Hit App Sarahah Quietly Uploads Your Address Book (theintercept.com) 72
An anonymous reader shares a report: Sarahah, a new app that lets people sign up to receive anonymized, candid messages, has been surging in popularity; somewhere north of 18 million people are estimated to have downloaded it from Apple and Google's online stores, making it the No. 3 most downloaded free software title for iPhones and iPads. Sarahah bills itself as a way to "receive honest feedback" from friends and employees. But the app is collecting more than just feedback messages. When launched for the first time, it immediately harvests and uploads all phone numbers and email addresses in your address book. Although Sarahah does in some cases ask for permission to access contacts, it does not disclose that it uploads such data, nor does it seem to make any functional use of the information. Zachary Julian, a senior security analyst at Bishop Fox, discovered Sarahah is uploading of private information when he installed the app on his Android phone, a Galaxy S5 running Android 5.1.1. The phone was outfitted with monitoring software, known as Burp Suite, which intercepts internet traffic entering and leaving the device, allowing the owner to see what data is sent to remote servers. When Julian launched Sarahah on the device, Burp Suite caught the app in the act of uploading his private data.
Re: So does almost every other app... (Score:1)
To be expected. Bastards anyway...
Re: (Score:2)
Re: Private data? (Score:1)
Tou sounded a bit culpable there son. You know theres this app for that that lets you say those things anonymously.
Re: (Score:2)
What kind of nonsense is this? Ever since iPhone 4/4S, you can restrict apps from touching your Contacts.
Re: (Score:1)
Please have someone pull your bowels out through your ass and strangle you with them. You retarded shit.
Remember, the Walled Garden is for you safety (Score:2)
Re: (Score:1, Funny)
Re: (Score:3)
Re:Remember, the Walled Garden is for you safety (Score:5, Insightful)
By the way, accessing the address book in order to find out if any of your friends are making use of the service is a legitimate reason to access the address book. I suspect it's an important reason for WhatsApp to become as popular as it did, since you didn't need to ask your friends if they signed up and what their handle was. But for this very reason you would expect Apple and Google to come up with a way to match friends on your address list without giving them full access, for example by providing a function that gives you a unique (for your service) user ID for each contact, by hashing a phone nr after salting it with the App ID or some such. That way the app can poll the service to see who signed up without requiring access to the actual address book.
Re:Remember, the Walled Garden is for you safety (Score:5, Insightful)
. At least on iOS the app cannot access your address book without you giving it explicit permission (apparently also the case on newer version of Android according to the article). Neither can it access anything else
The trouble remains that 'access' and 'upload the entire thing' is the same thing.
I suspect it's an important reason for WhatsApp to become as popular as it did, since you didn't need to ask your friends if they signed up and what their handle was.
Feature or bug? Maybe I don't WANT *everyone* to know I signed up. I signed up for telegram a while back to try it out with my wife. I was pretty appalled when a bunch of people at work started messaging me all over the place on it. We already have plenty of approved channels for them to reach me on; i was deliberately looking for something that I could leave running 24x7 on multiple devices... and not get messages from people at work.
But for this very reason you would expect Apple and Google to come up with a way to match friends on your address list without giving them full access, for example by providing a function that gives you a unique (for your service) user ID for each contact, by hashing a phone nr after salting it with the App ID or some such. That way the app can poll the service to see who signed up without requiring access to the actual address book.
This is a good idea. But even that is more sharing than I might want. They still get to build a social graph on graph on me that's bigger than letting me expose only the social graph I want to expose to them. They still know I am 'connectd' to all those people at work, even though i have no intention of connecting to them on the app, etc.
Games are notably bad for this too. I might wish to play a game and associate and communicate and share only with my wife and kids... but the social shit brings my sister inlaw in, randos at work, the neighbors, vendors and clients, lawyers and accountants, etc... not everyone on my contacts list is my 'friend'; and I don't want to connect to the vast majority of people in my contacts with any given app.
Re: (Score:2)
Re: (Score:2)
Like, say, a private e-mail account that supports IMAP
Fuck No. Not like that. Please god, no, not like that. I'd rather DIAF. That sounds truly abominable for my average IM use cases.
and can be read by a multitude of generic clients on most devices one can think of - even and especially devices that don't take a SIM card.
Telegram also works on the desktop and laptops (mac, windows, and Linux). Yes it is tied to a phone number, and yes, I agree that is stupid, but it is not limited to working with devices that have a sim card once the account is setup. That was one of the reasons I like it. I don't want to type on my phone, when im sitting in front of a dual screen with a fantastic keyboard; which
Re: (Score:2)
You can get a separate email, phone number, and phone for those things you know. There are reasons for a separate work phone, personal phon
Re: (Score:2)
You can get a separate email, phone number, and phone for those things you know.
Your suggestion is to pay twice as much per month, to create exactly one group partition? And my neighbors and extended family would still be on the 'personal' one... thanks. but no thanks.
And no, I can't create separate emails etc for each one unless they explicitly support it. If they tie to the phone number, or android or itunes account etc then I'm pretty much stuck. And creating a new itunes or android/play account for each app is all kinds of headaches of its own. You know what would be better than th
Re:Remember, the Walled Garden is for you safety (Score:4, Insightful)
So I just ran into this sort of issue with an app... its a simple app.
https://play.google.com/store/... [google.com]
It's a simple app... stick your phone on silent, and it pops up to ask you how long. The idea that you usually know how long your want your phone to be silent when you put it on silent, and often forget about afterwards.
It requests permission to "take videos and pictures"
WTF right? Why does it need that permission?
"15.3: Fix for interference with video recording apps. To detect when the camera is in use, camera permission is needed. This is optional in Android 6+, but if you don't give permission, Shush! can't tell that you're using the camera, and may pop up during video recording."
FFS ... seriously. And you see this sort of thing all the time. To 'play nice' with the phone and make sure it behaves nicely when you are on the phone, or taking a video, etc... the permission to determine simply whether you are using the camera or phone itself requires you to give the app permission to make calls and take videos. Those basic status APIs should be available without special permission or they should require a separate 'status permission' separate from the ability to make calls or take video.
How are we at version 6 of android, and you still need to give an app permission to take pictures and video just to give it permission to avoid irritating you while you are taking videos with a different app?
Re: (Score:2)
Re: (Score:2)
So long as the software is proprietary, technical users have no idea what the proprietary program is programmed to do (what it's capable of). And when that software is changed (patched or updated) programmers who can figure out what that program does have to re-learn what the program does.
I large improvement! (Score:4, Funny)
Previously Sarahah would max out the speaker volume and read my address book aloud while making snarky comments as it read each entry. I'm much happier now that it no longer comments on how often I've called my mother.
Give people anonymous ways to criticize each other (Score:3)
Joking aside, if you download an app and 'allow contacts' when it asks you, probably you should expect them to be grabbing your contacts and using them however they wish. The only surprise here is that people are surprised by this behavior.
Re: (Score:2)
Re: (Score:2)
The surprise here is that the data left the app unencrypted.
And I would have gotten away with it, too, if it wasn't for those pesky kids I hired for $5/hr to code my app not using a TLS certificate and strong trust validation!
Re: (Score:2)
Comment removed (Score:3)
I don't trust anyone. (Score:1)
Some apps I use on both Android and iOS - and some I don't. And it amazes me that the iOS version may need only access to the mic but the Android one needs access to contacts, camera, mic, location, photos, and everything else.
WTF?!
I will not down load such apps. Access to contacts is forbidden.
I don't care what the reason/excuse is. And you know what? I don't miss them in the slighest.
Android apps are the worst offenders.
Re: (Score:2)
It is the only thing VCs invest in... (Score:2, Interesting)
I was told that VCs will only invest in one of two things:
Apps that sling ads.
Apps that suck data in large quanitites.
This is why stuff like Meitu got so much funding and praise. The app did little to nothing except give a lot of data to its owners.
Similar with Sarahah. Some relatively shitty servers are up, and now some unknown people over in the Middle East now have a ton of connections of Americans and Europeans, as well as private, intimate things of their life. Perfect intel gathering for people who
That would explain it (Score:2)
I was wondering why the volume of spam was up dramatically.
Android has made this worse (Score:2)
Hit app? Why would anyone use this? (Score:2)
Seriously. An app that allows people to send you anonymous messages? I read their justification: to get candid feedback from coworkers and such. I suppose if that is something you welcome, then letting the app have access to your contacts so it would know who can send you messages, is expected.
But really, who would do this? If I know you, and you want to offer me candid feedback, do it.
Re: (Score:2)
Don't tell LinkedIn ... (Score:2)
Airbnb also (Score:2)
people are stupid (Score:1)
People are stupid.
Furthermore, Sarahah is not free software (which is claimed in the abstract).
Surprise surprise (Score:2)
Almost entirely just like Whatsapp, Facebook, Telegram, etc. etc. etc.
In fact, I do have something to hide: my contacts' privacy.
Is there any address book alternative out there that hides data to apps that request access and want to suck it, but makes contacts available to apps with a legitimate need?
Re: (Score:2)
How could it know which ones are legitimate or not? You already have to give permission to the app to read your address book.
Re: (Score:2)
You already have to give permission to the app to read your address book.
Would be better if you could give permission for it ("it" being probably through settings or ad-hoc permissions in you address book app) to only read certain addresses, or groups of addresses, and not even be aware that others exist.
IOS vs Android vs Blackberry 10 vs Symbian: perms (Score:1)
Today I use an early Symbian phone (Phillips
Re: IOS vs Android vs Blackberry 10 vs Symbian: pe (Score:1)
iOS hasn't worked that way in a long time.
Any open source alternative? (Score:2)
Are there any good open-source contacts and email apps for android that are reasonably good?
I am tired of turning off contacts access as a ritual after every other app install. I just want the OS level contact list to be empty or be a dummy list.
I want a phone app that maintains its own contacts internally... or a separate contacts app that can launch the phone. I really don't need the convenience of invoking contacts from third party apps and find their propensity to download my entire address book creepy.
Operating systems need more granular control (Score:2)
Either have users confirm every instance and be allowed to see what data is being accessed or allow the user to create separate contacts "wallets". I don't know the solution, but this is happening frequently enough that the OS needs to give the user more control than "yeah, have at my black book."
On iOS you can't even send a text without a user confirmation, but someone wants to dump your entire phonebook and that's OK???