4 ms·

>One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. >As soon as your cousin clicks

by gruez 2y ago

>One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. >As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd. Fortunately this is changing with iOS 18 with "limited contacts" sharing. https://mobiledevmemo.com/wp-content/uploads/2024/09/image.png https://mobiledevmemo.com/wp-content/uploads/2024/09/image.p... The interface also seems specifically designed to push people to allow only a subset of contacts, rather than blindly clicking "allow all". The far bigger issue is the contact info you share with online retailers. Scraping contact info through apps is very visible, drawing flak from the media and consumers. Most of the time all you get is a name (could be a nickname), and maybe some combination of phone/email/address, depending on how diligent the person in filling out all the fields. On the other hand placing any sort of order online requires you to provide your full name, address, phone number, and email address. You can also be reasonably certain that they're all accurate, because they're plausibly required for delivery/billing purposes. Such data can also be surreptitiously fed to data brokers behind the scenes, without an obvious "tiktok would like access to your contacts" modal.

create-username 2y ago
People will share their whole list because it’s simpler
- deleted 2y ago
  [deleted]
- taneq 2y ago
  Or because they were tricked. eg. LinkedIn’s “Connect with your contacts” onboarding step which sounds like it’ll check your contacts against existing LinkedIn users but actually spam invites anyone on your contact list that doesn’t have an account.
  - wkat4242 2y ago
    Linkedin is so terribly evil these days. I also see the shenanigans of adding new 'privacy' settings and setting them open by default. Another typical Microsoft ploy by the way.
    - noja 2y ago
      They were evil before. Previously they’d take your LinkedIn password and try using that to log in to your email account to grab your contacts.
      - 55555 2y ago
        This sounds absolutely insane.
      - dkga 2y ago
        This is a big thing, is there any evidence? Not implausible unfortunately…
        saagarjha 2y ago
        https://en.wikipedia.org/wiki/LinkedIn#Use_of_e-mail_accounts_of_members_for_spam_sending https://en.wikipedia.org/wiki/LinkedIn#Use_of_e-mail_account...
      - Cthulhu_ 2y ago
        Wasn't this also how some services would connect e.g. your bank accounts? They'd ask for your credentials and log into your bank to scrape its contents. And I kinda get it, some services external to your bank can help you manage your finances etc. But it's why banks should offer APIs where the user can set limited and timed access to these services. In Europe this is PSD2 (Revised Payment Services Directive).
        amanda99 2y ago
        I think the key point is that they would take your Linkedin password and try to use that on your email without asking you, in case you reused passwords.
x0x0 2y ago
I think it's not properly appreciated that Apple fully endorses all of this. For two reasons: (1) the provision of the output of billions of dollars of developer time to their users for no up front cost (made back via ads) is super valuable to their platform; and (2) they uniquely could stop this (at the price of devastating their app store), but choose not to. In light of that, perhaps reevaluate their ATT efforts as far less about meaningful privacy and far more about stealing $10B a year or so from Facebook.
- gruez 2y ago
  >I think it's not properly appreciated that Apple fully endorses all of this. [...] they uniquely could stop this (at the price of devastating their app store), but choose not to. A perfectly privacy respecting app store isn't going to do any good if it doesn't have any apps. Just look at f-droid. Most (all?) of the apps there might be privacy respecting, but good luck getting any of the popular apps (eg. facebook, tiktok, google maps) on there. >In light of that, perhaps reevaluate their ATT efforts as far less about meaningful privacy and far more about stealing $10B a year or so from Facebook. What would make you think Apple's pro-privacy changes aren't "about stealing $10B a year or so from Facebook"? At least some people are willing to pay for more privacy, and pro-changes hurts advertisers, so basically any pro-privacy change can be construed as "less about meaningful privacy and far more about stealing".
  - Aeolun 2y ago
    > good luck getting any of the popular apps (eg. facebook, tiktok, google maps) on there That makes sense, considering they’re not privacy respecting.
  - wkat4242 2y ago
    F-Droid will never have popular apps because it requires them to be open source. In fact F-Droid does the build for you, generating reproducible builds and avoiding the risk of adding trackers to the binary that aren't actually in the source code. With F-Droid the code you see is what you get.
  - inetknght 2y ago
sneak 2y ago
How about a no/limited internet setting? So many apps spy on you and they don’t need network at all to function.
- coin 2y ago
  I would love an iOS setting that blocks all network access for certain apps
- dylan604 2y ago
  Until the app's devs get wise to this, and do not allow the app to function without the network access. It could be as simple as a full screen, non-closable screen that says the app requires network access with a button to the proper setting to correct the issue.
  - wkat4242 2y ago
    Yeah like the ChatGPT app that doesn't work without a Google account. I have Google play on my phone, just no account logged in. I do have Google play services like firebase push which many apps legitimately need. But ChatGPT just opens the login screen in the play store and exits itself. I'm always wondering why these idiots force the creation of an account with their direct competitor. It's the only app I have that does this. But anyway I don't use their app for that reason, only use them a bit through API.
    - stavros 2y ago
      It doesn't do that for me. There's a Google button, and then big sign up/log in buttons, and a non-Google email works fine.
  - ryandrake 2y ago
    Such "go away" screens are in violation of Apple's AppStore rules. You cannot make a permission a condition of using the app, and stop the user from using it if they don't grant that permission. The app should gracefully do as much as it possibly can without the permission.
ActorNightly 2y ago
>Fortunately this is changing with iOS 18 with "limited contacts" sharing. Its not. Apple still owns your stuff. There is no difference between Apple and other 3p retailers. Apple just wants more of your money.
- gruez 2y ago
  >Its not. Apple still owns your stuff. There is no difference between Apple and other 3p retailers. That could be taken to mean anywhere between "Apple controls the software on your iPhone, therefore they control your contacts" and "Apple gives out your data like the data brokers mentioned in the OP". The former wouldn't be surprising at all, and most people would be happy with, and the latter would be scandalous if proven. What specifically are you arguing for?
  - ActorNightly 2y ago
    Why do you inherently trust Apple? Remember, the big celebrity photo leak happened because of a vulnerability within Apple Software.
    - deleted 2y ago
      [deleted]
    - gruez 2y ago
      The "vulnerability" part doesn't seem to be substantiated. From wikipedia: >The images were initially believed to have been obtained via a breach of Apple's cloud services suite iCloud,[1][2] or a security issue in the iCloud API which allowed them to make unlimited attempts at guessing victims' passwords.[3][4] Apple claimed in a press release that access was gained via spear phishing attacks.[5][6] Regardless of their security practices, it's a stretch to equate getting hacked with knowingly making available data. Moreover you can opt out of icloud backup, unlike with whatever is happening with apps mentioned in the OP.
    - zxvkhkxvdvbdxz 2y ago
      And why do you assume bad faith without any proof of foul play?
jcul 2y ago
On android you can choose whether to grant access to contacts. And most apps work fine without. GrapheneOS, which I use, also has contact scopes, so troublesome apps that refuse to work without access will think they have full access. You can allow them to see no contacts or a small subset. There's also multiple user profiles, a "private space", and a work profile (shelter) that you can install an app into, which can be completely isolated from your main profile, so no contacts. It surprises me how far behind iOS is with this stuff. Recently I wanted to install a second instance of an app on my wife's iPhone so she could use multiple logins simultaneously, there didn't really seem to be a way to do it.
- loxs 2y ago
  The point is that it doesn't matter whether YOU grant access to your contacts. As long as anyone who has you in THEIR contacts decides to just press "share contacts" with any app, you are doxxed and SkyNet is able to identify you for all practical purposes.
  - zxvkhkxvdvbdxz 2y ago
    Same with DNA testing really. A relative did a genealogy test through ancestry.com and suddenly I'm doxed for all eternity.
  - jcul 2y ago
    Ah yes, that is a problem.
- newscracker 2y ago
  You have two different points in your comment. Firstly, iOS has not been behind on having apps work if they don’t get access to a specific sensor or data. It’s on Android that apps refuse to work if they’re not given contacts access or location access and so on. Comparing the same apps on iOS and Android, I have found that Apple’s requirements for apps not to break when a permission is not granted is well respected and implemented on iOS apps. The same apps on Android apps just refuse to work until all the permissions they ask for are granted. YMMV. I do agree that iOS is behind by not providing profiles and multiple isolated installations of apps, and it would be great if it did.
pojzon 2y ago
Interesting thing is that security practices mention that you should always grant the minimal set of permissions. So in case Apple allowed for “share all” it means that they did it by design and are changing it now only because of backlash.
WA 2y ago
Useless without limiting the kind of data I want to share per contact. iOS asks for relationships for example. You can set up your spouse, your kids, have your address or any address associated with contacts. If I want to restrict app access to contacts, I also want to restrict app access to specific contact details.
croes 2y ago
Doesn’t help against your cousin who shares your data.

by gruez 2y ago

create-username 2y ago

People will share their whole list because it’s simpler

deleted 2y ago
[deleted]
taneq 2y ago
Or because they were tricked. eg. LinkedIn’s “Connect with your contacts” onboarding step which sounds like it’ll check your contacts against existing LinkedIn users but actually spam invites anyone on your contact list that doesn’t have an account.
- wkat4242 2y ago
  Linkedin is so terribly evil these days. I also see the shenanigans of adding new 'privacy' settings and setting them open by default. Another typical Microsoft ploy by the way.
  - noja 2y ago
    They were evil before. Previously they’d take your LinkedIn password and try using that to log in to your email account to grab your contacts.
    - 55555 2y ago
      This sounds absolutely insane.
    - dkga 2y ago
      This is a big thing, is there any evidence? Not implausible unfortunately…
      - saagarjha 2y ago
        https://en.wikipedia.org/wiki/LinkedIn#Use_of_e-mail_accounts_of_members_for_spam_sending https://en.wikipedia.org/wiki/LinkedIn#Use_of_e-mail_account...
    - Cthulhu_ 2y ago
      Wasn't this also how some services would connect e.g. your bank accounts? They'd ask for your credentials and log into your bank to scrape its contents. And I kinda get it, some services external to your bank can help you manage your finances etc. But it's why banks should offer APIs where the user can set limited and timed access to these services. In Europe this is PSD2 (Revised Payment Services Directive).
      - amanda99 2y ago
        I think the key point is that they would take your Linkedin password and try to use that on your email without asking you, in case you reused passwords.

x0x0 2y ago

I think it's not properly appreciated that Apple fully endorses all of this. For two reasons: (1) the provision of the output of billions of dollars of developer time to their users for no up front cost (made back via ads) is super valuable to their platform; and (2) they uniquely could stop this (at the price of devastating their app store), but choose not to. In light of that, perhaps reevaluate their ATT efforts as far less about meaningful privacy and far more about stealing $10B a year or so from Facebook.

gruez 2y ago
>I think it's not properly appreciated that Apple fully endorses all of this. [...] they uniquely could stop this (at the price of devastating their app store), but choose not to. A perfectly privacy respecting app store isn't going to do any good if it doesn't have any apps. Just look at f-droid. Most (all?) of the apps there might be privacy respecting, but good luck getting any of the popular apps (eg. facebook, tiktok, google maps) on there. >In light of that, perhaps reevaluate their ATT efforts as far less about meaningful privacy and far more about stealing $10B a year or so from Facebook. What would make you think Apple's pro-privacy changes aren't "about stealing $10B a year or so from Facebook"? At least some people are willing to pay for more privacy, and pro-changes hurts advertisers, so basically any pro-privacy change can be construed as "less about meaningful privacy and far more about stealing".
- Aeolun 2y ago
  > good luck getting any of the popular apps (eg. facebook, tiktok, google maps) on there That makes sense, considering they’re not privacy respecting.
- wkat4242 2y ago
  F-Droid will never have popular apps because it requires them to be open source. In fact F-Droid does the build for you, generating reproducible builds and avoiding the risk of adding trackers to the binary that aren't actually in the source code. With F-Droid the code you see is what you get.
- inetknght 2y ago

sneak 2y ago

How about a no/limited internet setting? So many apps spy on you and they don’t need network at all to function.

coin 2y ago
I would love an iOS setting that blocks all network access for certain apps
dylan604 2y ago
Until the app's devs get wise to this, and do not allow the app to function without the network access. It could be as simple as a full screen, non-closable screen that says the app requires network access with a button to the proper setting to correct the issue.
- wkat4242 2y ago
  Yeah like the ChatGPT app that doesn't work without a Google account. I have Google play on my phone, just no account logged in. I do have Google play services like firebase push which many apps legitimately need. But ChatGPT just opens the login screen in the play store and exits itself. I'm always wondering why these idiots force the creation of an account with their direct competitor. It's the only app I have that does this. But anyway I don't use their app for that reason, only use them a bit through API.
  - stavros 2y ago
    It doesn't do that for me. There's a Google button, and then big sign up/log in buttons, and a non-Google email works fine.
- ryandrake 2y ago
  Such "go away" screens are in violation of Apple's AppStore rules. You cannot make a permission a condition of using the app, and stop the user from using it if they don't grant that permission. The app should gracefully do as much as it possibly can without the permission.

ActorNightly 2y ago

>Fortunately this is changing with iOS 18 with "limited contacts" sharing. Its not. Apple still owns your stuff. There is no difference between Apple and other 3p retailers. Apple just wants more of your money.

gruez 2y ago
>Its not. Apple still owns your stuff. There is no difference between Apple and other 3p retailers. That could be taken to mean anywhere between "Apple controls the software on your iPhone, therefore they control your contacts" and "Apple gives out your data like the data brokers mentioned in the OP". The former wouldn't be surprising at all, and most people would be happy with, and the latter would be scandalous if proven. What specifically are you arguing for?
- ActorNightly 2y ago
  Why do you inherently trust Apple? Remember, the big celebrity photo leak happened because of a vulnerability within Apple Software.
  - deleted 2y ago
    [deleted]
  - gruez 2y ago
    The "vulnerability" part doesn't seem to be substantiated. From wikipedia: >The images were initially believed to have been obtained via a breach of Apple's cloud services suite iCloud,[1][2] or a security issue in the iCloud API which allowed them to make unlimited attempts at guessing victims' passwords.[3][4] Apple claimed in a press release that access was gained via spear phishing attacks.[5][6] Regardless of their security practices, it's a stretch to equate getting hacked with knowingly making available data. Moreover you can opt out of icloud backup, unlike with whatever is happening with apps mentioned in the OP.
  - zxvkhkxvdvbdxz 2y ago
    And why do you assume bad faith without any proof of foul play?

jcul 2y ago

On android you can choose whether to grant access to contacts. And most apps work fine without. GrapheneOS, which I use, also has contact scopes, so troublesome apps that refuse to work without access will think they have full access. You can allow them to see no contacts or a small subset. There's also multiple user profiles, a "private space", and a work profile (shelter) that you can install an app into, which can be completely isolated from your main profile, so no contacts. It surprises me how far behind iOS is with this stuff. Recently I wanted to install a second instance of an app on my wife's iPhone so she could use multiple logins simultaneously, there didn't really seem to be a way to do it.

loxs 2y ago
The point is that it doesn't matter whether YOU grant access to your contacts. As long as anyone who has you in THEIR contacts decides to just press "share contacts" with any app, you are doxxed and SkyNet is able to identify you for all practical purposes.
- zxvkhkxvdvbdxz 2y ago
  Same with DNA testing really. A relative did a genealogy test through ancestry.com and suddenly I'm doxed for all eternity.
- jcul 2y ago
  Ah yes, that is a problem.
newscracker 2y ago
You have two different points in your comment. Firstly, iOS has not been behind on having apps work if they don’t get access to a specific sensor or data. It’s on Android that apps refuse to work if they’re not given contacts access or location access and so on. Comparing the same apps on iOS and Android, I have found that Apple’s requirements for apps not to break when a permission is not granted is well respected and implemented on iOS apps. The same apps on Android apps just refuse to work until all the permissions they ask for are granted. YMMV. I do agree that iOS is behind by not providing profiles and multiple isolated installations of apps, and it would be great if it did.

pojzon 2y ago

Interesting thing is that security practices mention that you should always grant the minimal set of permissions. So in case Apple allowed for “share all” it means that they did it by design and are changing it now only because of backlash.

WA 2y ago

Useless without limiting the kind of data I want to share per contact. iOS asks for relationships for example. You can set up your spouse, your kids, have your address or any address associated with contacts. If I want to restrict app access to contacts, I also want to restrict app access to specific contact details.

croes 2y ago

Doesn’t help against your cousin who shares your data.