5 ms·

This has been happening to a bunch of XMPP apps recently, and as a maintainer of another one (which closely based on Conversations) I'm fearing the worst next t

This has been happening to a bunch of XMPP apps recently, and as a maintainer of another one (which closely based on Conversations) I'm fearing the worst next time I submit an update. The worst part is the lack of communication from Google about what they think the problem is. There are plenty of apps that do actually upload contact lists to servers (hi WhatsApp, etc.), and they are still listed on the store. Many XMPP apps do request the contacts permission, but this is to (on the client side only) allow storing XMPP addresses in your phone's address book and reusing your existing contact pictures, etc. This is explained within the app, and granting the permission is entirely optional.

sitkack 3y ago
Maybe Eric Schmidt is returning to Google.
rob74 3y ago
Then I'd argue that the actual problem is only having a permission to access the contacts, and not limiting what the app can do with them. Of course, limiting what an app can do with data that it already has access to is an interesting technical problem (and AFAIK not one Android is currently set up to handle)...
carstenhag 3y ago
Especially tiktok is still live, and there it's super obvious they upload the contact list. First: they ask you. More importantly though: you don't even need to search for someone or someone's phone. You open the app and get 3 people suggested you never even knew had a tiktok account. Really really creepy when you just exchanged numbers with someone and you can see all their 50 tiktoks. Happened to me with a girl I matched online - funny for me to see her videos, for her it was super creepy.
- madeofpalk 3y ago
  This happens the other way around as well (and is why, imho, both Android and iOS should flat out remove the capability from their platforms) - if TikTok knows your phone number for whatever reason, and the OTHER person uploads their contacts with you in it, that's enough to create the connection and start prompting you to friend them.
  - lloeki 3y ago
    Right, I can deny contact uploading all day long, as long as a bunch of people that have my number upload theirs to foostter it quickly paints a social graph where I'm† precisely pinpointed even though I did not interact with foostter. † Or a hash but that's barely pseudonymous. The social graph alone could constitute PII as it could easily identify me unequivocally, but here's no way for me nor anyone outside foostter to know what happens internally, let alone request erasure.
- troupo 3y ago
  > You open the app and get 3 people suggested you never even knew had a tiktok account. You send links to friends, and they immediately pop up as contact suggestions, too. TikTok is really keen on tracking those relationships down
  - droopyEyelids 3y ago
    The difference here is tiktok surfaces their tracking to the user in a friend-suggestion feature. Facebook (and others im sure) absolutely do the same thing. It's just that on facebook there is no attribution to how they generated the suggestion when the person appears on the 'people you might know' feed
- EasyMark 3y ago
  Could they simply be buying advertising databases which have possible connections for your name and ASL/phone number? Like the CIA and FBI seem to be doing. Plus likely your friends just give it whatever information it ask for so they already have your info anyway?
  - qingcharles 3y ago
    TikTok is buying data from almost everywhere. I browse to almost any site (on my desktop) and within minutes I am seeing ads on TikTok (on my phone) for the same/similar products.
jeroenhd 3y ago
> what they think the problem is See, that's probably where you're going wrong: I doubt a human looked at any of these apps and thought "this is suspicious". Instead, I think Google is using some kind of AI for determining this stuff. The only human component I expect to be present would be people working to prevent large apps that do upload your contacts to the cloud (WhatsApp and friends) from getting flagged automatically.

sitkack 3y ago

Maybe Eric Schmidt is returning to Google.

rob74 3y ago

Then I'd argue that the actual problem is only having a permission to access the contacts, and not limiting what the app can do with them. Of course, limiting what an app can do with data that it already has access to is an interesting technical problem (and AFAIK not one Android is currently set up to handle)...

carstenhag 3y ago

Especially tiktok is still live, and there it's super obvious they upload the contact list. First: they ask you. More importantly though: you don't even need to search for someone or someone's phone. You open the app and get 3 people suggested you never even knew had a tiktok account. Really really creepy when you just exchanged numbers with someone and you can see all their 50 tiktoks. Happened to me with a girl I matched online - funny for me to see her videos, for her it was super creepy.

madeofpalk 3y ago
This happens the other way around as well (and is why, imho, both Android and iOS should flat out remove the capability from their platforms) - if TikTok knows your phone number for whatever reason, and the OTHER person uploads their contacts with you in it, that's enough to create the connection and start prompting you to friend them.
- lloeki 3y ago
  Right, I can deny contact uploading all day long, as long as a bunch of people that have my number upload theirs to foostter it quickly paints a social graph where I'm† precisely pinpointed even though I did not interact with foostter. † Or a hash but that's barely pseudonymous. The social graph alone could constitute PII as it could easily identify me unequivocally, but here's no way for me nor anyone outside foostter to know what happens internally, let alone request erasure.
troupo 3y ago
> You open the app and get 3 people suggested you never even knew had a tiktok account. You send links to friends, and they immediately pop up as contact suggestions, too. TikTok is really keen on tracking those relationships down
- droopyEyelids 3y ago
  The difference here is tiktok surfaces their tracking to the user in a friend-suggestion feature. Facebook (and others im sure) absolutely do the same thing. It's just that on facebook there is no attribution to how they generated the suggestion when the person appears on the 'people you might know' feed
EasyMark 3y ago
Could they simply be buying advertising databases which have possible connections for your name and ASL/phone number? Like the CIA and FBI seem to be doing. Plus likely your friends just give it whatever information it ask for so they already have your info anyway?
- qingcharles 3y ago
  TikTok is buying data from almost everywhere. I browse to almost any site (on my desktop) and within minutes I am seeing ads on TikTok (on my phone) for the same/similar products.

jeroenhd 3y ago

> what they think the problem is See, that's probably where you're going wrong: I doubt a human looked at any of these apps and thought "this is suspicious". Instead, I think Google is using some kind of AI for determining this stuff. The only human component I expect to be present would be people working to prevent large apps that do upload your contacts to the cloud (WhatsApp and friends) from getting flagged automatically.