Voxer uploads your entire Address Book

http://bryanrahn.tumblr.com/post/17333238080/another-app-another-address-book-uploaded

by brahn • 14 years ago

46 15 14 years ago

bryanrahn.tumblr.com

dvillase2• 14 years ago

The privacy feature disables your location which is viewable to your friends by clicking their icon inside chat. I found that very disturbing. This should not be a default enabled feature.

notphilatall4• 14 years ago

How do you expect the app to find other users that are in your address book without uploading your address book? It can hardly send all other users to your phone in an attempt to match them up.

I agree that the second notification is a little bit annoying, but in the case of Voxer you DID have a chance to cancel out -- it didn't secretly do it in the background, which Path apparently did.

dvillase2• 14 years ago

Since we give them access to our Address Book, I wasn't too surprised.

jcoder• 14 years ago

They can hash the values they want and compare them with hashed values from other phones.

notphilatall4• 14 years ago

It's mostly a question whether they store it or not -- although they have to store it in order to support notifying you when new users who are in your address book join the service.

If their servers are compromised, a cracker could still get MOST of the info. Since the hashing function (and salting mechanism) lives on the phone, she could generate a rainbow table of all possible phone numbers and a set of emails for common domains.

sriramk• 14 years ago

The hashing won't let them do partial name matches and other 'fuzzy' matching where there isn't an exact text match but strong signals to indicate a match.

masonlee2• 14 years ago

I would recommend sending hashed canonical values like we do in Textie. I posted this explanation for our users and anyone interested:

http://blog.textie.me/post/17261989750/keeping-your-address-...

masonlee2• 14 years ago

While the security of the hash itself can be a concern, the technique is always valuable:

1. In particular, the domain of email addresses is less vulnerable to rainbow tables than the domain of phone numbers.

2. Using salts and a slow hash function improves security by requiring custom rainbow tables that take longer to build.

3. In a B2C situation, an easy appeal to justice can be made that a business should not be making a concerted effort to break its own customer privacy protection. This would not look good in court.

4. If additional consumer protection laws are needed, one-way hashing for the purpose of privacy could be considered a form of pro-consumer DRM. In that realm we have precedents for anti-circumvention laws and contracts.

spullara• 14 years ago

I think the stories about social and communication apps uploading your address book are a little overblown. I basically assumed all of them do it and am surprised to find that some don't. The real issue in my opinion is that any application could be uploading it and just mining and/or selling the data without being obvious about it.

Voxer uploads your entire Address Book

Related Stories