28 ms·

Path texts my entire phonebook at 6 AM

• k-mcgrady 14y ago
  Probably best not to just jump to conclusions until there is a response from Path or more evidence from users. I've been using Path since it launched with nothing like this ever happening. This sounds to me like some sort of unrelated scam. I didn't notice him say int he article but do the texts include a URL? If so where does that go? This seems like something that would be noticed by more than one or two guys if it was something Path was doing.
  • jen_h 14y ago
    There's a screenshot in The Verge's article (http://www.theverge.com/2013/4/30/4286090/path-is-spamming-address-books-with-unwanted-texts-and-robocalls http://www.theverge.com/2013/4/30/4286090/path-is-spamming-a...), looks to go straight to an invite with the guy's name (https://path.com/i/BfOPb https://path.com/i/BfOPb).
• evan_ 14y ago
  The weirdest part of this is that it apparently made voice calls to landlines? Why would they do that, it makes no sense. Unless maybe that's what the phone company does if you text a landline? Never tried it but I would be surprised...
  • bochoh 14y ago
    Verizon in the US offered text-to-voice service in the past. I'm sure this is something similar.
  • forgingahead 14y ago
    If you send a text to a landline, a lot of providers will convert it to a phone call using some sort of text-to-speech API. I've done this by accident on older cell phones when I'd add someone's landline to a text message instead of their mobile number. This sounds like a nightmare scenario though for this poor chap and his family (and his dentist).
    • evan_ 14y ago
      Well that shows you how long it's been since I've had a landline- Thanks all. (Do they charge you 15¢ for the privilege? Can you reply?)
  • andrewaylett 14y ago
    It's a reasonably standard thing in the UK. Useful at times, really annoying at other times... You can get landline phones that will actually receive the texts as texts; other phones get calls.
    • citricsquid 14y ago
      I remember when I was a kid in... it must have been 2005 or earlier, when I was at a friends house and they had this, it was literally the coolest thing in the world. A phone that spoke text messages? My god, it's the future! Novelty wore off fast once I entered adulthood because it's never a text message I want to hear. Who knew I could claim my PPI back?! bah
  • nwh 14y ago
    Various API that let you send SMS will make a call if the SMS can't be delivered, and then use text-to-speech to read the thing out to you. It's fairly obnoxious really.
    • jen_h 14y ago
      And some, like Telia in Sweden, will keep calling until you listen to a certain percentage of the message to helpfully ensure that you've gotten the message. Which is loads of fun if, for example, someone sends you a link with a UUID--you basically have to pull the phone off the hook and let it finish before you stop receiving the calls. (You can also contact your phone company and ask them to please remove this "feature" - but usually you have to be subjected to it before you know the phone company even does this!)
  • quarterto 14y ago
    At least BT do this for texts to landlines in the UK. When it was first launched, they used Tom Baker's voice. It was an amazing few weeks.
    • Samuel_Michon 14y ago
      Ah yes, there it is: http://www.youtube.com/watch?v=aFsOhJgCSpw http://www.youtube.com/watch?v=aFsOhJgCSpw
• MWil 14y ago
  I feel like you won't hear back from them. Know any lawyers who would be willing to pen a snail mail letter for you?
• raverbashing 14y ago
  This is good information I'll make sure to never install Path There are some abuses that can't be solved by an apology.
  • w1ntermute 14y ago
    Yeah, this just convinced me to never use Path too.
    • lucb1e 14y ago
      Great, we have a few more convinced not to use Path. One application will now have perhaps a few hundred less users. What about the rest of the permission-hungry apps? Whatsapp? Facebook? Any Google app? Any other big developer's app? What if the founders of Path just start a new company? Not installing Path is not a solution here. You gotta look critically at the permissions an app uses and their terms of service (at least skip to the privacy related issues, though they usually try to hide and obfuscate them). If there is something you don't entirely trust, wonder why you really need that app. Perhaps it's an improvement for your life, but can't you really live without? You've gone without that app for the past how many years? Is it worth giving up your phone book and all sdcard contents?
      • raverbashing 14y ago
        You're correct, and it gives me the shivers to see an application like 'photo sharing' wanting several useless permissions Here's what I would like: for Android to allow me to deny or ask for a confirmation for each permission of these.
        • lucb1e 14y ago
          Or ask upon usage. "Do you want to grant XYZ to view your contact list? [Yes, and don't ask again] [Just this time] [Never]"
• haraball 14y ago
  Path seems like a company which is doing everything wrong these days. My peeve with them is that I signed up and used it happily for a long time because it should be possible to get my data exported later. Now they have removed that from the FAQ/Support and their support mails are just ignorant saying "not possible but the team will look into it".
• coldcode 14y ago
  The just got fined $800,000. I guess it should have been $800,000,000.
  • amartya916 14y ago
    Totally agree with the sentiment. I believe that companies have DNA, and that most companies do not change over time, they just get better at hiding the bad stuff. I would probably trust a company that starts off of the right foot (e.g. Google) even when it becomes larger, than trust one that's built off – what I consider to be – shady growth strategies. Path seems to be taking especially egregious steps. All the UI polish in the world can't hide shady business practices.
  • rscale 14y ago
    We'd see a lot less abusive behavior from startups if investors went to zero when it happened. As it stands, $800k is a line item equal to only 2% of the money Path has raised. As such, I doubt that anybody who invested in it cares or views this as anything other than a triviality that a few nerds will care about.
• sailfast 14y ago
  I have been a Path user since the app launched and have never had any text messages sent to my address book. Path informed users that the address book data hook was no longer there and that all data had been removed from their services after the initial FTC inquiry. I took that at face value but after this article I would be interested in hearing a response from the company about how my information is handled.
  • deleted 14y ago
    [deleted]
  • lucahammer 14y ago
    This is a feature while signing up if you use Facebook. It shows your friends with a phone number and if you don't uncheck them before tapping ‘next’, it will invite them.
• eksith 14y ago
  Remember when a while back they downloaded far too much information from each phone (for the convenience of connecting you to people)? Everyone was surprised (some outraged) and then they pushed an update to stop that "feature" and when the CEO/Boss man posted a blog entry apologizing, everyone forgave the company, people were holding hands singing Kumbaya. Edit: Here's when they flubbed a year ago. http://news.cnet.com/8301-19882_3-57373474-250/path-ceo-we-are-sorry-and-weve-deleted-your-address-book-data/ http://news.cnet.com/8301-19882_3-57373474-250/path-ceo-we-a... Edit2: Er... apparently, I suffered a seizure of some sort (and an aneurism and a stroke simultaneously). Reworded.
  • skytalon 14y ago
    I just noticed, in that apology letter, the line: "... Your trust matters to us and we want you to feel completely in control of your information on Path. ..." So they want you to feel in control.
    • eksith 14y ago
      Haha, yes! It's very important to feel you're in control, just like you want to feel like you're making a wise decision when you reach for the conveniently placed junk in the supermarket isles. I get the feeling that either those in charge are hopelessly detached from society to see how privacy is perceived by the rest of us (like Zuckerberg) or there's little to no vetting when it comes to implementation decisions.
    • c0ur7n3y 14y ago
      "We are deeply sorry if you were uncomfortable with how our application used your phone contacts." That non-apology is corporate communications at its most typical.
      • Samuel_Michon 14y ago
        I’m a big sucker for a non-apology apology, reading one never fails to make my day. More here: http://terribleapologies.com/ http://terribleapologies.com/ and http://en.wikipedia.org/wiki/Non-apology_apology#Examples http://en.wikipedia.org/wiki/Non-apology_apology#Examples and http://jezebel.com/sorry-not-sorry-how-to-non-apologize-5993101 http://jezebel.com/sorry-not-sorry-how-to-non-apologize-5993...
• kyberias 14y ago
  This is *ucked up but hilarious at the same time.
• OGinparadise 14y ago
  Wow, they just paid $800K to FTC for being shady. They are betting that they become so big that these shenanigans don't matter later on.
  • smacktoward 14y ago
    They're doing it exactly backwards. The Right Way is to hold off on the massive user privacy violations until you become huge. At that point enforcing the laws against you becomes too difficult and expensive, so the government won't bother; and if some random AG tries to do it anyway you can afford to buy whatever changes to the laws you need to get him off your back. Problem solved.
    • minimaxir 14y ago
      But nowadays, due to all the competition for emerging startups, you can't become huge until you start invoking privacy violations. It's a Catch-22 of ethical misconduct!
  • notahacker 14y ago
    They're also being threatened with a class action lawsuit for doing what the OP described: http://www.mediapost.com/publications/article/197248/path-sued-for-sending-text-spam.html#axzz2RxxUCWRD http://www.mediapost.com/publications/article/197248/path-su... I'm not sure the shenanigans won't come back to haunt them. Less trendy apps have been booted from Apple's App Store for a lot less.
• gcv 14y ago
  Could this just have been a good old-fashioned programming bug, rather than spamming or malicious intent?
  • claudius 14y ago
    How could this possibly be a programming bug?
    • apike 14y ago
      Of course it was a bug. It seems clear to me they were experimenting with some texting functionality where Path would notify users of things, it made it to production with bugs, and some subset of users got this terrible behaviour. Never ascribe to malice that which is adequately explained by incompetence.
      • anonymoushn 14y ago
        It would need to be about three bugs. First, there's the bug where users who say that Path can't have their address books get their address books sent to Path. Second, there's the bug where their servers think the user has photos that he does not have. Third, there's the bug where their servers think the user wants to share these photos with Path's list of phone-number contacts for that user. This does not seem like the most likely scenario to me.
      • andreigheorghe 14y ago
        What are the reasons that make you so sure, though? To me, it's not clear at all just from the symptoms that it is a bug. It could just as well be a feature they're only testing out on 0.1% of the user base to see how their engagement or whatever improves.
        • apike 14y ago
          Maybe I'm naive, but it seems just so insanely bad that I assumed no product manager or engineer would intentionally cause this behavior.
• greghinch 14y ago
  Path seems to do all the shady things with your data that we fear Google and Facebook could do. FB and G definitely push the boundaries of privacy/creepy sometimes, but Path seems to have no qualms about blowing right past them. I am staying away.
  • OGinparadise 14y ago
    The impact is also smaller, FB has 1 billion or so accounts and Google probably has about the same. Plus, they can track every move you make across the web, things you like, searches you make, what type of content you email, share etc. If Path grows, I hope they just die (two strikes is enough for me!) more and more people will look under the hood.
  • NoPiece 14y ago
    It reminds of one of Facebook's early growth tactics - as part of the contact import process, they'd send out spam IMs to all your contacts saying you just joined Facebook and ask if they wanted to join. It was very shady.
• zalzane 14y ago
  Why is it even possible for this to happen? Did someone really think it was a bright idea to provide an API to access people's personal data, and if so, why doesn't the phone tell them that before letting them install the app? On top of all of that, why wouldn't the phone provide a setting to restrict all personal/identifying information from being accessed by the app?
  • akgerber 14y ago
    That sort of API is necessary for, say, an alternate text messaging app.
  • meritt 14y ago
    It most likely does warn users but most people just click 'Accept' on all those "ABC application wants access to X, Y and Z" warnings.
    • Samuel_Michon 14y ago
      Right, this form of security is completely ineffective. It’s just like Vista’s Universal Access Control modals: after being shown the first few of the day, you would stop reading them. I suspect EULAs are written to exploit this phenomenon: no-one reads EULAs because they go on forever, so you can bury all kinds of outrageous conditions in there.
  • jamesaguilar 14y ago
    All of the smartphones I have used ask you before allowing access to your contacts. But many apps want to use these for legitimate purposes -- for example, Vine uses them to find people you're already friends with.
    • dotmanish 14y ago
      It's all about trusting what that company is saying "now". They can change later and spam your list or use it for some other purpose. You can shame them publicly if you find it out. But then, it's already too late by that time.
• homosaur 14y ago
  This is pathetic. I'm glad I've never found a use for this pile of garbage but this is like the fourth or fifth time I've read about something exactly like this happening. This company has no respect for users or privacy. CALLING A FREAKING LANDLINE?!? DIE PATH
• DanI-S 14y ago
  FYI, you can deactivate your Path account by visiting their website (https://path.com/ https://path.com/), signing in and clicking 'Deactivate' on the 'Settings' page.
  • clauretano 14y ago
    Deactivating your account just effectively hides your profile. You're only a couple clicks away from having it all restored if you so choose. They seem quite good at finding ways to screw up, surely they can still find a way to do this until they actually remove your data. Contact them via their Desk service portal here http://service.path.com/customer/portal/emails/new http://service.path.com/customer/portal/emails/new and ask them to remove your data after deactivating.
  • taude 14y ago
    Notice that is says "Deactivating your account will remove your content from Path. If you reactivate your account, your content will come back." Not deleting your content, though. I hate that.
    • dbpatterson 14y ago
      It's also a bald-faced lie. If it removes the content, then there is no way for it to come back.
      • Samuel_Michon 14y ago
        The wording is slippery and pretty deceptive, but it’s technically correct. “Deactivating your account will remove your content from Path.” The ‘Path’ in the sentence refers to the social network, not the company’s servers.
        • pbhjpbhj 14y ago
          https://path.com/privacy https://path.com/privacy This privacy policy is a joke. It basically says "we can do anything we like with your data". Under the "What Information Do We Share With Third Parties?" section there are some classic deceptions. This one is great (as in evil genius): >with certain social networking services, if you allow such sharing through our services; // Not consent, allow. As in if you don't actively prevent it we'll do it. >with service providers who are working with us in connection with the operation of our site or our services // We'll sell you out to anyone who we can describe as "working with us". >"in connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition, or in any other situation where personal information may be disclosed or transferred as one of our business assets." So when doing business-y stuff, blah, blah oh yeah and any time we want to use your info as a business asset. They're covering themselves, again, to sell all data to anyone who'll buy it.
• deleted 14y ago
  [deleted]
• tnorthcutt 14y ago
  Google cache: http://webcache.googleusercontent.com/search?q=cache:www.branded3.com/blogs/the-antisocial-network-path-texts-my-entire-phonebook-at-6am/ http://webcache.googleusercontent.com/search?q=cache:www.bra...
• na85 14y ago
  Looks like the good old HN rush has tanked their server. Anyone got a mirror?
  • stordoff 14y ago
    Google Cache: http://webcache.googleusercontent.com/search?q=cache:http://www.branded3.com/blogs/the-antisocial-network-path-texts-my-entire-phonebook-at-6am/&strip=1 http://webcache.googleusercontent.com/search?q=cache:http://...
• smickie 14y ago
  This might be off topic but I loved reading that post, it turned into comedy gold. The time I was at the third... (I don’t have any photos to share with them) I was giggling. And the list of people path called at the end killed me.
  • edgesrazor 14y ago
    As I read the post I wondered the whole time, "Does he have any photos to share?"
• kemayo 14y ago
  I think the HN traffic may have destroyed another WordPress install. So, google cache: http://webcache.googleusercontent.com/search?q=cache%3Ahttp%3A%2F%2Fwww.branded3.com%2Fblogs%2Fthe-antisocial-network-path-texts-my-entire-phonebook-at-6am%2F&oq=cache%3Ahttp%3A%2F%2Fwww.branded3.com%2Fblogs%2Fthe-antisocial-network-path-texts-my-entire-phonebook-at-6am%2F&aqs=chrome.0.57j58.1101j0&sourceid=chrome&ie=UTF-8 http://webcache.googleusercontent.com/search?q=cache%3Ahttp%...
  • taylorbuley 14y ago
    For those with WordPress installs who want to survive an HN frontpage: 1. if you don't have sudo, use the W3 Total Cache plugin http://wordpress.org/extend/plugins/w3-total-cache/ 2. if you have sudo: 2a. the easy way: apt-get install memcached, add the pecl memcache extension, and use object-cache.php http://plugins.svn.wordpress.org/memcached/trunk/object-cache.php and batcache http://wordpress.org/extend/plugins/batcache/ 2b. the hard way: varnish https://www.varnish-cache.org/ https://github.com/pkhamre/wp-varnish
    • icelancer 14y ago
      Using CloudFlare or Google Page Speed Service is also a good idea to further optimize!
      • peterwwillis 14y ago
        Or: # /var/spool/cron/crontabs/apache */2 * * * * ( cd /var/www/htdocs && [ ! -e .mlan.lock ] && touch .mlan.lock && wget -q -O tmp.html http://www.mywebsite.com/blogs/my-long-article-name/ && mv -f tmp.html my-long-article-name.html && rm -f .mlan.lock ) Post HN story http://www.mywebsite.com/my-long-article-name.html http://www.mywebsite.com/my-long-article-name.html and it'll get refreshed every 2 minutes. Pretty simple hack. (Edit: add lock file)
    • lucb1e 14y ago
      rm -rf /var/www/wordpress FTFY
• trimbo 14y ago
  This is what desperation looks like, and why we need to be adamant about our privacy.
• nikolakirev 14y ago
  One of my clients wanted me to implement the same thing for his iOS app. I told him, that I think it is illegal and if it is not, that it should be. Anyway, I never wrote that code.
  • Matt_Mickiewicz 14y ago
    "Thank you" - From, The Internet.
• shadesandcolour 14y ago
  This certainly sounds like a bug in their Android app and not a malicious thing that they did. Path is headed up by some smart people. I have a hard time believing that they would willing blast out texts to everyone in an address book considering what they just paid the FTC. Then again, it's possible that it was a user error while trying to uninstall the app. There certainly is an option to invite people to path right there in the sidebar.
• crazygringo 14y ago
  How about another detail -- the fact that the message said the user had photos to share, when he didn't? There's annoying spam, and then there's straight-out-lying spam -- the "x has sent you a message, you need to create an account to view it" type. Just curious, is there a way to sue/fine a company like this for false advertising, essentially?
  • creativityland 14y ago
    Maybe that's why we've been seeing Path more in App Store top charts recently? Another app doing similar spamming is Circle: http://discovercircle.com http://discovercircle.com - surprised no one talked about that...
    • angersock 14y ago
      Growth hacking through grey-hat tricks? This is an outrage! (your winnings, sir.)
      • deleted 14y ago
        [deleted]
    • micampe 14y ago
      Apps can't send text messages without the user knowing it on iOS, you have to tap Send for each one of them, so this couldn't have affected App Store rankings.
      • ahknight 14y ago
        You presume the app sent it and not their servers or a partner service provider. They already grab your address book, including phone numbers. They don't need you after that.
        • micampe 14y ago
          In that case don't you think we would have seen many more reports of this shady practice? This seems to me a combination of purposefully bad UI and the user not paying attention. Still the same practice spammers use, but very different from "covertly uploading my contacts data and texting everyone without telling me".
• asperous 14y ago
  Strangely, this behavior will ultimately be reward with a huge influx in user base due to awareness. Might even cover that 800k fine easily.
• meerita 14y ago
  Glad i just deleted Path long time ago. I did it because many reasons, the first one is transfer my entire life to a new place, then find out it can close, sell to another company I don't like. So the fear of wasting resources and time to setup my life in there made me deny this app. The second reason was an old episode with contact data, so I thought they shall make many other "mistakes" in the future. So after this one I feel better I didn't follow this path. Facebook is also dead on my life, I just check it for family messages. Google+ all the way.
• jacquesm 14y ago
  Path must really like thos FTC fines. Here's to hoping the next fine will exceed their cash reserves and we can put an end to this madness. The post is proof positive that path still uploads phonebooks from the app to their servers right after installing it.
  • Me1000 14y ago
    This comment is a great example of how people are so quick to rush to judgement with emotional reactions. Let's look at the facts: 1. Path was fined, not for anything involving address books, but for allowing 12 year olds to sign up for the service. 2. Yes... it is proof that Path uploads your phone book. Of course, they ask you. The OS won't even give you access to the phone book without prompting the user. So somewhere along the way, the user knowingly gave Path access to their contacts. It would be rather trivial for a real reporter to do some research here. Does Path actually say "We're going to invite all your friends via SMS", even in fine print? It might be sleazy, but it would certainly change a lot. But instead, we're just going to sit here and speculate about things and irrationally talk about a fine that didn't have anything to do with this.
    • sandaru1 14y ago
      Android doesn't ask for user's permission before accessing the address book, is it?
      • ditojim 14y ago
        yes, android requires user permission to access any data on your phone.
      • shocks 14y ago
        When you install an Android app it lists the permissions you grant the app by continuing with the install. Contact access is one of these permissions.
      • gtaylor 14y ago
        Android shows the permissions each app is requesting before you install, and even lets you know if they change their permissions between updates. While what Path did is crappy, they didn't subvert the Android permissions system. The thing that burnt the poster is that while a social app asking for access to their contacts might not rise a brow, the user has no way to know what they are going to do with that data without looking at the reviews or around the internet for complaints/testimonials.
• jordhy 14y ago
  That's what I call a genuine "oh-sh&t" moment.
• orangethirty 14y ago
  I actually got a text from them at around 1am not long ago. A friend opened up an account and they spammed everyone on her contacts list. She is an iOS user. I'm nost against tactics like these, but you have to do this correctly. Or else you alienate your user base and their contacts. I, for one, now tell people to steer clear from path.
• soneca 14y ago
  Growth hackers also wear black hats.
• benjlang 14y ago
  "Growth hacking"
• vegashacker 14y ago
  On iOS, Apple made it so the app has to get permission to access the phone book. (Interestingly, Google Image search turned up this for a query of "ios address book permission": http://i.stack.imgur.com/MHF0p.jpg http://i.stack.imgur.com/MHF0p.jpg) Did OP give this permission? I'm not defending Path (at all!), just trying to get full details. I've in fact accidentally given address book permission to apps by tapping too fast. Update: OP is using Android, which is different.
  • clauretano 14y ago
    Apple added this feature after the previous privacy gaffe from Path. Still though, there's a legitimate use case for asking for your contacts, and it is to help connect you with people you may know who are also on path. You also give them access to your photos to share things on Path, but there would be an uproar if they started uploading all of your photos to their servers. I'm not really seeing any good way to solve this at the OS level, it seems the only solution is for apps to be less shady.
    • Samuel_Michon 14y ago
      “Apple added this feature after the previous privacy gaffe from Path.” Yup, here’s an article about it, from February of last year: http://allthingsd.com/20120215/apple-app-access-to-contact-data-will-require-explicit-user-permission/ http://allthingsd.com/20120215/apple-app-access-to-contact-d... However, according to Apple, even before iOS6 came along (which asks permission whenever an app requests access to Contacts) it had already been against Apple’s dev guidelines to use Contacts info without users’ permission: “You and Your Applications may not collect user or device data without prior user consent, and then only to provide a service or function that is directly relevant to the use of the Application, or to serve advertising. You may not use analytics software in Your Application to collect and send device data to a third party.”
  • js2 14y ago
    OP is using Android where you either have to accept all the permissions the app requests as part of installing it, or not install it at all.
• uptown 14y ago
  I'd held off uninstalling Path because it was well-designed and I always liked checking out their new UI enhancements when they'd roll out an update. Though, apparently they've already got my address book - the app is no longer on my device. Enough.
  • pullo 14y ago
    I was thinking the same thing. Path's UI design is notable and i wanted to keep tabs on it , as an engineer. Looks like the curiosity is not worth it.
• crikli 14y ago
  I got one of these texts from a friend of mine. Path didn't ring a bell so I figured he'd gotten hacked and ignored the text message.
• maxcan 14y ago
  I'm sure this will be downvoted to hell and back, but still: http://jesuschristsiliconvalley.tumblr.com/post/46539276780/a-cunt-and-his-iphone http://jesuschristsiliconvalley.tumblr.com/post/46539276780/...
  • hawkharris 14y ago
    This was so great it almost made me laugh out loud.
    • maxcan 14y ago
      the man is a genius. his other posts are also pretty awesome. however, part of me suspects that in an ultimate act of vanity, dave morin himself set up his own hateblog.
  • deleted 14y ago
    [deleted]
  • blocke 14y ago
    And here I was busy thinking "Wow. If Path is doing crap like this than that post about the founder being a douchebag must be 100% correct." Congrats on being even more obnoxious than Facebook.
  • deleted 14y ago
    [deleted]
  • rdl 14y ago
    Turning off the ringer on your phone is totally legit, though. I don't believe in interrupt-driven communication, unless it's mediated through a machine or some kind of filter. (I'll let a machine notify me if lots of stuff is down, or if one of a very small number of people call me, but that's about it. IIRC, pg's call went to voicemail a couple years ago.
    • untog 14y ago
      Turning off the ringer on your phone is totally legit, though. It is, but his stated reason for doing so is nothing if not totally insane.
• hkdobrev 14y ago
  I haven't even finished the article when I checked if had uninstalled the Path app!
  • jonny_eh 14y ago
    The problem was the guy's address book got spammed AFTER uninstalling, yikes!
• leephillips 14y ago
  I think the moral of this story is to do a little Googling about a company or product before trusting them with all the contact information (at least) in your phone. You know, to find out first if they're criminal scumbuckets. For all you know their app keylogs your transactions with your bank.
  • nwh 14y ago
    Well we know they don't keylog, they can't act outside of their sandbox. Curious if they'd try if they could though.
    • leephillips 14y ago
      Unless they've found an exploit. Even companies that are generally law-abiding (Sony) have distributed applications specifically designed to circumvent OS-level protections, to do things the user doesn't want. Given what we know about these creeps, why wouldn't they? You have to have trust to install closed-source software, and that trust should be based on something besides "oooo, shiny".
      • rdl 14y ago
        Putting a keylogger exploit into an app that you, as named identifiable rich people and a US company distribute through the app store, would be pretty crazy risk profile for the developer. All it takes is one person finding it. Exploits should be used on targeted individuals where you can serve a trojaned app just to that individual, vs. something like the App Store where that would require either Apple's permission or some crazy proxy. (A carrier could probably do it with phones the carrier sells, though, particularly on Android, but even on Apple by pre-jailbreaking phones sold in sketchy areas like rebel-held Syria, if that were the goal)
      • nwh 14y ago
        They might run into troubles doing that. At least one security researcher has a lifetime ban from Apple's developer program for trying things like that.
• austenallred 14y ago
  At times like these I feel the best I can do is pay with my downloads (or vise versa). I just deleted Path; I recommend others do the same.
  • deleted 14y ago
    [deleted]
  • rzt 14y ago
    I just deleted my account as well. I never really used the app due to a lack of traction within my own circle of friends, but now I have an even better reason to rid myself of the thing.
    • deleted 14y ago
      [deleted]
• deleted 14y ago
  [deleted]
• deleted 14y ago
  [deleted]
• celerity 14y ago
  Why do people use these horrible services? Is having an online social presence so important? I understand if you do it for business, but if bad news like this keeps coming out of a company, I simply stop using their products.
• nashequilibrium 14y ago
  This is both funny and a serious invasion of privacy. Path keeps on stepping into it because they are hell bent in using web 2.0 tactics to get customers. The smartphone is a very personal and intimate device completely different than a desktop or laptop and when you loose the trust of people who have invited you into their homes, you will not get a second chance. Path has been struggling for a while but for the last few months I have been noticing a lot of PR articles talking about their growth, especially outside of the US. My guess is that their VC probably said fuck it! We can ask for forgiveness later! When a company is this small and shows no regard for privacy we better hope that it falls in the deadpool because if they get to scale, we are going to get to hear a lot more of these invasive tactics. I really hoped for path to put a dent into Facebook's growth but not anymore!
• msantos 14y ago
  I share this guy's frustration. But with Whatsapp not Path - I heard not so nice things about Path so didn't bother trying it. Anyway, after installing Whatsapp on my Android the app didn't spam my contacts, but quickly uploaded by entire contact list and hours later I started receiving spam from recruiters that had my phone number. So far, not the app's fault. But then I went on the delete the app, but first I wanted to delete any contact it had previously uploaded so it wouldn't keep my data. How naive was I?! Whatsapp wouldn't let me delete the contacts it had previously uploaded. Eventually I just gave up and deleted the app without clearing the app's data.
• Groxx 14y ago
  Looks like this might be related to the "find friends" button. There are a handful of reviews in the Play store that mention it messaging everyone. This is why I hate install-time permissions. It means you have to trust an app until uninstall do you part, which generally happens well after abuses.
  • SomeCallMeTim 14y ago
    >This is why I hate install-time permissions. Android developer here: I would have to say a mix of permission types would be best. Sometimes a feature of an app is crucial to its design (or, to be blunt, to its monetization). A few things -- using the camera on the phone, accessing the address book, sending text messages, maybe a few others -- would be great to request as "optional permissions," or even better, "runtime-granted permissions," so that an app that only 5% of the time needs that permission could ask for it LATER instead of making everyone who installs the app agree to using a permission that they may not want the app to have. As it stands, you'd have to break your app up into several different downloads in order to have optional features. Not impossible, but neither is it a good user experience.
• deleted 14y ago
  [deleted]
• donretag 14y ago
  Am I the only one that found this sentence interesting/amusing/silly: "I decided the best place to contact them would be Twitter" Why would anyone contact someone on Twitter first? Their contact page (usefulness unknown) is easy to find on their website.
  • manifold 14y ago
    You're publicising a problem with the company and so it has more of an incentive to deal with it quickly.
  • jmathai 14y ago
    You'd be surprised how often you can get a response faster on Twitter than via a service's support desk.
• gcb0 14y ago
  that is great! really! if another dozen of cases like this happen, maybe, just maybe, people will wake up and stop installing apps with ridiculous permissions. That's one of the reasons i use CyanogenMod. i can disable permissions from apps. For example, i removed internet access from swype. It does crash everytime i reboot my phone, because it's probably trying to check for updates, and i know it will crash if it tries to connect while i'm typing. and i rather that then be in the dark if my data is secure.
• schabernakk 14y ago
  I was considering joining path with 4, 5 of my closest friends to have some kind of 'private facebook'. I don't really like sharing stuff on twitter/facebook so path seemed like a good alternative to share stuff with people i definately know will be interested. After reading this I don't think I will join anytime soon. I don't really get the reasoning behind this. Path is marketed for the use case I had in mind. Sharing stuff with only a handful of people you know well. Why on earth are they trying to lure all of your contacts in. This would make sense for facebook, not for path. Anyone knows an alternative to path using my data more responsibly?
  • HNaTTY 14y ago
    Internet Relay Chat (I'm into simple solutions)
    • schabernakk 14y ago
      I really like using email for staying in touch, also works with groups. But besides the fact that my friends aren't really into the whole tech thing (lot of them are still using their old non-smartphone) Inlining videos, photos and threading conversations is something I really like for such a software to have.
      • HNaTTY 14y ago
        One other idea that comes to mind is that you could create a private subreddit on reddit.com and make it closed/invite-only. Reddit doesn't ask for personally identifying data.
  • dcpdx 14y ago
    I use GroupMe; although it isn't laid out as "beautifully" as Path is, it's simple to use and you can share photos pretty effortlessly. I don't think it has as many bells and whistles as Path (I installed it once but then ended up deleting it because the utility was near zero) but it works great to have an ongoing conversation with a gorup of buddies. The thing I love about GroupMe is that you can create new groups and add different people according to the situation at hand; it's awesome for concerts, festivals, and shared events to keep track of everyone. The downsides are it doesn't have the longevity of something like a Path, and it's a battery HOG...make sure to turn off Push notifications or you're going to have a bad time. Also just to disclose, I don't work for GroupMe so not a corporate plug. I've also heard What's App is great although I've never used it myself.
• ajanuary 14y ago
  From http://www.theverge.com/2013/4/30/4286090/path-is-spamming-address-books-with-unwanted-texts-and-robocalls http://www.theverge.com/2013/4/30/4286090/path-is-spamming-a... it sounds like it's a result of "finding your friends" actually texting invites to friends, and then text messages being put in a queue so they're getting sent out even after the app is deleted. Obviously such an action should be more clearly labelled. If it was, could they whitelist the times it sends out text messages to not do it at 6am? How easy is it to lookup an approximate region for a mobile number?
  • mynameisvlad 14y ago
    You can do it based on country code, and, if you want, NANP for North American numbers. That would get you a time zone (or range) and you can easily use that to not spam people at 6am.
• hmottestad 14y ago
  Let's sue them for hacking into everyones phones. Which is essentially what they did. It's still a break in even if you leave your door unlocked.
• cloudwalking 14y ago
  Let's not jump to conclusions too quickly. This was probably (hopefully) a bug.
  • HNaTTY 14y ago
    From theverge's article (above this post currently) "Path is really best with friends and we really want to help users invite the people that they care about to their Path as quickly as possible," said Nate Johnson, VP of marketing for Path. Johnson said the Path customer service team has reached out to Kenwright, but right now it looks like nothing went wrong with the app.
  • bentcorner 14y ago
    The whole feature seems like a bug. Even under the best of conditions who would want to text their entire address book that they had photos to share? It's (IMO) socially obnoxious behavior and should be made difficult to do. Maybe I'm not in the target demographic, but I'm guessing that most people have a mix of contacts in their contact list that conform to different social situations. Not all of them would care to know I had photos to share.
• lucahammer 14y ago
  The article is wrong and a linkbait. 1. Was the feature designed badly? Yes. Friends should be unchecked by default. 2. Did Path call anyone? No. That's a service from phone providers when a text is sent to a landline. 3. Did Path sent texts without permission of the user? No. But the feature was designed in a way that many people just tapped yes and didn't uncheck their contacts.
  • SEMW 14y ago
    > Did Path sent texts without permission of the user? No. No? The permissions screen is shown in the verge article. It's labelled: "Find Your Friends: Path is more fun with friends. Find out who's already on Path." I interpret that as asking permission to run my contacts against its database and tell me who else is already on Path. Not as asking permission to text people who aren't. Permission to do some X with a contacts list is not permission to do anything with a contacts list.
• cwb71 14y ago
  This is the last straw I am definitely not buying any more stickers from Path.
• joecurry 14y ago
  This is absurd- Deactivation Link: http://service.path.com/customer/portal/articles/257565-deactivate-reactivate-your-account http://service.path.com/customer/portal/articles/257565-deac...
• _pmf_ 14y ago
  > I decided the best place to contact them would be Twitter No, you didn't. You decided that you could score some quick internet drama points using Twitter.
• ysapir 14y ago
  This seems to be a direct violation of Google Play policy: "Do not send SMS, email, or other messages on behalf of the user without providing the user with the ability to confirm content and intended recipient." https://play.google.com/about/developer-content-policy.html https://play.google.com/about/developer-content-policy.html
  • amirmc 14y ago
    Not quite. The messages aren't being sent from the device, they're being sent by Path from their own infrastructure once they've uploaded the address-book.
    • ysapir 14y ago
      The policy does not make that distinction. An app generally needs a backend and it is clear some of the policies are directed towards not the app itself but how it interacts with the backend. These same guidelines are meant to be used to stop apps such as malware games that collect contacts and send them to the backend to be used as spam email lists.
• hiroprot 14y ago
  It doesn't seem to be a bug, it has to do with their post-signup invite friends screen. By default, all contacts are selected, and if you just hit next, it will invite them all. You have to explicitly hit "unselect all" first :( Obviously, this is really bad UX design (for the user), and it really surprises me that Path would do this just to get a few more users, especially considering that they used to market themselves as a social network for a limited number of close friends.
• taylorbuley 14y ago
  Could this kind of "feature" be responsible for recent news about massive user growth? http://blogs.wsj.com/digits/2013/04/25/path-a-social-diary-app-is-adding-1-million-new-users-a-week/ http://blogs.wsj.com/digits/2013/04/25/path-a-social-diary-a... Path, a more intimate social-networking app that’s like a personal journal, is now growing by 1 million registered users a week after its most recent launch. The newest version of Path includes a way to message your friends — for which Path limits to 150 — and send them stylized stickers like other top messaging apps. Around half of Path’s registered users (now at 9 million) are regularly using the app on a monthly basis, CEO Dave Morin said.
• SurfScore 14y ago
  Is this only a problem on Android phones? The screenshot he shows of the text is clearly Android. I would wonder how this would be possible on a non-jailbroken iOS device if Path wasn't left running all night.
  • rozap 14y ago
    I don't see any reports from iOS folks about this happening. It's definitely against the Android Play store TOS, though. The Play store definitely has a more laissez fair approach to apps, but spamming like this is pretty a pretty blatant violation. Google might want to consider suspending their app.
• questionhn 14y ago
  is there a way to sandbox an application? say i install an app, but i want that app to see exactly 0 contacts when i actually have more contacts than that.
  • pekk 14y ago
    Of course not, that would make the App Store less valuable to its customers (namely, app vendors).
• deleted 14y ago
  [deleted]
• droithomme 14y ago
  Perhaps the third time's a charm for Path. http://gawker.com/5883549/dont-forgive-path-the-creepy-iphone-company-that-misled-us-once-already http://gawker.com/5883549/dont-forgive-path-the-creepy-iphon...
• deleted 14y ago
  [deleted]
• deleted 14y ago
  [deleted]
• deleted 14y ago
  [deleted]
• AJ007 14y ago
  I don't know the exact details of this story, may be the blogger accidentally pressed a button in the app and the messages were queued up for the following day. However, if the story is indeed cut and dry: 1) Path sent messages that qualify as spam both because they had no permission to send them and they were false. 2) If this was intentional, this should be a red flag to investors not just of the company but the kind of people that run it. 3) This is nothing new. Tagged did the same thing, with e-mail, which to some degree falls afoul of less laws than using text messages or the telephone (other commentators pointed out that land line carriers convert SMS to voice calls, which is news to me.) 4) Using spammy methods to acquire users is a red flag for any web service. While arguably Facebook used and uses extremely aggressive e-mail notifications (sending out an e-mail for every minor thing, and whenever a new feature is added opting in the user to receive notifications by default), using spammy techniques means that your service will skew toward the bottom of the market that actually "falls" for these techniques (poor and illiterate) early on and actually scare away early adapters for multiple reasons. 5) In the short term, Path's metrics will look really good, but in the long term it could result in serious problems, least of which will be another news story with FTC settlement in it.
• Void_ 14y ago
  This is the most ridiculously arrogant apology: > We're sorry to hear of your issues. Well I don't have issues, you have issues. And you should be sorry that you screwed up, not to hear about anything.
• white_devil 14y ago
  > @stekenwright We’re sorry to hear of your issues and would love to engage. Please message us so we can help Translation: "Your blog post detailing our scuzzy spammery is getting seen by lots of people. We're uncomfortable with that, and would like to get you to say we're not so bad after all."
• nicholassmith 14y ago
  I wonder if Path will end up being used as a model of what not to do for start-ups, there's been that many missteps that it's hard to separate the network from the issues. Overreaching use of customer data, check ("But everyone else was doing it!"), and then saying "it turned out the customers didn't understand this", spamming contacts, a CEO who come across as somewhat of an arse at multiple opportunities. If I was a VC I'd be so nervy about investing money in a business that's repeatedly getting caught out doing some seriously shady business practises.
• yebyen 14y ago
  So, did anyone tell you / did you find out that they signed up for Path as a result of the SMS spam? Did it turn out that you really did have photos to share, but forgot?
• cemregr 14y ago
  MessageMe does this too. When I was installing it, it auto-checked 600 people and the default "next" button was going to text those 600 people. LinkedIn's signup flow is similar.
• gfodor 14y ago
  This sounds to me like there was a fuckup in one of the pieces of software that sends these messages causing a lag. The guy probably hit "yes" somewhere without realizing it and then 12 hours later shit hit the fan. Could have been client, could have been Path server, could have been cell provider, whatever. The thing is it doesn't matter. When you're dancing on the line of ethical behavior, you are one bug, one mistake, one oversight from crossing it. When you cross it, it might not be "your fault", but generally it never is: your fault was to be so close that such a thing could happen in the first place.
• onemorepassword 14y ago
  Why on earth are people still using Path after it has become so very obvious a long time ago how unethical this company is? This kind of behavior doesn't just go away after a bit of bad publicity or a few fines. It's part of the DNA of a company. Such a lack of ethics permeates everything from strategic decisions to technical choices to hiring. Expect more of the same.
• creativityland 14y ago
  Another similar user report from 3 months ago on Reddit, very detailed report. http://www.reddit.com/r/Android/comments/16tavj/warning_be_careful_with_the_path_app_featured_on/ http://www.reddit.com/r/Android/comments/16tavj/warning_be_c...
• ketralnis 14y ago
  Twist also likes to send me messages every time someone in my phone book uses their app (and presumably it tells that person too). I don't remember telling it that it could access my contacts but I suppose I must have.
• WilliamSt 14y ago
  I signed up for path a couple of months ago, with facebook. When I realised how much private photos (they didn't seem to care about the privacy settings on facebook) they took from me, I deactivated my account and sent an email asking them to remove all my information. Yesterday, I reactivated my account, lo and behold, they had not taken away my information as I asked them to do, and it seems the information had been there all along, even though I deactivated my account, because some friend of mine hade gone in and "liked" my pictures on path while my account was deactivated.
• perchance 14y ago
  A terms needs to be coined for this behavior- perhaps "PATHology"?
• smegel 14y ago
  Sounds like a job for Anonymous
• fotoblur 14y ago
  One thing I've learned from this kind of news is this: Do wrong and get ahead. Most people will forget next week, you'll get a ton of free press, and oh yeah...more users. I've been so dumb to not have tried this kind of bad publicity stunt yet.
• pmarca 14y ago
  This is not a comment specifically on Path -- I don't know anything about what they are doing or not doing. But more generally: one of the most interesting parts of startups is the tension between "Don't Be Evil" and "Don't Fail". It would be good to be able to discuss this more openly -- "Don't Be Evil" by itself is too utopian. Many of the most successful companies in the world did things in their early days -- or later -- that new entrepreneurs would never even consider -- until of course their own backs are up against the wall.
  • mehrzad 14y ago
    I, and I think most of us here, know of this concept, but I'd say you articulated it well. If a company needs to be semi-evil, being upfront may help them.
  • amirmc 14y ago
    There are many (perhaps dubious) things I've learned from friends about how to grow/bootstrap users. If I decide to ever use any of those tactics then I'll know I'm doing something dodgy and work to mitigate any risks. I'd bet that the successful companies you're referring to also knew that they were on shaky ground and acted accordingly. However, problems arise when startups begin to think that behaving this way is 'normal'. During the previous furore over Path grabbing address books, the CEO claimed it was "industry best practice". Just because (nearly) everyone does it, doesn't make it "best practice". It actually belongs on the 'list-of-dodgy-things' and therefore should be treated with the appropriate caution. This is one reason I have a gripe with the "Move fast and break things" bandwagon. It's not really appropriate if you're stumbling around in a minefield.
    • chii 14y ago
      yep - agreed that just because nearly everyone does the same thing doesn't mean its a good thing to do: nearly everyone used to own slaves (except the slaves).
• mattdeboard 14y ago
  "We're sorry to hear of your issues and we would love to engage..." If you can't send anything except this daft, goofy, unbelievably annoying tweet, maybe you need to find a different way to "engage" with upset users.
• mckoss 14y ago
  Thanks for the reminder - just uninstalled Path.
• polymathist 14y ago
  I just went to the path app on the Google Play store and marked every user review that mentions the spamming as helpful. People should know about this before they download, but most only read the first three reviews and don't look closely at permissions. https://play.google.com/store/apps/details?id=com.path&feature=nav_result#?t=W251bGwsMSwxLDMsImNvbS5wYXRoIl0 https://play.google.com/store/apps/details?id=com.path&f....
• pjbrunet 14y ago
  I blame Google and Android and its Play Store. So many apps ask for ridiculous access to everything, they should really discourage this. There should be a big red flag on any apps that ask for "superuser" access to my phone. After getting a "smartphone" I've had 50x more spam calls. I never had this problem pre-Android. Coincidentally, spam peaks when I'm using my phone, which makes me wonder if these apps are telling spammers I'm near the phone.
  • smirksirlot 14y ago
    You're blaming the Play Store for something that the app developers decided to do? Just because there's a hole doesn't mean it should be abused, particularly since Path is supposed to be from a "legit" company.
    • pjbrunet 14y ago
      Yes I am. If there's a hole in IE allowing a virus to proliferate, don't we blame IE and get a security patch or switch to another browser? How is this any different? The root of the problem is Android and the Play Store.
• laxcrosi 14y ago
  They're actually hiring a Director of Privacy and Legal right now: "The Director of Privacy and Legal will be responsible for positioning Path as a leader in the protection of user privacy."
• wwwong 14y ago
  Usually, this is what happens when someone get's so caught up with 'Growth Hacking' they forget about UX.
• existentialmutt 14y ago
  http://www.wuphf.com/ http://www.wuphf.com/
• nekojima 14y ago
  How about a little bit of consistency for the Path url in the tweet. I know its now common practice, but this obscuring of links is what I have repeated told my family and many friends to avoid clicking on, so to avoid downloading viruses or going to sites they don't intend to. For "bit.ly/PathHelp" the underlying url is "t.co/B4lOWrDqyr" and it redirects to "service.path.com/customer/portal/emails/new" I'm sure there is a reason for it, but just having service.path.com or help.path.com would be more beneficial for the company to both have as a url and to tweet to (former) customers/users.
  • salman89 14y ago
    Has to do with URL character count - Twitter limit is 140.
• dredmorbius 14y ago
  And this is why I fundamentally don't trust my smartphone. It's a fun device. But it's a spy, outside my control, in my pocket. I've rooted it, but haven't yet modded it (and if anyone cares to point me at a gentle introduction for CyanogenMod or another option that works on an HTC Incredible, I'm all ears). I've been reasonably conservative in what apps I place on my phone, and several (Pandora specifically comes to mind) were removed when permissions were extended to include contacts (Pandora, you listening?). I'm waiting eagerly for the following capabilities: To define at the phone level what information I'm willing to share. Existing "privacy controls" make a mockery of any semblance of either "privacy" or "control" by distributing vague and conflicting access among a great many applications with no ability to centrally audit them. To specifically grant to specific applications specific rights. My location is something I'll disclose very guardedly (I disable GPS functions on my phone). Other rights generally shouldn't be shared. To request and audit ALL information a given application has of me in a convenient electronic format (such as a database dump accessibly by MySQL or Postgresql). Such functionality is of course a three-edged sword, as what information the vendor has and I wish to request a third party might also request pretending to be me. Or having legal authority to make the request (though that's already the case), via subpoena or warrant. My contacts list is off limits. Full stop. Specific contacts might be contacted by way of an application if specifically designated by me, but no other use may be made of their information. Hell, it's not even mine to give. The existing state of smartphones is interesting, but it's also a little shop of horrors. And if application authors, smartphone manufacturers, and telecom providers don't get their act together on this Real Soon Now, we're going to see some horror stories.
  • magic_haze 14y ago
    A thousand times this. Why does the OS not make the app permissions more granular than a bit flag? Every app and its dog nowadays require all these really invasive data permissions, and all the choice we're given is either "yes to all" or GTFO. Google went to great efforts to design the concept of contact circles (something that could easily have prevented the OP's problem), why is Android still stuck in the dark ages of data sharing?
  • dnissley 14y ago
• tlear 14y ago
  Happy I deleted my account a while ago, loved the design back when v2 came out but..
• jevin 14y ago
  I don't understand why people still use Path. Why do they have good ratings and how come they are still on the Appstore?
• jevin 14y ago
  I don't understand why people still use Path. Why do they have good ratings and how come they are still on the Appstore?
• tzury 14y ago
  The very fact that a product/service/company does not have a clear and solid revenue model. The fact that their success is measured by generated traffic (downloads/page-views/subscribers etc) can cause some people to make very strange choices. This may not be the reason but surely helps many in our industry to reach those dark spots of ethics and faithfulness. If your users are customers, that is, they pay you, then you will care about their privacy, as you know that otherwise, you will loos them. If they don't, and yet consume your bandwidth and CPU, you may find yourself end up sniffing their address-books, claiming copyrights on their images or selling their clicks and choices to campaigners.
• Mordor 14y ago
  I know this is totally off topic, but why does File Expert need to read my contacts? Would be better if Android was able to install apps while selectively denying certain permissions. Another option is to prompt, e.g. "send path.com your address book [yes|no]?"
• qompiler 14y ago
  That's why its free.
• magoon 14y ago
  didn't Tagged get sued for this?
• saintx 14y ago
  Software developers are as responsible for this guy's address book getting spammed as fork and spoon makers are for making people gain weight. Someone built a tool. And someone else used that tool to do an unethical thing. I doubt a software language exists that can control the choices of its users.
• hatestheword 14y ago
  Always be on offense - never answer your phone :-)
• general_failure 14y ago
  I like Path. They are showing the world what could happen if your data lands in the wrong hands. I hope people now become more aware of privacy and security issues thanks to Path. Tell me which other company is directly working for this cause? FB and Google keep telling that they won't use our date for bad purposes. Path is showing what can be done with the data they already have. So this is why I like Path. They are setting an example of what bad companies can do.
• vtempest 14y ago
  The problems with Path are because its CEO Dave Morin is not geek enough. Dave is Christian, majored in economics, focuses on skiiing, worked in a marketing and management position at Facebook and Apple. he doesn't go hard, he is just opportunistically trying to seize a financial position by hiring geeks and be public speaker in the news. He acts like Steve Jobs while leaving out the crucial prerequisite of actually having smart people like his product.
• valugi 14y ago
  This is not news. I do remember this news about 6 months ago.
• mikescoffield 14y ago
  Taking a page from FB's playbook.