4 ms·

She probably gave Instagram access to her photo library (not unreasonable for a photo sharing app). That means the Instagram app can scan her latest pictures in

by planb 4y ago

She probably gave Instagram access to her photo library (not unreasonable for a photo sharing app). That means the Instagram app can scan her latest pictures in the background when it's opened. I think it's more likely that the data was leaked this way.

wil421 4y ago
Glad I deleted my Meta apps and only use online FB when I need to. The other day I noticed the yahoo mail app on iOS was reading my clipboard for no reason. I’m going to start blocking photos on most of my apps.
- pc86 4y ago
snowwrestler 4y ago
In case folks don’t know this: on an iPhone you do not need to give an app access to all your photos in order to use photos in the app. Under Privacy > Photos, you can set “Selected Photos” instead of “All Photos” on a per-app basis. Then when you go to add a photo to the app, you first go through an iOS prompt to select the photos the app will have access to. Only then do you go through the app’s photo selection dialogue. I have all my apps set this way (or “None”).
- nailer 4y ago
  I just did this and the UI is weird and confusing - it looks like I need to statically pick photos in the settings app, which obviously won’t work for day to day use every time I take a photo and want to publish it to instagram. Not saying it doesn’t work like you say, just saying it doesn’t look like it does.
  - bombcar 4y ago
    At least for Telegram each time you go to pick a photo to share, it offers you the chance to "add more photos visible" or you can click Manage. I assume Instagram and friends would do the same. I often just take the photo via Telegram instead, which automatically adds it to your photo roll and gives Telegram access to it. It works relatively well.
  - snowwrestler 4y ago
    You can just hit “done” in the settings app and it will close (with no photos selected). Then on Instagram (for example) when you go to post, you’ll get a message like “you’ve only let Instagram have partial access to your photos - Manage”. Tapping Manage will let you select photos that Instagram can access.
paavohtl 4y ago
Is this something that actually happens (= can anyone prove this by disassembling the app or MITMing the network traffic), or is it just unfounded paranoia?
- mid-kid 4y ago
  Considering how easy it is to implement these things without anyone noticing since it's closed source, you have to assume it is happening in any scenario where you need any decent opsec. Even in scenarios where you don't, there's been enough cases of similar things happening with well-known apps and services to be wary.
  - Shish2k 4y ago
    > Considering how easy it is to implement these things without anyone noticing since it's closed source I see you’ve never heard of Jane Manchun Wong...
  - dvtkrlbs 4y ago
    It shoukd be easy to test since Ios has a feature called app privacy report that lists networks and permission access and no when you just open the instagram app it does not access photos. Only when you open add to story page or click on the new post icon it does the access.
    - planb 4y ago
      Thanks for making me aware of this! You're right!
  - titaniczero 4y ago
    > Considering how easy it is to implement these things without anyone noticing since it's closed source You can reverse engineer those things and analyze your network traffic. You can’t have a client in a device controlled by the user, in this case an app, send anything to a server without anyone noticing it. And frankly, they don’t even need it. Just with your contacts they can link you to your friends and common interests without even you having a facebook account, all you need is friends with a fb/ig account who have linked their accounts to their phones and use whatsapp. The contacts are known to be sent to the server, they are known to be linked to facebook except in the european union where there is a different app from WhatsApp Ireland and a different privacy policy that specifically states (in the version outside of EU) that it shares your contacts with facebook and they are much more valuable and much less risky than reading your messages.
Melatonic 4y ago
Instagram is especially malicious with this - it is the only app that REQUIRES access to my microphone for me to post something. They try to do this by having a camera inside instagram (that you can record with which would obviously require mic access) but even to post stuff I have already taken (even just photos) it wants mic access. I usually temporarily give it what it wants, post, then remove again.

by planb 4y ago

wil421 4y ago

Glad I deleted my Meta apps and only use online FB when I need to. The other day I noticed the yahoo mail app on iOS was reading my clipboard for no reason. I’m going to start blocking photos on most of my apps.

pc86 4y ago

snowwrestler 4y ago

In case folks don’t know this: on an iPhone you do not need to give an app access to all your photos in order to use photos in the app. Under Privacy > Photos, you can set “Selected Photos” instead of “All Photos” on a per-app basis. Then when you go to add a photo to the app, you first go through an iOS prompt to select the photos the app will have access to. Only then do you go through the app’s photo selection dialogue. I have all my apps set this way (or “None”).

nailer 4y ago
I just did this and the UI is weird and confusing - it looks like I need to statically pick photos in the settings app, which obviously won’t work for day to day use every time I take a photo and want to publish it to instagram. Not saying it doesn’t work like you say, just saying it doesn’t look like it does.
- bombcar 4y ago
  At least for Telegram each time you go to pick a photo to share, it offers you the chance to "add more photos visible" or you can click Manage. I assume Instagram and friends would do the same. I often just take the photo via Telegram instead, which automatically adds it to your photo roll and gives Telegram access to it. It works relatively well.
- snowwrestler 4y ago
  You can just hit “done” in the settings app and it will close (with no photos selected). Then on Instagram (for example) when you go to post, you’ll get a message like “you’ve only let Instagram have partial access to your photos - Manage”. Tapping Manage will let you select photos that Instagram can access.

paavohtl 4y ago

Is this something that actually happens (= can anyone prove this by disassembling the app or MITMing the network traffic), or is it just unfounded paranoia?

mid-kid 4y ago
Considering how easy it is to implement these things without anyone noticing since it's closed source, you have to assume it is happening in any scenario where you need any decent opsec. Even in scenarios where you don't, there's been enough cases of similar things happening with well-known apps and services to be wary.
- Shish2k 4y ago
  > Considering how easy it is to implement these things without anyone noticing since it's closed source I see you’ve never heard of Jane Manchun Wong...
- dvtkrlbs 4y ago
  It shoukd be easy to test since Ios has a feature called app privacy report that lists networks and permission access and no when you just open the instagram app it does not access photos. Only when you open add to story page or click on the new post icon it does the access.
  - planb 4y ago
    Thanks for making me aware of this! You're right!
- titaniczero 4y ago
  > Considering how easy it is to implement these things without anyone noticing since it's closed source You can reverse engineer those things and analyze your network traffic. You can’t have a client in a device controlled by the user, in this case an app, send anything to a server without anyone noticing it. And frankly, they don’t even need it. Just with your contacts they can link you to your friends and common interests without even you having a facebook account, all you need is friends with a fb/ig account who have linked their accounts to their phones and use whatsapp. The contacts are known to be sent to the server, they are known to be linked to facebook except in the european union where there is a different app from WhatsApp Ireland and a different privacy policy that specifically states (in the version outside of EU) that it shares your contacts with facebook and they are much more valuable and much less risky than reading your messages.

Melatonic 4y ago

Instagram is especially malicious with this - it is the only app that REQUIRES access to my microphone for me to post something. They try to do this by having a camera inside instagram (that you can record with which would obviously require mic access) but even to post stuff I have already taken (even just photos) it wants mic access. I usually temporarily give it what it wants, post, then remove again.