https://news.ycombinator.com/item?id=31432334 https://news.ycombinator.com/item?id=31432334 It's a bit harsh, but I would have thought that the domain filtering would be done on device and favicon retrieval also on device. I must check the source code tbh. An interesting case though.
  - g_p 4y ago
    It appears domain filtering and favicon retrieval are indeed done on the device, looking at the code. It also appears to be off by default, requiring a user to turn it on manually. It looks like this also excludes any mail in the junk folder (to preserve privacy even when someone turns this on, presumably) I can't see how to do it in any more private way than this - it seems akin to a claim of "browser leaks details of requests to a third party", where said third party is the user's DNS server.
- gommm 4y ago
  Which HTTP server? the getFavicon method requests the favicon from each domain, so any one email provider only gets a single request for a favicon. It doesn't send all the contact info to any single server. So reading the code, say you have in your contact b@acme.com a@acme.com c@google.com The code makes a single request to acme.com (to get the favicon) and one to support.google.com to get that favicon (there's a special case for google to avoid getting the new doodle of the day). That's it. I don't really see how that's sharing contact details.

tonmoy 4y ago

He may not be intentionally “uploading” contact info, but the HTTP server could be configured to keep log of all the contacts email addresses.

bilekas 4y ago
Yeah I read the runthrough here : https://news.ycombinator.com/item?id=31432334 https://news.ycombinator.com/item?id=31432334 It's a bit harsh, but I would have thought that the domain filtering would be done on device and favicon retrieval also on device. I must check the source code tbh. An interesting case though.
- g_p 4y ago
  It appears domain filtering and favicon retrieval are indeed done on the device, looking at the code. It also appears to be off by default, requiring a user to turn it on manually. It looks like this also excludes any mail in the junk folder (to preserve privacy even when someone turns this on, presumably) I can't see how to do it in any more private way than this - it seems akin to a claim of "browser leaks details of requests to a third party", where said third party is the user's DNS server.
gommm 4y ago
Which HTTP server? the getFavicon method requests the favicon from each domain, so any one email provider only gets a single request for a favicon. It doesn't send all the contact info to any single server. So reading the code, say you have in your contact b@acme.com a@acme.com c@google.com The code makes a single request to acme.com (to get the favicon) and one to support.google.com to get that favicon (there's a special case for google to avoid getting the new doodle of the day). That's it. I don't really see how that's sharing contact details.