5 ms·

iOS 18 cracks down on apps asking for full address book access

97 points by mfiguiere 2y ago

ratg13 2y ago
More than just “growth hacking” apps.. if someone gets access to your contacts they can generally identify who you are just from this information alone. Data brokers have been harvesting this information for years. This is a huge step forward for data privacy.
- cantSpellSober 2y ago
  Even just cynically, it doesn't even work: > in many cases, that hack does not drive sustainable growth in the long term
  - noprocrasted 2y ago
    It's rarely about growth per se. Inferring someone's social graph and reidentifying them based on that would allow you to link them to their other accounts/shadow profiles and better target ads for them and their friends. Simple example, let's say the social platform knows you're into football. It has no information on whether your friends are into it, but if they see that you are mutual contacts they can try show football-related ads to your friends too and potentially get a boost in ad performance.
- WhackyIdeas 2y ago
  Kind of. But they could have done this many moons ago. They didn’t. In no way am I going to be duped that Apple suddenly give a damn about anything other than protecting their investment.
bigyikes 2y ago
I love these crackdowns and increasingly granular permissions. They did a similar thing for photos a while back. I wish they’d crack down on advertisements in notifications. Sleazy players like Uber will spam you with ads, so you’re forced to choose between receiving ads or missing out on actually important notifications. There’s nothing better than getting buzzed for an advertisement which you can conveniently view on your lock screen!
- joshuaturner 2y ago
  I think they used to have a rule about this but then their own apps started to violate it, so they loosened restrictions. What I'd really love to see is notification categories so you can choose which to accept.
  - xnx 2y ago
    Android has notification categories, but I think those end up getting abused too.
    - joshuaturner 2y ago
      I'm sure enforcement around it would be difficult but I'd imagine most major apps would fall in line if only because the risk of losing their notification entitlement would be too great.
      - ffsm8 2y ago
        What do you mean with enforcement? Literally delisting the app if it doesn't correctly classify their notifications? Because as they said: android has multiple channels, but the app owners quickly realized that if they classified their notifications, the unwanted channels such as "news"/advertising get disabled. So they bundle it into the same channel you don't really want to disable again. For example a taxi service that gives you discounts etc on the same channel as the notification that the driver is almost there. I really don't see a solution to this problem, because the consumer almost always wants some notifications, so disabling all from apples side wouldn't really work either (as customers would be negatively impacted). It'd be great if Apple found a solution, but I can't think of one that has any chance of succeeding. Maybe their new Apple Intelligence feature... We don't know enough about it's capabilities yet, but it could potentially act as a filter, with the potential for false negatives/positives. But that should hopefully be okay for something like notifications
  - buffet_overflow 2y ago
    I moved my primary phone from Android to iOS and this is hands down the thing I miss the most. I ended up silencing a lot of apps wholesale, mostly rideshares, as a result.
joecool1029 2y ago
It would seem to me that eventually Apple will have some kind of 'identity proxy' that apps will need to talk to in order to have an app send to a real contact. It can be overridden explicitly when needed by the end user but the default would be a sort of unique UID that changes over time. Think private relay/URL's but for identity.
- cassianoleal 2y ago
  > Think private relay/URL's but for identity. More like Hide my Email [0]. [0] https://support.apple.com/en-us/105078 https://support.apple.com/en-us/105078
reify 2y ago
I have always disliked any app that wants access to my contacts. While the rest of my friends do not repsect my privacy I do respect theirs. I use a seperate database that isolates my contacts so that no apps can have access. On android I use OpenContacts which does the same thing. OpenContacts: A different database for contacts to keep them private only to you. We should not be sharing our contact information online.
- instagib 2y ago
  It only takes one or one business to expose them. Combine that with the LinkedIn breach or another which also requests your contacts. One of my recent phone lookups for a dying friend had me, other family, and their friends numbers included along with previous phone numbers. I found my exotic 999 number I had for a short time. None of my friends change their phone numbers and I am working to keep a 25 year old number by doing a two step switch because I have no idea how many places that have the number as a backup for codes and some family can’t seem to switch to using our mobile numbers.
chongli 2y ago
This is great but it feels like closing the barn door after the horses have already left. All the big social networks already know your address book! Would have loved this from the very beginning of the App Store.
- viraptor 2y ago
  It will take ~5 years for the social media landscape to rotate again. The next "generation" will be protected at least.
- adiabatty 2y ago
  I never said 'yes' to any of those prompts. If you did, why?
  - chongli 2y ago
    I think I got swindled into it by not paying attention when trying to look up a friend!
  - noprocrasted 2y ago
    They use underhanded tactics such as showing a pixel-perfect recreation of the address book permission dialog with only the "accept" button functional, and upon clicking that the real one pops up - most people would think it was just a glitch and click again on the real one (even though technically the "decline" button is now functional too).
dmitrygr 2y ago
Again, this is only possible because big ad (eg Facebook) MUST follow AppStore rules to have access to customers. This is why I love the Apple walled garden.
- deleted 2y ago
  [deleted]
- zarzavat 2y ago
  In this case not because contacts are an OS API and always have been since before the iPhone. They could do the same on Mac OS if they wanted.
- e_y_ 2y ago
  This has nothing to do with the App Store. The API access is being gated by the user granting permission, rather than some reviewer looking at the app and deciding it violates a policy. Letting users lock and unlock doors is completely different from a walled garden.
coin 2y ago
I would love to be able to block network access for certain apps.
- WhyNotHugo 2y ago
  Mainstream Android used to have this, but the feature was dropped because it could be used to block ads. Some Android distributions like eOS have re-enabled the switch.
- TheTxT 2y ago
  You can at least block certain apps from using mobile data
  - noprocrasted 2y ago
    Ironically, iPhones for the China market actually allow you to restrict not just cellular data but also Wi-Fi.
jimbobthrowawy 2y ago
I am surprised this happened later than limited photo sharing did.

97 points by mfiguiere 2y ago

More than just “growth hacking” apps.. if someone gets access to your contacts they can generally identify who you are just from this information alone. Data brokers have been harvesting this information for years. This is a huge step forward for data privacy.

cantSpellSober 2y ago
Even just cynically, it doesn't even work: > in many cases, that hack does not drive sustainable growth in the long term
- noprocrasted 2y ago
  It's rarely about growth per se. Inferring someone's social graph and reidentifying them based on that would allow you to link them to their other accounts/shadow profiles and better target ads for them and their friends. Simple example, let's say the social platform knows you're into football. It has no information on whether your friends are into it, but if they see that you are mutual contacts they can try show football-related ads to your friends too and potentially get a boost in ad performance.
WhackyIdeas 2y ago
Kind of. But they could have done this many moons ago. They didn’t. In no way am I going to be duped that Apple suddenly give a damn about anything other than protecting their investment.

bigyikes 2y ago

I love these crackdowns and increasingly granular permissions. They did a similar thing for photos a while back. I wish they’d crack down on advertisements in notifications. Sleazy players like Uber will spam you with ads, so you’re forced to choose between receiving ads or missing out on actually important notifications. There’s nothing better than getting buzzed for an advertisement which you can conveniently view on your lock screen!

joshuaturner 2y ago
I think they used to have a rule about this but then their own apps started to violate it, so they loosened restrictions. What I'd really love to see is notification categories so you can choose which to accept.
- xnx 2y ago
  Android has notification categories, but I think those end up getting abused too.
  - joshuaturner 2y ago
    I'm sure enforcement around it would be difficult but I'd imagine most major apps would fall in line if only because the risk of losing their notification entitlement would be too great.
    - ffsm8 2y ago
      What do you mean with enforcement? Literally delisting the app if it doesn't correctly classify their notifications? Because as they said: android has multiple channels, but the app owners quickly realized that if they classified their notifications, the unwanted channels such as "news"/advertising get disabled. So they bundle it into the same channel you don't really want to disable again. For example a taxi service that gives you discounts etc on the same channel as the notification that the driver is almost there. I really don't see a solution to this problem, because the consumer almost always wants some notifications, so disabling all from apples side wouldn't really work either (as customers would be negatively impacted). It'd be great if Apple found a solution, but I can't think of one that has any chance of succeeding. Maybe their new Apple Intelligence feature... We don't know enough about it's capabilities yet, but it could potentially act as a filter, with the potential for false negatives/positives. But that should hopefully be okay for something like notifications
- buffet_overflow 2y ago
  I moved my primary phone from Android to iOS and this is hands down the thing I miss the most. I ended up silencing a lot of apps wholesale, mostly rideshares, as a result.

joecool1029 2y ago

It would seem to me that eventually Apple will have some kind of 'identity proxy' that apps will need to talk to in order to have an app send to a real contact. It can be overridden explicitly when needed by the end user but the default would be a sort of unique UID that changes over time. Think private relay/URL's but for identity.

cassianoleal 2y ago
> Think private relay/URL's but for identity. More like Hide my Email [0]. [0] https://support.apple.com/en-us/105078 https://support.apple.com/en-us/105078

reify 2y ago

I have always disliked any app that wants access to my contacts. While the rest of my friends do not repsect my privacy I do respect theirs. I use a seperate database that isolates my contacts so that no apps can have access. On android I use OpenContacts which does the same thing. OpenContacts: A different database for contacts to keep them private only to you. We should not be sharing our contact information online.

instagib 2y ago
It only takes one or one business to expose them. Combine that with the LinkedIn breach or another which also requests your contacts. One of my recent phone lookups for a dying friend had me, other family, and their friends numbers included along with previous phone numbers. I found my exotic 999 number I had for a short time. None of my friends change their phone numbers and I am working to keep a 25 year old number by doing a two step switch because I have no idea how many places that have the number as a backup for codes and some family can’t seem to switch to using our mobile numbers.

chongli 2y ago

This is great but it feels like closing the barn door after the horses have already left. All the big social networks already know your address book! Would have loved this from the very beginning of the App Store.

viraptor 2y ago
It will take ~5 years for the social media landscape to rotate again. The next "generation" will be protected at least.
adiabatty 2y ago
I never said 'yes' to any of those prompts. If you did, why?
- chongli 2y ago
  I think I got swindled into it by not paying attention when trying to look up a friend!
- noprocrasted 2y ago
  They use underhanded tactics such as showing a pixel-perfect recreation of the address book permission dialog with only the "accept" button functional, and upon clicking that the real one pops up - most people would think it was just a glitch and click again on the real one (even though technically the "decline" button is now functional too).

dmitrygr 2y ago

Again, this is only possible because big ad (eg Facebook) MUST follow AppStore rules to have access to customers. This is why I love the Apple walled garden.

deleted 2y ago
[deleted]
zarzavat 2y ago
In this case not because contacts are an OS API and always have been since before the iPhone. They could do the same on Mac OS if they wanted.
e_y_ 2y ago
This has nothing to do with the App Store. The API access is being gated by the user granting permission, rather than some reviewer looking at the app and deciding it violates a policy. Letting users lock and unlock doors is completely different from a walled garden.

coin 2y ago

I would love to be able to block network access for certain apps.

WhyNotHugo 2y ago
Mainstream Android used to have this, but the feature was dropped because it could be used to block ads. Some Android distributions like eOS have re-enabled the switch.
TheTxT 2y ago
You can at least block certain apps from using mobile data
- noprocrasted 2y ago
  Ironically, iPhones for the China market actually allow you to restrict not just cellular data but also Wi-Fi.

jimbobthrowawy 2y ago

I am surprised this happened later than limited photo sharing did.