Dictionary app auto-posts piracy accusations on users’ Twitter accounts

http://www.pocketables.com/2012/11/enfour-inc-screws-up-big-time-makes-dictionary-app-auto-post-false-accusations-on-users-twitter-accounts.html

by masto • 14 years ago

277 121 14 years ago

pocketables.com

philip1209• 14 years ago

Could this be considered libel?

yock2• 14 years ago

My gut reaction is to temper my response to this because I tend to overreact to injustice, but this is just unforgivable.

Karunamon• 14 years ago

Booby trapped software. Very clever, except for when it blows up in your face.

At least they only posted to twitter instead of [1] something a lot worse (think file deletion, etc).

Generally a bad idea, if you're of the leet warez d00d type, to give any illicitly acquired app your credentials to anything important, at least until you've verified that it's safe.

The armchair lawyer in me wonders if someone could get a libel/defamation suit going because of this. The average user wouldn't probably have much to go on, but the head of a company perhaps.. yikes.

[1] http://www.geocities.ws/johnboy_tutorials/bt.html

    why yes that *is* a geocities address!

yock2• 14 years ago

Something we see discussed on occasion is a call for app developers to explain in detail why they request certain permissions. If this developer were required to explain (and the user required to acknowledge) the requested permission, it may have prevented the whole episode.

MatthewPhillips• 14 years ago

No it wouldn't have. The app required permission, or he couldn't use the thing he paid $50 for. The is a (stunning) app store review failure. A dictionary app that requires permission to post to your twitter should be rejected, period.

praptak2• 14 years ago

> The armchair lawyer in me wonders if someone could get a libel/defamation suit going because of this.

As a professional certified internet laywer I'd also add impersonation.

__david__3• 14 years ago

That seems a difficult route given that the user had to explicitly give twitter posting access permission to the app in question...

troels2• 14 years ago

Eh .. off topic, but why did you write lawyer with Y and W switched around? You emphasised it, so I assume it was on purpose?

whamill• 14 years ago

Sloppy effort on behalf of the developers. Andreas (author of the blog post) was right to deny it permission to use his Twitter account the first few times but gave in eventually because of the nagging.

If there was a way to see expanded permissions before allowing a program to update perhaps he would have not updated at all?

drivebyacct2• 14 years ago

>If there was a way to see expanded permissions before allowing a program to update perhaps he would have not updated at all?

You really can't do that on the App Store?

hospadam• 14 years ago

The fact that the developer would only allow the app to run if the user granted access to their twitter feed would be very annoying to me. This scenario is exactly what Apple tried to help users avoid with Twitter permissions. I understand the developers wishes to stop piracy - but this is the wrong way. Simply checking for Installous is an incredibly lazy hack to check for piracy.

smirksirlot• 14 years ago

This is so offensive. I get piracy is an issue, but how did they ever think this would be a legitimate solution?

Honestly, just let the quality of your app speak for itself.

mistercow5• 14 years ago

From what I understand, piracy on iOS isn't an issue. The only place where it's really significant is China. And there are two points to keep in mind there:

1. Stopping piracy of a single app in China is very unlikely to result in increased sales of that app.

2. There's no Twitter in China.

smackfu• 14 years ago

Well, what makes something an issue? There is certainly piracy on iOS... people jailbreak their phones and then pass around ipa files on the standard piracy sites.

I'd say it is similar to piracy on game consoles. It exists but you need to do something unusual to enable it, so most people don't do it.

gurkendoktor• 14 years ago

I suspect that piracy works along the line of "product quality" / "ease of pirating a product". $50 apps and most eBooks have it a lot harder than $1 songs, even if their quality relative to their genre is the same.

UnoriginalGuy4• 14 years ago

The developers are calling this a "bug."

https://twitter.com/keitaigoddess/status/263995697571971072

https://twitter.com/keitaigoddess/status/263995940602535936

CF_HoneyBadger• 14 years ago

"Bug" my arse...someone was trying to prove a point / make a statement and it bit them. Hard.

They will have to do some heavy backpedaling for me to believe it was a bug. I'm a developer. Ive created bugs and fixed bugs. This is not a bug. This is a "feature".

mistercow5• 14 years ago

No, you see, triggering it for a legitimate user was a bug. In other words, they are unrepentant for including this feature in the first place, even though it's totally scummy and possibly illegal even when targeted at someone who really did pirate the software.

mibbitier• 14 years ago

It may well have been a "fun thing" they added in there, but never intended to release to the public. The "bug" could well have been that it was enabled in the public release.

So, it's a feature, but the bug could have been that it was unintentionally 'enabled'.

mistercow5• 14 years ago

I love how they apologize for the "inconvenience". Yes, the inconvenience of being impersonated and publicly defamed through your Twitter account.

UnoriginalGuy4• 14 years ago

I did some more digging to check that Tracey as above is in fact an employee of the company who makes this app and indeed she is:

http://www.being-a-broad.com/2010/11/tracey-northcott-of-enf...

There are lot's of other verification links on google, just look for "tracey northcott enfour"

ramchip2• 14 years ago

There's an official apology on their Japanese website where they refer to it as a bug:

http://www.enfour.co.jp/news/121105apology.pdf (JP)

MrJagil4• 14 years ago

What a repulsive link. Those images are really distasteful.... Not the pregnancy part but the staging of it. As if your entire being revolves around your stomach, and therefor so should everyone elses.

Sorry, I'm sensitive to this kind of thing. As if her life suddenly has meaning, so now she has to compensate for all the lost time. Congratulations, though.

ErikHuisman• 14 years ago

They or rather Twitter should revoke their oauth keys. Then push an update to the store with new keys.

UnoriginalGuy4• 14 years ago

Excuse my ignorance but would this work if the app is posting as the user themselves?

mikeash7• 14 years ago

Of course! Do you not routinely write bugs that result in your software accidentally impersonating people? It's so easy to do by mistake!

antidoh2• 14 years ago

Oh. They slipped and fell on that impersonation code?

trotsky• 14 years ago

im confused about paying $50 for a dictionary app

adrr• 14 years ago

it is also a twitter client

Foomandoonian• 14 years ago

favourite

john78• 14 years ago

They also sell a 99 cent American Heritage Desk dictionary app. They are a Japanese company that's been making apps and accessories since the Newton.

Their website is interesting - http://enfour.com/

Jagat• 14 years ago

It's ironic how their tagline is "The Global Communications Enabler"

incision• 14 years ago

Same.

It's probably a bit much, but I'm going to go ahead and say...

It seems somehow fitting that a company which feels entitled to $50 for a dictionary app would also feel entitled to commandeer a supposed pirate's Twitter account for public embarrassment or do something equally smug [1].

1: http://news.ycombinator.com/item?id=4778847

cobralibre2• 14 years ago

The short, glib answer is that if you have to ask why you would want to pay for a dictionary, then you aren't the kind of person who needs to pay for a dictionary.

The long answer is that good dictionaries, such as American Heritage Dictionary, the Shorter Oxford English Dictionary, and the OED itself, are produced by scholars and experts, guided by editorial panels comprised of scholars and experts, require a great deal of work to produce (the first edition of the OED took something like 71 years to complete!), and contain more data (i.e., more words and more definitions per word) and generally higher quality data than free dictionaries. You're probably willing to pay $50 for software that solves your problems, because you probably make software yourself, and you know that it costs money to create software; an analogy can be made here. But if a barebones dictionary works for you, then it works for you, and don't worry about it.

So what is a good dictionary? Here's a tentative answer. A good dictionary provides pithy, useful definitions that reflect the words' differing meanings over time and differing contexts. Most good dictionaries also provide style and usage guidelines (e.g., "When should I use 'lie' and when should I use 'lay'?"), and a good dictionary will also provide a word's etymology. Many free dictionary apps use data from WordNet, which is an amazing resource, but its focus is on tagging words with taxonomic properties (sorry, a better phrase isn't coming to me right now) and defining the relationships between those words, all of which is very useful for general linguistics and NLP research. The quality of the definitions fall short, and you should be able to confirm this by comparing just about any WordNet definition to a definition from a good dictionary at your library.

I was hoping to find a better example, but to give yourself an idea of the research problems that can be solved with a good dictionary, consider reading this brief student's guide to using the OED:

http://www.rci.rutgers.edu/~wcd/oedguide.htm

cormullion• 14 years ago

For those living in the UK, it's probable that you can access the online master OED through your local council's library web site, using your ridiculously long library card number as username.

kstenerud3• 14 years ago

Most likely, their "piracy detector" was nothing more than checking for "MobileSubstrate" (a library present in all jailbroken phones) under the silly assumption that jailbroken = pirated.

Booby trapped software is NEVER a good idea. No matter how clever you think you are, you're not clever enough.

activepeanut• 14 years ago

What do you think of disabling IAPs if IAPCracker or IAPFree is detected?

hackmiester• 14 years ago

That sounds good, as long as you don't go on the internet and talk shit about the user if it is detected.

Popping a message like this would be good: "Sorry, this section of the app is incompatible with IAPCracker. Please contact support if you have received this message in error."

alts• 14 years ago

But there are better ways of attacking fraudulent IAPs. Perhaps more effort, but certainly fewer false positives. http://developer.apple.com/library/ios/#documentation/Networ...

kstenerud3• 14 years ago

Jailbreaking and installing those hacks is difficult enough that your losses from it are likely to be low. So the question comes down to what your motivations are. Money-wise, it doesn't make much sense to tack on any more anti-piracy measures than there are already. You'd effectively be working for pennies designing and implementing your schemes with the amount of revenue they'd likely generate vs your losses from goodwill in the inevitable anti-piracy screw ups.

Personally, I prefer the pragmatic approach to the idealist. It's far less stressful.

confluence• 14 years ago

Well he didn't disable the app and he also didn't say something that wasn't technically true.

> How about we all stop using pirated iOS apps? I promise to stop. I really will. #softwarepirateconfession

If you have a jailbroken iPhone, odds are that you did so to pirate "iOS apps" and are hence a "software pirate". That sentence looks like it was carefully crafted to be correct and generalizable.

This is probably not good for the dev's PR though, because accusing customers of being criminals doesn't go down too well (Music/Film) - unless of course you are a lawyer (MPAA/RIAA) - then you make fat stacks.

kstenerud3• 14 years ago

I have a jailbroken phone and I don't use it to pirate. Cydia is an alternate app store for apps that Apple rejected. Jailbreaking is also a step to unlocking, which allows me to use my phone with my Softbank account when I travel to Japan. For those that fit these categories and use this dictionary app, the author has stepped right into the legal minefield of libel.

Collateral damage is not a justification for this.

cowpewter• 14 years ago

I have a jailbroken iPhone, because I want SBSettings and Winterboard. That's it. I want to be able to skin my phone the way I want (it's mine, after all), and I want quick access to things like brightness and wifi on/off that doesn't require jumping through multiple menus in the Settings app.

gilgoomesh3• 14 years ago

If you're an iOS app developer...

The correct way to check if your app has been pirated requires two steps:

1) You must be running on a jailbroken system. Check this by trying to read from outside the sandbox.

2) Check if your app's signature is invalid. Checking this is fairly involved. Look around for code.

If either of these two are false, then you've not been pirated (point (2) will be true when your app is checked by Apple but point (1) will be false).

For Mac App Store apps, only point (2) is required.

The author of the app in the article has only checked point (1) (and additionally checked an irrelevant point by checking for Installous).

Incidentally, the preferred action if you've detected a pirate situation is to exit(173).

myko• 14 years ago

Checking these things wont get you disapproved from the App Store?

mikecane• 14 years ago

Does checking for those things slow down the load time of the app? Wouldn't that punish paid users?

gilgoomesh3• 14 years ago

The files you're reading are already cached by the OS (to perform the exact same work). The only processing involved is computing a hashes and a small RSA encryption.

Less than half a millisecond?

mikeash7• 14 years ago

Even if both are true, the app still may not have been pirated. I wouldn't take any action based on this information beyond perhaps gathering statistics (and keep in mind that those statistics could be way off).

gilgoomesh3• 14 years ago

Apple explicitly suggest an exit(173) if the certificate check fails for Mac App Store apps.

Although I've definitely had non pirate users report this error to me because they've drag and dropped the app onto another machine instead of reinstalling from the App Store -- so you're right, it's not a guarantee that they're a pirate in an absolute sense.

eropple• 14 years ago

(and additionally checked an irrelevant point by checking for Installous)

Nit: I'm almost certain that they checked for MobileSubstrate.

DHowett2• 14 years ago

You can normally read from outside the sandbox on iOS: there are data in /usr/lib and /usr/share that are important to libraries shipped as part of the dyld cache (also incidentally found outside of the app container.)

The main question is: what exactly lays outside the sandbox? A good thing to search for could be Cydia, but there are alternative package managers. MobileSubstrate isn't a sure bet either, but I suppose it's a far cry safer than Cydia. An additional method could be trying to map a page you can both write to and execute, which should fail unless specific kernel patches indicative of a jailbreak have been applied (or you're a webview with Nitro enabled.)

The best method, however, is to not care, because if you do it's for the sake of either tracking/analytics or screwing over your users.

cobralibre2• 14 years ago

It's distressing to see such colossally poor judgment on the part of Enfour. Besides developing the ODE app from TFA, they also produce the American Heritage Dictionary app, which is one of the better if not the best name-brand dictionary app for iOS. I would like to support this app because I don't care to see the professionally edited dictionary go the way of the encyclopedia, but nonsense like this is hard to pardon.

cs702• 14 years ago

It would be obviously wrong and illegal for a stranger to come into your home, secretly inventory all physical items in your possession, and then impersonate you on, say, a global TV broadcast in which you're wrongly accused of stealing things.

It should also be obviously wrong and illegal for any app secretly to inventory everything in your phone and then impersonate you on a Twitter broadcast in which you're wrongly accused of pirating things.

Evidently, the people who made this dictionary app think it's perfectly legal to do that, and must not see anything wrong with it.

Our laws, regulations, and societal norms have a long way to go before they catch up with technology.

paulgb• 14 years ago

> Our laws, regulations, and societal norms have a long way to go before they catch up with technology.

I wouldn't say that what this app is doing is within societal norms. Just like laws, societal norms get broken, which is what happened here. The publisher will suffer consequences (both from Apple and potential customers), as they should.

jellicle• 14 years ago

> Our laws, regulations, and societal norms have a long way to go before they catch up with technology.

Oh, that remains to be proven. Impersonating someone else to have them describe themselves as a criminal is pretty clearly legally actionable, both in a civil and criminal sense. There's every likelihood that the laws and regulations will work just fine. And judging by this post, societal norms are also working just fine to disapprove of the behavior.

The guy has come up with a new way to violate laws/social norms, to be sure. But that doesn't actually mean they aren't working. They are flexible enough to adapt to most new situations and this is certainly one covered by them.

codyromano• 14 years ago

Your analogy should be narrowed according to the facts of this case. Assuming that the author's guesses about the app's behavior are correct, this is a case of software checking for one specific tool — a tool that's strongly associated with piracy. A defendant in the physical world wouldn't necessarily have a reasonable expectation of privacy if there were indications that he or she was engaging in unlawful conduct. So it's unfair to say the app's behavior would be obviously illegal or that it's comparable to a secret inventory of all of someone's physical items. That said, I'm not justifying the hijacking of the author's Twitter. That's not an appropriate remedy by any standard.

thirdtruck• 14 years ago

It's one thing to have other people learn that you own a crowbar. It's another thing to have someone else declare, using your name, that you've used that crowbar for breaking into houses.

__david__3• 14 years ago

Well, to continue the tortured analogy, the stranger was invited into the home, they didn't break in. Then they presented a release form to the homeowner saying they could impersonate him on TV, which the homeowner signed. Only then did they go on TV and "impersonate" him, saying things he didn't expect.

I don't think it's so cut-and-dry as you are making it out.

It's definitely shady, but I dare say there's nothing illegal here.

pdonis4• 14 years ago

I don't see where he gave permission for the app to post Tweets for him. He gave it access to his Twitter account, but that's not the same thing. To continue your analogy, the stranger was invited into his home, gave him a form to sign that said he could inventory the items there, got it signed, and then proceeded to publish the information in a way that wasn't mentioned on the form.

bruceboughton• 14 years ago

In the UK, I'm fairly sure this would be considered libel.

olefoo• 14 years ago

So the current social expectation of most twitter users (app developers take note) is that an app should not post content without informing the user that they are going to do so; or without affirmative action from the user indicating that they want the app to take that action. I've seen people get outraged by apps that post without warning often enough to think that doing so breaks a fundamental bond of trust.

So the granting of permission is conditional on that permission being used responsibly, and if the app fails to work without that permission and then breaks trust with its users in that dramatic of a fashion...

I know that I won't purchase or use any Enfour inc. product in the future on the basis of this; there's plenty of easier dictionary apps that won't falsely accuse me of piracy.

SonicSoul• 14 years ago

i believe the user agreed access to his tv channel, and not that he could be impersonated on tv. maybe that was in the fine print, but i'm pretty sure nobody would sign this agreement knowing such impersonation was an option

joe_the_user• 14 years ago

I would claim that you are mistaken here. Ianala but I'm fairly sure there is actionable bad behavior going on.

You may find it surprising but it is actually illegal to trick someone into agreeing to something that harms them. You can't just say "Can I do this to you" if the person you're doing something to can't reasonably be expected to know the implication of "this". That's why we use phrases like "informed consent".

stfu• 14 years ago

Somehow I think obviously questionable ideas like these have a positive impact.

They are most likely teaching users a lot more about privacy than all the warnings of us "paranoids" can achieve.

mikeash7• 14 years ago

Apple needs to burn these people to the ground as an example to others. Pull their apps, refund their customers, and ban them from all Apple platforms for life. If Apple doesn't severely punish this sort of thing, then just what good is their fancy walled garden?

antidoh2• 14 years ago

"just what good is their fancy walled garden?"

They are or have been the most highly valued company in the world.

The walled garden is not for our benefit.

mikeash7• 14 years ago

That is exactly what I was trying to imply. Apple and Apple fans are constantly telling us that the walled garden is four our own good. If Apple doesn't take severe action here, then they'll be all but admitting that our protection has nothing to do with it.

s8qnze982y• 14 years ago

Well, they've been, illegally, pursuing their own interest exactly as the people using the app without paying. I don't see anything excessive here; I'm not saying that I justify them of course.

mikeash7• 14 years ago

You don't see anything excessive about impersonating somebody and surreptitiously posting a public apology for piracy on their behalf? Huh?

evoxed• 14 years ago

What happens if you don't have a twitter account? Are you unable to open the app or does it behave normally?

DanBC• 14 years ago

They claim "complete offline use - no internet connection is required" - but that doesn't seem accurate when compared to the article.

OldSchool• 14 years ago

I'm a fan of privacy so I don't understand the draw of twitter beyond the original purpose of broadcasting a message to a known list of people. Perhaps even 1-way followers if you add in celebrity types as tweet sources.

I guess the tipping point is the 'tweet back' feature. At its worst it seems like a narcissistic 'I want to have public conversations with another individual.'

If twitter id's were all anonymous I suppose it's no worse than a forum like this except that the content is most likely far more personal and far less technically valuable. I use HN to keep up on the latest technology and to some extent business trends.

Why do people like twitter?

ramchip2• 14 years ago

One example use case I saw recently in my circle of friends: person A tweets "wow, there's a great special on sashimi bowl at the place near the university", person B tweets back "@a hey, I'll be in the area Friday, how about we go for lunch? anyone else interested?", person C (common friend) sees the conversation and tweets "@a @b hey, I'll go too". Finally a group outing is quickly organized.

Mostly I see it used for quick conversations, funny remarks, organizing small events, saying when you're going for a trip...

aidenn0• 14 years ago

An example: DJB posted something about why crit-bit trees are superior to hashes, I replied asking about cache-issues with crit-bit trees and he responded back with information about how to make crit-bit trees cache aware.

That is a very useful public conversation to have; indeed 20 years ago it could have happened on usenet.

danso• 14 years ago

Contact info to register complaints to the company (Enfour) is here: http://www.enfour.com/richard/index.html

mnicole2• 14 years ago

For those not reading the comments --

"I would add that this problem seems to be happening with many, if not all of the Enfour dictionary apps, not just the Oxford app that this story is about. And Enfour seems to be attacking customers who post low reviews on their App Store pages.

And this has nothing to do with having a jail broken iPad or iPhone. It is happening to everyone."

".. Enfour is attacking people leaving bad reviews in the App Store, but not by triggering their Twitter accounts. Enfour is actually responding to the bad reviews by posting negative comments about the reviewers themselves on the description pages of Enfour’s apps. You can see these when you access the iPad store, but you have to click “more” for them to appear. I don’t think they show up in the iPhone app store."

Sounds like a great company all around.

pooriaazimi• 14 years ago

I don't have this particular app, but I have Longman's Dictionary of Contemporary English (5th ed.), also by Enfour, Inc. that I bought last year for, I don't remember, $50 I think (at the time, now they've dropped the price).

The latest version displays "I'm a software thief" as a notification, says to run the app in safe mode and then crashes.

https://itunes.apple.com/us/app/longman-dictionary-contempor...

Oh, and I'm not jailbroken.

mambodog• 14 years ago

I've got Collins Gem Malay <-> English dictionary, which requests Twitter access, then when denied throws up a dialog saying 'Run in Safe Mode!' and crashes.

mindslight• 14 years ago

This is just the kind of thing comes along with the philosophy that the user shouldn't be the ultimate owner and controller of their computer.

Why isn't the app given an opaque 'twitter handle', which may be a real account, a no-op, or has a moderated posting ability? And why is the app allowed to view general properties of the system, looking for system software which it deems unfavorable?

Because Apple decided that instead of implementing the above security features (and giving their UI designers the task of making such capabilities understandable and non-overwhelming), they would simply only allow "good" apps. Well guess what - "good" doesn't scale.

tarabukka• 14 years ago

"Sandboxed" apps that can even look at the system drive and inspect its contents? Doesn't sound like much of a sandbox to me.

adambratt• 14 years ago

Honestly, I find this kind of funny.

"iPhone app goes rogue and starts defaming users via twitter"

That's not and issue people had to deal with 50 years ago haha.

mhuffman• 14 years ago

This is a disgusting abuse of user trust! It makes assumptions about other software and posts insinuations about you on your own twitter account!? I hope they have repercussions enough to make others considering this either think twice or be very upfront about what it intends to do.

stevewillows• 14 years ago

Does this count as a violation of one of Asimov's Three Laws?

leoh• 14 years ago

I wonder how Oxford feels about all this...

darkstalker• 14 years ago

Apps posting tweets without consent of the account owner is a violation of the Twitter rules [1]

  Get users' permission before sending Tweets or other messages on their behalf. A user authenticating through your application does not constitute consent to send a message.

[1] https://dev.twitter.com/terms/api-terms

Argorak• 14 years ago

Schemes like this do seem to pop up from time to time. Garrys Mod was the last very well known offender in this:

http://news.ycombinator.com/item?id=2447485 (I won't copy over my full complaint, read it there)

http://en.wikipedia.org/wiki/Copy_protection#Notable_payload... (for a very comprehensive list, but without comments about false positives)

They are all similar: they are dangerous when gone wrong, damage your brand, expose paying customers as if they were sad idiots and - at worst - ensure that they are ridiculed on support boards even when they have an actual problem.

Implementing such a system shows that either the programmer or the project owner in question is a smartass that thinks of himself as more infallible and better than all the others that programmed such systems that subsequently went haywire. Sorry for the harsh words, but after being bitten multiple times by such schemes, I have no nicer ones.

Groxx• 14 years ago

This is why I think every API which gives an app access to your data / identity / etc should have a way to fake it, and track whatever it does. Using a different account is sufficient, but what about when things are integrated, like system-wide Twitter or Facebook? Just give us a black-hole option for such things - return no contacts, send no messages, and let us see what it tried to do. You'll have a lot less abuse when it's easy to find.

Aissen• 14 years ago

Not an iOS user, so I wonder: what would have happened if you didn't have a Twitter account ? Or is it mandatory now ?

Dictionary app auto-posts piracy accusations on users’ Twitter accounts

Related Stories