9 ms·

Stealing Your Address Book

239 points by maccman 15y ago

dredmorbius 15y ago
Why can I not lock down my phone information and describe, at the device level, what I'm willing to share? The present alternative (on Android) is to allow/deny applications on a case-by-case basis. Fuck up once and I've let slip data I don't want to share. Some apps cannot be deleted (on an unrooted, phone -- only with difficulty on a rooted one). Why can I not query each and every application vendor for all data held on me, and either modify or correct this as I see fit? I've enjoyed playing with my Android phone for the past while, but I'm increasingly very unhappy carrying a persistent snitch in my pocket. I'm waiting for the Perl Harbor / 9/11 day for this stuff. It's going to happen, it's a matter of when.
deleted 15y ago
[deleted]
stevenou 15y ago
It is super curious why Apple decided to allow apps to access the Address Book freely. I'm releasing an app on the App Store next week and I definitely thought about all the evil things I could do to my users because Apple provides them no protection. And as a developer looking for success on the App Store, it is very tempting. I once considered the possibility of uploading the entire address book to my servers, too. In fact, I even considered email/sms spamming everyone in those address books with "invitations" from the address book owner to download my app. Of course, I did not end up doing any of that nefarious stuff. Not even uploading the address book for innocent "Add Friends" features. But the fact remains that given the freedom to do so, almost every developer will be, at least, tempted to take advantage of it. Most will. I honestly don't think Path did anything wrong and I'm sure they kept the information secure on their servers. It's Apple that somehow let this one slip through.
- eridius 15y ago
  Your stance seems to boil down to "if Apple doesn't catch you and reject your app, then you've done nothing wrong", which seems preposterous.
  - stevenou 15y ago
    I think you misunderstand. I think Path did nothing wrong not because they "weren't caught". I'm sure they keep their data secure and they only use it to benefit the user's experience - ergo, nothing wrong. On the other hand, if say, they spammed people's address books, then I would think they are in the wrong. Or if they sold the data, then they are in the wrong. But as far as I can tell, they did nothing bad. Oh and by "let it slip through," I didn't mean the app itself, but the fact that the SDK requires no authorization from the user for any app to access the address book. Like the author of the article said, it requires it for location. Why on earth doesn't it require it for your contacts? They're arguably much more valuable.
- rvkennedy 15y ago
  Perhaps, to Apple, it's really not your data. When you put data on an Apple device, they consider it to belong to Apple. So the appropriate permission was granted when they accepted Path into the App Store. Maybe this is the Apple way of thinking?
  - jjtheblunt 15y ago
    "When you put data on an Apple device, they consider it to belong to Apple." What is the basis for that claim?
    - mattgreenrocks 15y ago
      Inevitably, it ends up being the speaker's dislike of said brand. Ah, Internet.
      - rvkennedy 15y ago
        It's a supposition, sorry if thinking about the possibilities upset the fanboys out there.
phuff 15y ago
I think it's a bit conspiracy-theorist to say that companies do this because they want to use everything they can get. The relatively easy privacy maintaining alternative (hash address book contents and store the hash, and check against hashes when people join) is simply not as obvious as simply uploading what you get from the API. Most app developers are just trying to get a job done as quickly as they can, and are in that hustle are choosing the path of least resistance, rather than thinking, "I really want to exploit this data as much as possible and invade as much privacy as possible."
- baddox 15y ago
  Would hashing contact information placate those who are outraged at this practice? It would still enable the app to associate you with other users of the app without your explicit information. It seems to me that the biggest complaints are that Apple doesn't popup a permission dialog before allowing an app to access your address book, and that Path's privacy policy seemed to omit that they were using your address book.
  - bigiain 15y ago
    Keep in mind too, that the data involved is all small enough that rainbow tables could easily be used to reverse them. My cell phone number's unsalted MD5 hash is trivially reversable via a google search - and if you salted it, you couldn't then compare it to the hash out of someone else's address book. I've seen rainbow tables claiming 100% coverage of all <14 lowercase characters. I'd bet reasonable money that there's a rainbow table specifically generated for email-address-like strings and another for name-like-strings. I'm pretty sure both names and email addresses have a lot less entropy than random lowercase letter for the same lengths. Using hashes to obfuscate while still maintaining comparison ability of low entropy data really doesn't help security much…
    - ghshephard 15y ago
      Particularly because 85% of "average" people in north america keep their email in one of 5 mail domains (hotmail.com, aol.com, yahoo.com, gmail.com, Facebook.com) - that, plus the low entropy of names - means the rainbow tables would probably have a 95% hit rate at relatively small sizes.
WestCoastJustin 15y ago
Am I missing something? I'm not a iPhone/iOS user so please forgive me. Does iPhone/iOS not ask if you give permission for this App to view your Address Book? If not, then I can see why this might be Apples fault for allowing developers to abuse this. If yes, then how can this possibly be Apple's fault? It seems almost absurd to blame them. The buck stops with the end user for not protecting their Address Book. If you allow some weather app to download your Address Book, why should Apple care? You cannot trust every developer (turns out we are all data hungry), and they even asked to peak in there too.. You explicitly gave them permission!
- Macha 15y ago
  All iOS apps have every permission except location without asking.
  - WestCoastJustin 15y ago
    Wow, that is news to me! My guess is that there will be some privacy restrictions / access control lists coming down the pipe after this flare up.
  - amitparikh 15y ago
    Every permission? How about the permission to access your Camera Roll (as described in this blog post)? Clearly that is NOT granted by default. I think you're overgeneralizing...
    - Macha 15y ago
      Oh. My ipod touch didn't have a camera roll, so I guess that could be restricted too.
  - baddox 15y ago
    Then does it make sense to call it a "permission?"
  - ryanwaggoner 15y ago
    Here are a list of things that iOS apps can't access by default: - location (only accessible via permissions dialog) - existing photos and videos (only accessible via apple-provided picker dialog) - reading email or SMS (never accessible) - sending email or SMS (only accessible via apple-provided compose dialog) - any data or settings for other apps (never accessible) - push notifications (only allowed after permissions dialog) - Safari history, cache, cookies, etc (never accessible) In fact, the only thing apps can access without permission that's really problematic are the contacts. And yes, I expect Apple will be closing this very soon. You could maybe argue that accessing the live camera and microphone feed are an issue?
spwmoni 15y ago
Not really related to the content of the article, but my pointer wandered over some dot on the page. Suddenly it started animating, with the caption "DON'T MOVE." So I didn't. Then it changed to a checkmark, with the caption "SENT." What the hell did I just do?
- kyro 15y ago
  You just sent your entire email list to his servers.
- dangrossman 15y ago
  You sent an HTTP POST to http://dcurt.is/stealing-your-address-book/add_kudos http://dcurt.is/stealing-your-address-book/add_kudos. This results in incrementing the "# KUDOS" number under the dot. He seems to have built his own "like this" button, essentially, with a like counter.
- paxswill 15y ago
  Gave "Kudos" it seems. Kinda like a +1 or thumbs up.
- bittersweet 15y ago
  I did this as well, it seems very obvious but it's a great insight in human behaviour.
polemic 15y ago
It's interesting that one side effect of the Apple 'walled-garden' and the perceive strictness of the app approval process has led to the idea that: > ...this issue is a failure of Apple and a breach of trust by Apple, not by app developers. That's a cop-out, of course. There is no lesser responsibility on the part of an app developer to "do no evil" if you've simply bent your definition of evil to "whatever Apple DOESN'T let me do to their users". Let's look at this statement: > ...there's a quiet understanding among many iOS app developers that it is acceptable to... That should be a big red flag to the writer. Quiet understandings have led to all sorts of problems - certain financial collapses come to mind. Ultimately, this is something Apple needs to confront. Consistency is far more important that any specific moral position - for users and app developers. But that's not a get out of jail free card for the developer.
- baddox 15y ago
  > That's a cop-out, of course. There is no lesser responsibility on the part of an app developer to "do no evil" if you've simply bent your definition of evil to "whatever Apple DOESN'T let me do to their users". That's arguable. Privacy is all about "expectation of privacy," which means there's really no predictable, testable methodology other than implementing a feature and finding out if people are outraged. In fact, it's almost certainly different for apps with different target audiences. Path probably gets a lot of tech-savvy 20- and 30-something users who are outraged by address book sharing, but the average Facebook user probably wouldn't care even if they found out it was happening. Obviously, this just means that developers should err on the side of openness (e.g. in your privacy policy) and explicitness (e.g. popup dialog asking for permission). But that's often only apparent in hindsight, since a developer may never think that something could even be interpreted as a privacy issue, since the developer knows he or she will never misuse the data or even use it all in any personally-identifiable way. Presumably, for better or for worse, many developers either consciously or subconsciously trust Apple to have a pulse on the community of users when it comes to privacy. It would be nice to be able to do so, but apparently that can't be trusted. Of course, from the user's perspective, it means they can't trust any app to not be abusive (according to their own definition of "abuse").
- a_a_r_o_n 15y ago
copenhagencoder 15y ago
"I fully believe this issue is a failure of Apple and a breach of trust by Apple, not by app developers." So the companies that willfully ignore Apple's app rules and normal ethics are in no way to blame?
nantes 15y ago
So, let's see if I can turn this into a positive ... A while back I casually nuked my iPhone 3G back to factory to give to a friend. I did so without realizing there were some contacts on there that failed to backup to my Mac. What are the odds some startup or other company out there has my contacts? Do any of them offer personal data dumps? Sadly, these contacts never made it to Google, where I can dump the data. Just curious.
geoffbp 15y ago
I wouldn't really care if a company had access to my address book, different if they were reading my memos or something though.
- rkudeshi 15y ago
  I suspect your address book is just names and phone numbers? I use my address book for everything. I have my contacts' names, phone numbers, email addresses, addresses, IM usernames, birthdays, anniversaries, websites, workplace and other info stored in mine (not to mention some personal info jotted in the notes section). Until today, I believed that information was secure. I had no idea an app could upload all of that information to their server WITHOUT MY KNOWLEDGE, much less consent. Because of Google's approval process (or lack thereof), Android users have always been paranoid of the apps they install and what permissions they give them. As an iOS user, I never thought I had to worry about that because of Apple's approval process. Does it make a little more sense why some of us are furious about this now?
  - kisielk 15y ago
    Exactly. I was always under the (apparently totally mistaken) assumption that Apple's approval process was there to catch exactly this kind of behaviour. It's supposed one of the reasons why an Android-style permissions system is not necessary on iOS devices. Recently it seems it's been coming to light that their curation process is not nearly as thorough as they would have us believe.
- bigiain 15y ago
  Two things. Are you sure all the people in your address book are as careless about that data? The friend with the restraining out against their ex? The minor celebrity with the unlisted phone number? Are you happy with the possibility that a connection between you and someone else might be implied without being true? What if a known drug dealer* had your phone number in their address book? (Perhaps via a room mate or child using the landline to have called them once? Or through reuse of an expired disposable cellphone number?) * or child pornographer, or political dissident, or terrorist, or…
pclark 15y ago
I find the whole thing really rather curious. I too am baffled as to why Apple has allowed this functionality from day one. I am also surprised that there has not been considerably more malicious usages of this data. Apple clearly does not enforce the the guidelines 17.1 strictly - but some developers are rejected for this. I can imagine it being possible (and I have no idea) that Apple turns a blind eye to developers that break this rule on the assumption they are doing it as a reputable company and doing it for "clear" value to the end user. (e.g.: not just acquiring all your contacts despite being a fart app.) > 17.1: Apps cannot transmit data about a user without obtaining the user's prior permission and providing the user with access to information about how and where the data will be used. Apple traditionally will happily leave functionality users or developers deem critical out of iOS until it is done right - push notifications, geo-location, background applications. It seems to make so much sense that "contacts" are part of something that Apple would want to do right - after all - it can create significant value for the user. (as discussed here: http://parislemon.com/post/11647475506/your-true-social-network http://parislemon.com/post/11647475506/your-true-social-netw...) But that doesn't explain why allow it in the first place in its current state? Its a really odd thing to simply offer developers on a whim (all their SDK blurb says is "Your application can create new Address Book contacts and get existing contact info.") Why can I import all of a users' contacts but it is not possible to populate an iMessage with a recipient and content? (I mean, Game Centre, the nearest thing to an Apple "social network" uses contacts to find your friends but in a truly terrible - albeit more ethical - manner. Which is both parts fascinating and infuriating as GameCentre is mostly crippled by being incapable of finding your friends.) At a guess: internally Apple iOS development is under resourced and they have a todo list a mile long. This simply has not been a severe enough problem that it has warranted being fixed yet. Whatever the reason, I hope it gets fixed.
- Terretta 15y ago
  They didn't allow it from day one. GPS apps, for example, couldn't navigate to contact addresses. VOIP couldn't use your numbers. It was relaxed later. I don't recall exactly when, but I'm thinking around 3.2 or so. Before whatever update, you had to have silos of contacts. After it, all apps could use your address book.
- 15y ago
creativityland 15y ago
There are many legitimate uses and I know I've downloaded many apps that uploaded my phone book for backup purposes, syncing purposes so on. Anything can be abused if used wrongly however, that's my philosophy.
feralchimp 15y ago
The biggest problem with all of this, and which I'm surprised no one else has mentioned, is that my Address Book isn't principally "personal data about me, which I wish to keep safe." It is "personal data about other, often more important people, who have entrusted me with the security of that data"! If you pull my CEO's private contact info off my phone, or pull a high-level contact from some company we've been privately looking to acquire, you best pray that theft doesn't result in a leak of privileged business information.
- k-mcgrady 15y ago
  Excellent point that most people have missed (I've actually brought it up in a few threads now). They are taking data that others have entrusted you with which is the worst part of this. If there servers were compromised not only would my data be stolen but the data of all my friends, family, and colleagues.
- apgwoz 15y ago
  > or pull a high-level contact from some company we've been privately looking to acquire, you best pray that theft doesn't result in a leak of privileged business information. Right, because the presence of some contacts at company B immediately implies "oh, we're going to acquire them." What people really aren't mentioning is that people give out the information likely stored in your address book to pretty much any service that even looks to be interesting based on a screencast, or even a splash page. Do you read the terms of service and privacy policies of all random websites you sign up for? Do the people whose contact information you are protecting do so?
  - erikpukinskis 15y ago
    people give out the information likely stored in your address book to pretty much any service that even looks to be interesting You're missing a "some" in that sentence, and the difference between "all people" and "some people" sort of renders your point moot.
  - deleted 15y ago
    [deleted]
zbowling 15y ago
Apple avoids the Vista like "ask for permission" on access design like android by requiring you to justify your needs to the app reviewer as an app developer. Not having an untrusted source of apps that can install on the device that is allowed on the iPhone means Apple can, in theory, improve user experience by not having as many of these dialogs bugging the user. Apps, should just work.® Constant permission prompts just train users in to muscle memory to accept these dialogs without thinking. Instead Apple sees it better make developers justify their needs to the APIs when they submit. Then Apple tests the app and looks for anything fishy. In the end, they reserve the right to pull them when they violate their terms. The article is wrong in that the camera roll is secure. It's technically not. Through the asset library API you can get at it. See docs here: https://developer.apple.com/library/ios/#documentation/AssetsLibrary/Reference/ALAssetsLibrary_Class/Reference/Reference.html https://developer.apple.com/library/ios/#documentation/Asset... One of the issues Android had up until recently was that you couldn't update all apps in one shot. The reason is that app update may have required permission changes from a pervious version. You would have to acknowledge each of these before installing the update. This was a crappy user experience and it's still the current experience when you install 3rd party APKs and update them. The problems with these "list of permissions wanted" screens is they don't let the developers justify to the user why they need access to these different features inline with the request. The users see it at install or update often. There are often very simple reasons why I need access to data on the device on Android in my app. I had people not install my app because I asked to send SMSs (which tells the user I can charge them money that way) in my music app, but it's only because I had a share button that is user invoked and clearly is sending a text message to user. Sure, be clear with your intent with your users, but these permission models don't always scale for the everyday users.
- tedivm 15y ago
  Apple already has a prompt before allowing applications access to your location- the address book seems just as important.
- furyofantares 15y ago
  Your complaints can be addressed by waiting to ask for permission the first time the app needs it, as opposed to a list of permissions to give at install time, and making the 'yes' answer sticky as opposed to prompting constantly.
gojomo 15y ago
Apple doesn't just allow this; it seems they do it (for Twitter's benefit) themselves, in the official iOS5 Twitter integration settings panel: http://cache.gizmodo.com/assets/images/4/2011/06/ios5twitter2.jpg http://cache.gizmodo.com/assets/images/4/2011/06/ios5twitter... (It's possible they're scraping Twitter handles/photos in some way that doesn't link the 'email addresses and phone numbers' to the requester's Twitter handle... but almost any straightforward way of implementing this has the de facto effect of informing Twitter of all your contacts' emails and phone numbers.) Everyone's at it.
jacques_chester 15y ago
It seems to me that all of these applications would be in trouble under Australia's fairly strict privacy laws. In particular, you are allowed only to collect details reasonably useful to your business and you must give a great deal of notice that this is happening[1]. Persons wishing to bring this issue to Apple's attention might wish to engage an Australian lawyer or bring the matter to the attention of the Attorney-General's department. I don't have an iPhone, so I'd have no standing. Fellow Australians, call your lawyers and start raising a stink. (IANAL, TINLA). [1] http://www.privacy.gov.au/materials/types/infosheets/view/6583 http://www.privacy.gov.au/materials/types/infosheets/view/65...
droithomme 15y ago
We develop software for Windows and Macs. On the Mac the address book files are certainly available to read, and also available through an API. We don't read these files, we don't upload them, and we don't analyze them. We don't touch them at all. We also don't touch anything else on our customer's system that they wouldn't normally be expecting, and we don't send any information back to our server without the user explicitly saying it's OK when it happens. Here's one reason why we don't scan people's system for interesting private files and secretly upload it for our economic benefit: 1. It violates the user's trust, expectations and privacy. Here's a second reason: 2. It is a criminal act to do so. I don't buy these discussions about how it is Apple's fault. It's not. It's illegal to steal private data like this. The companies doing this should be raided and shut down by the FBI immediately. All of them. Whether or not they issued a tearful apology.
- abcd_f 15y ago
  These are all fine and valid points, but the fact remains that a free game app might be very tempted to complement its lousy revenue by stealing and reselling users' address books and anything else their app can get its hands on. I as an iPhone user want a protection against that.
  - droithomme 15y ago
    And it's criminal to do so. Software that steals data is malware. Prosecute these companies severely, put their president and the engineers who were in on it in prison for data theft and conspiracy. It's not like there isn't overwhelming evidence proving the case in these situations.
    - mistermann 15y ago
      All of which costs millions of dollars. Alternatively, Apple could spend a few thousand dollars and properly secure their MULTI billion dollar platform so the problem couldn't occur in the first place.
      - 15y ago
idspispopd 15y ago
I'm curious why Apple allows this also, but making this an excuse to render a blame and bash Apple article is misguided. I say misguided because there are many ways that your personal information, behaviours, interests and usage history can be fettered away from you all outside of Apple's control, this is a privacy and transparency issue. Not only should there be some level of respect for the information you possess (especially information you possess on others), but many countries already have legislation that address these privacy concerns specifically. This means that there are real legal consequences to this address book saga, but contrary to the article's spin this is again not directed at Apple. In short: Apple can do more to protect users, but shovelling them with the full blame over apps that are deliberately designed to gather and produce results from your contact information to provide is misguided.
- eternalban 15y ago
  The people who built your house also "allow" thieves to break in your house rather trivially. Would you hold them responsible in the event of a robbery?
  - orangecat 15y ago
    If the builders were using security as a major selling point when marketing the houses, it wouldn't be unreasonable.
  - yabai 15y ago
    I don't think this is exactly the case. More like...the people who built your house and are guarding it allowed thieves to break in. I believe I might hold them responsible.
four 15y ago
Unacceptable. What craven view of ethics puts any concept of "user experience" above treating others truthfully and respecting their privacy, property and personal domain? This is not a "mistake". Why would anyone want to have anything to do with such people, much less be their customer? This warrants punishment, not forgiveness.
enobrev 15y ago
It's a lazy mistake. The tools are provided by way of a command or two on just about any platform available to any programmer. Hashing information and matching against said hash are problems that have been solved and simplified in as many languages as asking for the bathroom. It's easier to send the raw data. It's foolish to send the raw data. It's a lazy mistake. We all know it happens. We all know WHY it happens. Stop fucking with our data. Pay attention because sometimes you should not be quite so lazy. Path gets off easy because they're Path. I'm ok with that. But I would fire your ass if you did this under my watch because I know for a fact that this is a stupidly easy problem to resolve. Don't be so damned lazy when it matters.
twsted 15y ago
I think that it is important that at least 2 levels of access can be asked by an app per resource (location, contacts, etc): 1. Permission to access a resource just locally for the benefit of the user; 2. Permission to transmit the data about a resource for social purposes.
becasse 15y ago
tl;dr - What d'you mean stealing address books is wrong?! Everyone else is doing it!

239 points by maccman 15y ago

Why can I not lock down my phone information and describe, at the device level, what I'm willing to share? The present alternative (on Android) is to allow/deny applications on a case-by-case basis. Fuck up once and I've let slip data I don't want to share. Some apps cannot be deleted (on an unrooted, phone -- only with difficulty on a rooted one). Why can I not query each and every application vendor for all data held on me, and either modify or correct this as I see fit? I've enjoyed playing with my Android phone for the past while, but I'm increasingly very unhappy carrying a persistent snitch in my pocket. I'm waiting for the Perl Harbor / 9/11 day for this stuff. It's going to happen, it's a matter of when.

deleted 15y ago

[deleted]

stevenou 15y ago

It is super curious why Apple decided to allow apps to access the Address Book freely. I'm releasing an app on the App Store next week and I definitely thought about all the evil things I could do to my users because Apple provides them no protection. And as a developer looking for success on the App Store, it is very tempting. I once considered the possibility of uploading the entire address book to my servers, too. In fact, I even considered email/sms spamming everyone in those address books with "invitations" from the address book owner to download my app. Of course, I did not end up doing any of that nefarious stuff. Not even uploading the address book for innocent "Add Friends" features. But the fact remains that given the freedom to do so, almost every developer will be, at least, tempted to take advantage of it. Most will. I honestly don't think Path did anything wrong and I'm sure they kept the information secure on their servers. It's Apple that somehow let this one slip through.

eridius 15y ago
Your stance seems to boil down to "if Apple doesn't catch you and reject your app, then you've done nothing wrong", which seems preposterous.
- stevenou 15y ago
  I think you misunderstand. I think Path did nothing wrong not because they "weren't caught". I'm sure they keep their data secure and they only use it to benefit the user's experience - ergo, nothing wrong. On the other hand, if say, they spammed people's address books, then I would think they are in the wrong. Or if they sold the data, then they are in the wrong. But as far as I can tell, they did nothing bad. Oh and by "let it slip through," I didn't mean the app itself, but the fact that the SDK requires no authorization from the user for any app to access the address book. Like the author of the article said, it requires it for location. Why on earth doesn't it require it for your contacts? They're arguably much more valuable.
rvkennedy 15y ago
Perhaps, to Apple, it's really not your data. When you put data on an Apple device, they consider it to belong to Apple. So the appropriate permission was granted when they accepted Path into the App Store. Maybe this is the Apple way of thinking?
- jjtheblunt 15y ago
  "When you put data on an Apple device, they consider it to belong to Apple." What is the basis for that claim?
  - mattgreenrocks 15y ago
    Inevitably, it ends up being the speaker's dislike of said brand. Ah, Internet.
    - rvkennedy 15y ago
      It's a supposition, sorry if thinking about the possibilities upset the fanboys out there.

phuff 15y ago

I think it's a bit conspiracy-theorist to say that companies do this because they want to use everything they can get. The relatively easy privacy maintaining alternative (hash address book contents and store the hash, and check against hashes when people join) is simply not as obvious as simply uploading what you get from the API. Most app developers are just trying to get a job done as quickly as they can, and are in that hustle are choosing the path of least resistance, rather than thinking, "I really want to exploit this data as much as possible and invade as much privacy as possible."

baddox 15y ago
Would hashing contact information placate those who are outraged at this practice? It would still enable the app to associate you with other users of the app without your explicit information. It seems to me that the biggest complaints are that Apple doesn't popup a permission dialog before allowing an app to access your address book, and that Path's privacy policy seemed to omit that they were using your address book.
- bigiain 15y ago
  Keep in mind too, that the data involved is all small enough that rainbow tables could easily be used to reverse them. My cell phone number's unsalted MD5 hash is trivially reversable via a google search - and if you salted it, you couldn't then compare it to the hash out of someone else's address book. I've seen rainbow tables claiming 100% coverage of all <14 lowercase characters. I'd bet reasonable money that there's a rainbow table specifically generated for email-address-like strings and another for name-like-strings. I'm pretty sure both names and email addresses have a lot less entropy than random lowercase letter for the same lengths. Using hashes to obfuscate while still maintaining comparison ability of low entropy data really doesn't help security much…
  - ghshephard 15y ago
    Particularly because 85% of "average" people in north america keep their email in one of 5 mail domains (hotmail.com, aol.com, yahoo.com, gmail.com, Facebook.com) - that, plus the low entropy of names - means the rainbow tables would probably have a 95% hit rate at relatively small sizes.

WestCoastJustin 15y ago

Am I missing something? I'm not a iPhone/iOS user so please forgive me. Does iPhone/iOS not ask if you give permission for this App to view your Address Book? If not, then I can see why this might be Apples fault for allowing developers to abuse this. If yes, then how can this possibly be Apple's fault? It seems almost absurd to blame them. The buck stops with the end user for not protecting their Address Book. If you allow some weather app to download your Address Book, why should Apple care? You cannot trust every developer (turns out we are all data hungry), and they even asked to peak in there too.. You explicitly gave them permission!

Macha 15y ago
All iOS apps have every permission except location without asking.
- WestCoastJustin 15y ago
  Wow, that is news to me! My guess is that there will be some privacy restrictions / access control lists coming down the pipe after this flare up.
- amitparikh 15y ago
  Every permission? How about the permission to access your Camera Roll (as described in this blog post)? Clearly that is NOT granted by default. I think you're overgeneralizing...
  - Macha 15y ago
    Oh. My ipod touch didn't have a camera roll, so I guess that could be restricted too.
- baddox 15y ago
  Then does it make sense to call it a "permission?"
- ryanwaggoner 15y ago
  Here are a list of things that iOS apps can't access by default: - location (only accessible via permissions dialog) - existing photos and videos (only accessible via apple-provided picker dialog) - reading email or SMS (never accessible) - sending email or SMS (only accessible via apple-provided compose dialog) - any data or settings for other apps (never accessible) - push notifications (only allowed after permissions dialog) - Safari history, cache, cookies, etc (never accessible) In fact, the only thing apps can access without permission that's really problematic are the contacts. And yes, I expect Apple will be closing this very soon. You could maybe argue that accessing the live camera and microphone feed are an issue?

spwmoni 15y ago

Not really related to the content of the article, but my pointer wandered over some dot on the page. Suddenly it started animating, with the caption "DON'T MOVE." So I didn't. Then it changed to a checkmark, with the caption "SENT." What the hell did I just do?

kyro 15y ago
You just sent your entire email list to his servers.
dangrossman 15y ago
You sent an HTTP POST to http://dcurt.is/stealing-your-address-book/add_kudos http://dcurt.is/stealing-your-address-book/add_kudos. This results in incrementing the "# KUDOS" number under the dot. He seems to have built his own "like this" button, essentially, with a like counter.
paxswill 15y ago
Gave "Kudos" it seems. Kinda like a +1 or thumbs up.
bittersweet 15y ago
I did this as well, it seems very obvious but it's a great insight in human behaviour.

polemic 15y ago

It's interesting that one side effect of the Apple 'walled-garden' and the perceive strictness of the app approval process has led to the idea that: > ...this issue is a failure of Apple and a breach of trust by Apple, not by app developers. That's a cop-out, of course. There is no lesser responsibility on the part of an app developer to "do no evil" if you've simply bent your definition of evil to "whatever Apple DOESN'T let me do to their users". Let's look at this statement: > ...there's a quiet understanding among many iOS app developers that it is acceptable to... That should be a big red flag to the writer. Quiet understandings have led to all sorts of problems - certain financial collapses come to mind. Ultimately, this is something Apple needs to confront. Consistency is far more important that any specific moral position - for users and app developers. But that's not a get out of jail free card for the developer.

baddox 15y ago
> That's a cop-out, of course. There is no lesser responsibility on the part of an app developer to "do no evil" if you've simply bent your definition of evil to "whatever Apple DOESN'T let me do to their users". That's arguable. Privacy is all about "expectation of privacy," which means there's really no predictable, testable methodology other than implementing a feature and finding out if people are outraged. In fact, it's almost certainly different for apps with different target audiences. Path probably gets a lot of tech-savvy 20- and 30-something users who are outraged by address book sharing, but the average Facebook user probably wouldn't care even if they found out it was happening. Obviously, this just means that developers should err on the side of openness (e.g. in your privacy policy) and explicitness (e.g. popup dialog asking for permission). But that's often only apparent in hindsight, since a developer may never think that something could even be interpreted as a privacy issue, since the developer knows he or she will never misuse the data or even use it all in any personally-identifiable way. Presumably, for better or for worse, many developers either consciously or subconsciously trust Apple to have a pulse on the community of users when it comes to privacy. It would be nice to be able to do so, but apparently that can't be trusted. Of course, from the user's perspective, it means they can't trust any app to not be abusive (according to their own definition of "abuse").
a_a_r_o_n 15y ago

copenhagencoder 15y ago

"I fully believe this issue is a failure of Apple and a breach of trust by Apple, not by app developers." So the companies that willfully ignore Apple's app rules and normal ethics are in no way to blame?

nantes 15y ago

So, let's see if I can turn this into a positive ... A while back I casually nuked my iPhone 3G back to factory to give to a friend. I did so without realizing there were some contacts on there that failed to backup to my Mac. What are the odds some startup or other company out there has my contacts? Do any of them offer personal data dumps? Sadly, these contacts never made it to Google, where I can dump the data. Just curious.

geoffbp 15y ago

I wouldn't really care if a company had access to my address book, different if they were reading my memos or something though.

rkudeshi 15y ago
I suspect your address book is just names and phone numbers? I use my address book for everything. I have my contacts' names, phone numbers, email addresses, addresses, IM usernames, birthdays, anniversaries, websites, workplace and other info stored in mine (not to mention some personal info jotted in the notes section). Until today, I believed that information was secure. I had no idea an app could upload all of that information to their server WITHOUT MY KNOWLEDGE, much less consent. Because of Google's approval process (or lack thereof), Android users have always been paranoid of the apps they install and what permissions they give them. As an iOS user, I never thought I had to worry about that because of Apple's approval process. Does it make a little more sense why some of us are furious about this now?
- kisielk 15y ago
  Exactly. I was always under the (apparently totally mistaken) assumption that Apple's approval process was there to catch exactly this kind of behaviour. It's supposed one of the reasons why an Android-style permissions system is not necessary on iOS devices. Recently it seems it's been coming to light that their curation process is not nearly as thorough as they would have us believe.
bigiain 15y ago
Two things. Are you sure all the people in your address book are as careless about that data? The friend with the restraining out against their ex? The minor celebrity with the unlisted phone number? Are you happy with the possibility that a connection between you and someone else might be implied without being true? What if a known drug dealer* had your phone number in their address book? (Perhaps via a room mate or child using the landline to have called them once? Or through reuse of an expired disposable cellphone number?) * or child pornographer, or political dissident, or terrorist, or…

pclark 15y ago

I find the whole thing really rather curious. I too am baffled as to why Apple has allowed this functionality from day one. I am also surprised that there has not been considerably more malicious usages of this data. Apple clearly does not enforce the the guidelines 17.1 strictly - but some developers are rejected for this. I can imagine it being possible (and I have no idea) that Apple turns a blind eye to developers that break this rule on the assumption they are doing it as a reputable company and doing it for "clear" value to the end user. (e.g.: not just acquiring all your contacts despite being a fart app.) > 17.1: Apps cannot transmit data about a user without obtaining the user's prior permission and providing the user with access to information about how and where the data will be used. Apple traditionally will happily leave functionality users or developers deem critical out of iOS until it is done right - push notifications, geo-location, background applications. It seems to make so much sense that "contacts" are part of something that Apple would want to do right - after all - it can create significant value for the user. (as discussed here: http://parislemon.com/post/11647475506/your-true-social-network http://parislemon.com/post/11647475506/your-true-social-netw...) But that doesn't explain why allow it in the first place in its current state? Its a really odd thing to simply offer developers on a whim (all their SDK blurb says is "Your application can create new Address Book contacts and get existing contact info.") Why can I import all of a users' contacts but it is not possible to populate an iMessage with a recipient and content? (I mean, Game Centre, the nearest thing to an Apple "social network" uses contacts to find your friends but in a truly terrible - albeit more ethical - manner. Which is both parts fascinating and infuriating as GameCentre is mostly crippled by being incapable of finding your friends.) At a guess: internally Apple iOS development is under resourced and they have a todo list a mile long. This simply has not been a severe enough problem that it has warranted being fixed yet. Whatever the reason, I hope it gets fixed.

Terretta 15y ago
They didn't allow it from day one. GPS apps, for example, couldn't navigate to contact addresses. VOIP couldn't use your numbers. It was relaxed later. I don't recall exactly when, but I'm thinking around 3.2 or so. Before whatever update, you had to have silos of contacts. After it, all apps could use your address book.
15y ago

creativityland 15y ago

There are many legitimate uses and I know I've downloaded many apps that uploaded my phone book for backup purposes, syncing purposes so on. Anything can be abused if used wrongly however, that's my philosophy.

feralchimp 15y ago

The biggest problem with all of this, and which I'm surprised no one else has mentioned, is that my Address Book isn't principally "personal data about me, which I wish to keep safe." It is "personal data about other, often more important people, who have entrusted me with the security of that data"! If you pull my CEO's private contact info off my phone, or pull a high-level contact from some company we've been privately looking to acquire, you best pray that theft doesn't result in a leak of privileged business information.

k-mcgrady 15y ago
Excellent point that most people have missed (I've actually brought it up in a few threads now). They are taking data that others have entrusted you with which is the worst part of this. If there servers were compromised not only would my data be stolen but the data of all my friends, family, and colleagues.
apgwoz 15y ago
> or pull a high-level contact from some company we've been privately looking to acquire, you best pray that theft doesn't result in a leak of privileged business information. Right, because the presence of some contacts at company B immediately implies "oh, we're going to acquire them." What people really aren't mentioning is that people give out the information likely stored in your address book to pretty much any service that even looks to be interesting based on a screencast, or even a splash page. Do you read the terms of service and privacy policies of all random websites you sign up for? Do the people whose contact information you are protecting do so?
- erikpukinskis 15y ago
  people give out the information likely stored in your address book to pretty much any service that even looks to be interesting You're missing a "some" in that sentence, and the difference between "all people" and "some people" sort of renders your point moot.
- deleted 15y ago
  [deleted]

zbowling 15y ago

Apple avoids the Vista like "ask for permission" on access design like android by requiring you to justify your needs to the app reviewer as an app developer. Not having an untrusted source of apps that can install on the device that is allowed on the iPhone means Apple can, in theory, improve user experience by not having as many of these dialogs bugging the user. Apps, should just work.® Constant permission prompts just train users in to muscle memory to accept these dialogs without thinking. Instead Apple sees it better make developers justify their needs to the APIs when they submit. Then Apple tests the app and looks for anything fishy. In the end, they reserve the right to pull them when they violate their terms. The article is wrong in that the camera roll is secure. It's technically not. Through the asset library API you can get at it. See docs here: https://developer.apple.com/library/ios/#documentation/AssetsLibrary/Reference/ALAssetsLibrary_Class/Reference/Reference.html https://developer.apple.com/library/ios/#documentation/Asset... One of the issues Android had up until recently was that you couldn't update all apps in one shot. The reason is that app update may have required permission changes from a pervious version. You would have to acknowledge each of these before installing the update. This was a crappy user experience and it's still the current experience when you install 3rd party APKs and update them. The problems with these "list of permissions wanted" screens is they don't let the developers justify to the user why they need access to these different features inline with the request. The users see it at install or update often. There are often very simple reasons why I need access to data on the device on Android in my app. I had people not install my app because I asked to send SMSs (which tells the user I can charge them money that way) in my music app, but it's only because I had a share button that is user invoked and clearly is sending a text message to user. Sure, be clear with your intent with your users, but these permission models don't always scale for the everyday users.

tedivm 15y ago
Apple already has a prompt before allowing applications access to your location- the address book seems just as important.
furyofantares 15y ago
Your complaints can be addressed by waiting to ask for permission the first time the app needs it, as opposed to a list of permissions to give at install time, and making the 'yes' answer sticky as opposed to prompting constantly.

gojomo 15y ago

Apple doesn't just allow this; it seems they do it (for Twitter's benefit) themselves, in the official iOS5 Twitter integration settings panel: http://cache.gizmodo.com/assets/images/4/2011/06/ios5twitter2.jpg http://cache.gizmodo.com/assets/images/4/2011/06/ios5twitter... (It's possible they're scraping Twitter handles/photos in some way that doesn't link the 'email addresses and phone numbers' to the requester's Twitter handle... but almost any straightforward way of implementing this has the de facto effect of informing Twitter of all your contacts' emails and phone numbers.) Everyone's at it.

jacques_chester 15y ago

It seems to me that all of these applications would be in trouble under Australia's fairly strict privacy laws. In particular, you are allowed only to collect details reasonably useful to your business and you must give a great deal of notice that this is happening[1]. Persons wishing to bring this issue to Apple's attention might wish to engage an Australian lawyer or bring the matter to the attention of the Attorney-General's department. I don't have an iPhone, so I'd have no standing. Fellow Australians, call your lawyers and start raising a stink. (IANAL, TINLA). [1] http://www.privacy.gov.au/materials/types/infosheets/view/6583 http://www.privacy.gov.au/materials/types/infosheets/view/65...

droithomme 15y ago

We develop software for Windows and Macs. On the Mac the address book files are certainly available to read, and also available through an API. We don't read these files, we don't upload them, and we don't analyze them. We don't touch them at all. We also don't touch anything else on our customer's system that they wouldn't normally be expecting, and we don't send any information back to our server without the user explicitly saying it's OK when it happens. Here's one reason why we don't scan people's system for interesting private files and secretly upload it for our economic benefit: 1. It violates the user's trust, expectations and privacy. Here's a second reason: 2. It is a criminal act to do so. I don't buy these discussions about how it is Apple's fault. It's not. It's illegal to steal private data like this. The companies doing this should be raided and shut down by the FBI immediately. All of them. Whether or not they issued a tearful apology.

abcd_f 15y ago
These are all fine and valid points, but the fact remains that a free game app might be very tempted to complement its lousy revenue by stealing and reselling users' address books and anything else their app can get its hands on. I as an iPhone user want a protection against that.
- droithomme 15y ago
  And it's criminal to do so. Software that steals data is malware. Prosecute these companies severely, put their president and the engineers who were in on it in prison for data theft and conspiracy. It's not like there isn't overwhelming evidence proving the case in these situations.
  - mistermann 15y ago
    All of which costs millions of dollars. Alternatively, Apple could spend a few thousand dollars and properly secure their MULTI billion dollar platform so the problem couldn't occur in the first place.
    - 15y ago

idspispopd 15y ago

I'm curious why Apple allows this also, but making this an excuse to render a blame and bash Apple article is misguided. I say misguided because there are many ways that your personal information, behaviours, interests and usage history can be fettered away from you all outside of Apple's control, this is a privacy and transparency issue. Not only should there be some level of respect for the information you possess (especially information you possess on others), but many countries already have legislation that address these privacy concerns specifically. This means that there are real legal consequences to this address book saga, but contrary to the article's spin this is again not directed at Apple. In short: Apple can do more to protect users, but shovelling them with the full blame over apps that are deliberately designed to gather and produce results from your contact information to provide is misguided.

eternalban 15y ago
The people who built your house also "allow" thieves to break in your house rather trivially. Would you hold them responsible in the event of a robbery?
- orangecat 15y ago
  If the builders were using security as a major selling point when marketing the houses, it wouldn't be unreasonable.
- yabai 15y ago
  I don't think this is exactly the case. More like...the people who built your house and are guarding it allowed thieves to break in. I believe I might hold them responsible.

four 15y ago

Unacceptable. What craven view of ethics puts any concept of "user experience" above treating others truthfully and respecting their privacy, property and personal domain? This is not a "mistake". Why would anyone want to have anything to do with such people, much less be their customer? This warrants punishment, not forgiveness.

enobrev 15y ago

It's a lazy mistake. The tools are provided by way of a command or two on just about any platform available to any programmer. Hashing information and matching against said hash are problems that have been solved and simplified in as many languages as asking for the bathroom. It's easier to send the raw data. It's foolish to send the raw data. It's a lazy mistake. We all know it happens. We all know WHY it happens. Stop fucking with our data. Pay attention because sometimes you should not be quite so lazy. Path gets off easy because they're Path. I'm ok with that. But I would fire your ass if you did this under my watch because I know for a fact that this is a stupidly easy problem to resolve. Don't be so damned lazy when it matters.

twsted 15y ago

I think that it is important that at least 2 levels of access can be asked by an app per resource (location, contacts, etc): 1. Permission to access a resource just locally for the benefit of the user; 2. Permission to transmit the data about a resource for social purposes.

becasse 15y ago

tl;dr - What d'you mean stealing address books is wrong?! Everyone else is doing it!