4 ms·

Contacts are just a toy example, aren't they? Else this is a privacy nightmare waiting to happen: It's easy to accidentially share numbers. Also it might turn

Contacts are just a toy example, aren't they? Else this is a privacy nightmare waiting to happen: It's easy to accidentially share numbers. Also it might turn out your new friend J. is superficially pleasant, but actually a horrible human being once you get to know them - congratulations, J. has access to all your shared contacts. If I was friends with Alice, I'd be very annoyed that J. is now harassing me. Or suppose you created a list of all doctor's phone numbers in your area. You can then look up if any of your contacts (friends, family, loose aquintance) share any of them (e.g. because they recommended a specialist to a friend). This needs a tremendous work to setup access rights, and it's easy for an individual to screw this up and put themselves in a bad spot. Sharing contacts on a need-to-know basis (using e.g. Threema or WhatsApp) is the established standard in my peer group; be it the number of a Pizza place or my SO's new number, so a common friend can invite her to a party. And while it's less cool and adds some effort, it requires an explicit action to share a contact. This is more safe. In my humble opinion, and I might have a bad hunch there: The overall mistake with that example is lies in how it associates identities with phone numbers. In reality, it's the other way around. We want to share identities (be it the Pizza Place, Mum, or a doctor), and should have control who can access the information (not just phone numbers) associated with them. But that's essentially re-inventing social networks with a narrow focus. From a academical perspective the technical issue can be interesting of course, and valuable insights might be gained from this research. There might be use cases beyond the basic contacts example; in fact, I think in a company phone directory this can be incredibly useful as part of the CRM.

nonameiguess 2y ago
A contact list actually seems to me like an abnormally bad example for other reasons, or I'm way more atypical than I think I am and everyone else curates their contacts far more carefully. For me, the proliferation of spam means I'm never going to answer an unrecognized phone number, and thus enter everyone I ever expect to receive a phone call from into the list. The vast majority of the time, these are things like contractors coming to my house, a hand surgeon I visit for one injury and hopefully only one injury, a shop I take my car to hopefully once and only once. Numbers I received a call from a few times, possibly more than a decade ago. The fact they're still in my contacts list says nothing whatsoever about my level of trust in them and doesn't mean other contacts, especially my actual friends, should assume anything about their presence except that I received at least one phone call from them at some point and I was expecting that call. That's aside from the fact that contact lists are not reciprocal. Adding a number to your list and giving it a name doesn't mean the owner of that number has added you to their list. There is no guarantee whoever is on the other end of that number has any idea who you even are. This is also aside from the fact that phone numbers can be reassigned. That's an argument that I and anyone else as cavalier about their lists as me should be removing numbers more often, but outside of a fairly short time horizon, there is no guarantee that the person who owns a number you have listed as "Bob" is still Bob. These issues aren't unique to digital contact lists, either. My wife pulled a book off the shelf a few months ago I hadn't opened in a very long time and found an old sheet of paper I'd written some phone number on, possibly 25 years ago? One was a very good friend from high school, a name I still knew and a number I still recognized as her parent's home number from the late 90s. The other, I have absolutely no idea. Probably some designated driver for a group of friends I was going to a party with who were going separate from me in case I needed someone to call if something came up. I may have never even called that number or received a call from it. Hell, how many contacts of people in their early 20s are someone you met in a club who gave you a fake phone number that happens to be some other person's real phone number? This bugs me to no end with all the apps out there for smart phones that want access to your contacts. Why? What significance do you think this list has? It's just a semi-random assortment of some sub-sample of all the people and organizations I have had some kind of fleeting and possibly one-time interaction with in the past quarter century. It doesn't imply I remember who they are, know them, or that I vouch for them in any way.
alphazard 2y ago
A contacts list is a superset of the publicly available connections that would make up a web of trust. Out of all my contacts, there are a few people that I would be willing to vouch for. As in: declare publicly that I know who they are, and reveal the name that I refer to them as. That pet name may be different from person to person, but that's fine. Alice might call a public key "Bobby's Public Key", and Charlie might call it "Robert's Public Key". I can make sense of those attestations when I'm trying to verify that I have Bob's key, and assign it my own pet name. If Alice or Charlie weren't willing to publicly attest to the Bob-ness of the same public key then I wouldn't be looking at their attestations.
elbasti 2y ago
To reinforce the real-world value of contact secrecy, let me share an example of how WhatsApp's contact broadcasting is creating massive opportunities for scammers where I live (Mexico). In WhatsApp, when you join a "community" (sort of like a giant, moderated group), all members of the community are visible to all other members. You can see their phone numbers and their self-chosen nickname. Note that very frequently people will have their names or a shortened version of their name as their nickname. In emerging markets, people use WhatsApp for everything and many people will naturally join a few communities. Things like: - A community for your kid's school - A community for your neighborhood's safety alerts. - A community for a club or hobby. So a scammer's workflow is as follows: 1. Infiltrate a community or a group. 2. Check all of the members and find those whose names are publicly shared or you can deduce. 3. Use their name, phone and--crucially--information about the community itself to craft a targeted phishing phone call. Example: Sandra is a part of a community for neighborhood safety news. The community is called "Hillsborough safety." Her whatsapp nickname is "Sandy Williams." A scammer will join the community and see her contact. They will then call her with a message like "Hi, is this Sandra Williams? Yes, I'm calling from the Hillsborough police department. Unfortunately there's been an accident with your husband...". You can imagine how the simple fact of knowing someoen's name and some sort of "proprietary knowledge" (they know I live at Hillside!) can be enought to for a victim to lower their defenses. An additional layer to this is that often the scammer will social-engineer their way into gaining access to the victim's Whatsapp account itself. They can then access all of the groups that victim was a member of, including "tight" friend groups, etc. IMHO contact broadcasting is an inexcusable design decision by WhatsApp.
- wodenokoto 2y ago
  Is this why I get added to seemingly nonsense communities all the time on WhatsApp?
eterm 2y ago
Yes, I think this was a really bad example, and something without humans would have been better, so for example naming of cloud server resources. With real world names there's also the messy issue of name changes and dead-naming. If Alice changes her (his) name to Bob, but Eve keeps Alice in as Alice, you'd have mutual contacts seeing still referring to Bob as Alice. There are also of course the privacy concerns you mentioned, despite any optionality of sharing contacts. Here's a problem that this does potentially solve: "Two different cloud orchestrators need to be able to create servers which may get referenced by servers they each create. Coordinating unique names would be difficult". Although that's an odd problem, and it's already solved in a similar way by other hierarchical naming structures with authorities such as domains, which is essentially what this pattern is describing in a roundabout way. "com" names everything under it. "example.com" names everything under that, etc. Multiple different paths can point to the same resource.
eximius 2y ago
This complaint and thinking of other simple but sliiiightly more advanced permission/privacy systems reminds me of G+ circles - kinda wish it'd have taken off. I thought it was a pretty neat system.
thomastjeffery 2y ago
> Else this is a privacy nightmare waiting to happen: It's easy to accidentially share numbers. That's a critical implementation detail, but I think it can be done. All we need to do is make contact-sharing an explicit feature. > But that's essentially re-inventing social networks with a narrow focus. Yes it is. That's the utility of decentralized networks: by removing the hierarchy from the network, we have removed the explicitly drawn context. Instead, the context is implicit and flexible. There are pros and cons to this feature. Instead of segmenting "twitterverse", "facebookverse", etc.; we simply have "the universe". The same boundaries can be replicated, but the lines are drawn by the users instead of by the platform, all while preserving compatibility across those lines. My answer to this change is to replace moderation with curation. I get into this distinction more in my comment here: https://news.ycombinator.com/item?id=42238201 https://news.ycombinator.com/item?id=42238201 As far as privacy in curated networks goes, I think we could find some interesting strategies to accomplish it. One could be anonymous pseudonyms: publish the attestations you don't want traced back to you as an explicitly not-you user. Another could be attestation laundering: provide a publicly available user (that anyone can use) that publishes a collection of attestations as if it was the original publisher, and let collaborators vote on that user's overall validity via attestation. Essentially, we must contend with the inverted hierarchy that decentralized networks are made of. It's definitely a change, but I think can provide a lot more utility than centralized networks provide today.

nonameiguess 2y ago

A contact list actually seems to me like an abnormally bad example for other reasons, or I'm way more atypical than I think I am and everyone else curates their contacts far more carefully. For me, the proliferation of spam means I'm never going to answer an unrecognized phone number, and thus enter everyone I ever expect to receive a phone call from into the list. The vast majority of the time, these are things like contractors coming to my house, a hand surgeon I visit for one injury and hopefully only one injury, a shop I take my car to hopefully once and only once. Numbers I received a call from a few times, possibly more than a decade ago. The fact they're still in my contacts list says nothing whatsoever about my level of trust in them and doesn't mean other contacts, especially my actual friends, should assume anything about their presence except that I received at least one phone call from them at some point and I was expecting that call. That's aside from the fact that contact lists are not reciprocal. Adding a number to your list and giving it a name doesn't mean the owner of that number has added you to their list. There is no guarantee whoever is on the other end of that number has any idea who you even are. This is also aside from the fact that phone numbers can be reassigned. That's an argument that I and anyone else as cavalier about their lists as me should be removing numbers more often, but outside of a fairly short time horizon, there is no guarantee that the person who owns a number you have listed as "Bob" is still Bob. These issues aren't unique to digital contact lists, either. My wife pulled a book off the shelf a few months ago I hadn't opened in a very long time and found an old sheet of paper I'd written some phone number on, possibly 25 years ago? One was a very good friend from high school, a name I still knew and a number I still recognized as her parent's home number from the late 90s. The other, I have absolutely no idea. Probably some designated driver for a group of friends I was going to a party with who were going separate from me in case I needed someone to call if something came up. I may have never even called that number or received a call from it. Hell, how many contacts of people in their early 20s are someone you met in a club who gave you a fake phone number that happens to be some other person's real phone number? This bugs me to no end with all the apps out there for smart phones that want access to your contacts. Why? What significance do you think this list has? It's just a semi-random assortment of some sub-sample of all the people and organizations I have had some kind of fleeting and possibly one-time interaction with in the past quarter century. It doesn't imply I remember who they are, know them, or that I vouch for them in any way.

alphazard 2y ago

A contacts list is a superset of the publicly available connections that would make up a web of trust. Out of all my contacts, there are a few people that I would be willing to vouch for. As in: declare publicly that I know who they are, and reveal the name that I refer to them as. That pet name may be different from person to person, but that's fine. Alice might call a public key "Bobby's Public Key", and Charlie might call it "Robert's Public Key". I can make sense of those attestations when I'm trying to verify that I have Bob's key, and assign it my own pet name. If Alice or Charlie weren't willing to publicly attest to the Bob-ness of the same public key then I wouldn't be looking at their attestations.

elbasti 2y ago

To reinforce the real-world value of contact secrecy, let me share an example of how WhatsApp's contact broadcasting is creating massive opportunities for scammers where I live (Mexico). In WhatsApp, when you join a "community" (sort of like a giant, moderated group), all members of the community are visible to all other members. You can see their phone numbers and their self-chosen nickname. Note that very frequently people will have their names or a shortened version of their name as their nickname. In emerging markets, people use WhatsApp for everything and many people will naturally join a few communities. Things like: - A community for your kid's school - A community for your neighborhood's safety alerts. - A community for a club or hobby. So a scammer's workflow is as follows: 1. Infiltrate a community or a group. 2. Check all of the members and find those whose names are publicly shared or you can deduce. 3. Use their name, phone and--crucially--information about the community itself to craft a targeted phishing phone call. Example: Sandra is a part of a community for neighborhood safety news. The community is called "Hillsborough safety." Her whatsapp nickname is "Sandy Williams." A scammer will join the community and see her contact. They will then call her with a message like "Hi, is this Sandra Williams? Yes, I'm calling from the Hillsborough police department. Unfortunately there's been an accident with your husband...". You can imagine how the simple fact of knowing someoen's name and some sort of "proprietary knowledge" (they know I live at Hillside!) can be enought to for a victim to lower their defenses. An additional layer to this is that often the scammer will social-engineer their way into gaining access to the victim's Whatsapp account itself. They can then access all of the groups that victim was a member of, including "tight" friend groups, etc. IMHO contact broadcasting is an inexcusable design decision by WhatsApp.

wodenokoto 2y ago
Is this why I get added to seemingly nonsense communities all the time on WhatsApp?

eterm 2y ago

Yes, I think this was a really bad example, and something without humans would have been better, so for example naming of cloud server resources. With real world names there's also the messy issue of name changes and dead-naming. If Alice changes her (his) name to Bob, but Eve keeps Alice in as Alice, you'd have mutual contacts seeing still referring to Bob as Alice. There are also of course the privacy concerns you mentioned, despite any optionality of sharing contacts. Here's a problem that this does potentially solve: "Two different cloud orchestrators need to be able to create servers which may get referenced by servers they each create. Coordinating unique names would be difficult". Although that's an odd problem, and it's already solved in a similar way by other hierarchical naming structures with authorities such as domains, which is essentially what this pattern is describing in a roundabout way. "com" names everything under it. "example.com" names everything under that, etc. Multiple different paths can point to the same resource.

eximius 2y ago

This complaint and thinking of other simple but sliiiightly more advanced permission/privacy systems reminds me of G+ circles - kinda wish it'd have taken off. I thought it was a pretty neat system.

thomastjeffery 2y ago

> Else this is a privacy nightmare waiting to happen: It's easy to accidentially share numbers. That's a critical implementation detail, but I think it can be done. All we need to do is make contact-sharing an explicit feature. > But that's essentially re-inventing social networks with a narrow focus. Yes it is. That's the utility of decentralized networks: by removing the hierarchy from the network, we have removed the explicitly drawn context. Instead, the context is implicit and flexible. There are pros and cons to this feature. Instead of segmenting "twitterverse", "facebookverse", etc.; we simply have "the universe". The same boundaries can be replicated, but the lines are drawn by the users instead of by the platform, all while preserving compatibility across those lines. My answer to this change is to replace moderation with curation. I get into this distinction more in my comment here: https://news.ycombinator.com/item?id=42238201 https://news.ycombinator.com/item?id=42238201 As far as privacy in curated networks goes, I think we could find some interesting strategies to accomplish it. One could be anonymous pseudonyms: publish the attestations you don't want traced back to you as an explicitly not-you user. Another could be attestation laundering: provide a publicly available user (that anyone can use) that publishes a collection of attestations as if it was the original publisher, and let collaborators vote on that user's overall validity via attestation. Essentially, we must contend with the inverted hierarchy that decentralized networks are made of. It's definitely a change, but I think can provide a lot more utility than centralized networks provide today.