Hacker News Reader

Comment by deft | Hacker News Reader

What happened: Twitter asks users on sign up to scan their contacts (read: steal and upload them). If you say no, twitter asks again and again every day / every login until you finally allow it to. Twitter builds a huge and unnecessary db of users and phone numbers, as well as non-users IDs tied to phone numbers. Someone uses an API to steal this info that in most cases twitter only collected by tricking their users / forcing it.

Anyone affected by this should be suing twitter for even collecting this information! My friend can give away my phone number because of this data collection.

View on HN

A trick I found to stop this nonsense is, at least on iOS, answer yes to the Application's custom dialog to ask permission. This will then invoke the iOS security dialog where you can click "No" and never be asked again.

Generally what I see happening is apps will ask the user if it's okay, and only when the user says yes will they execute the necessary system call to request access. In iOS at least, if a user clicks No the app can never prompt for that permission ever again. Until the app makes this formal request to the operating system, it does not show up under privacy (as the app had never asked for it in the first place).

What does Apple allow that for App Store apls? That's obvious circumvention of iOS's privacy control regime.

My post below is wrong, please move along. Keeping as-is, so the replies make sense. Thanks repliers!

The native prompts don't allow for app specific explanatory text to be presented. I haven't reviewed iOS guidelines, but Google provides guidance to inform users of why you're asking for permissions before you do it, and I would guess Apple would suggest the same as well. Pestering people for access once a day is probably not within the scope of the guidelines though.

Incorrect, iOS does allow explanatory text on the system prompt, in fact it’s required.

There is no good reason for Apple to allow apps to mask permission requests with their own dialogs, it’s just a case of not bothering to fix this loophole.

> The native prompts don't allow for app specific explanatory text to be presented

Not true. iOS apps can specify explanatory text to be included in the native prompt. In fact they are required to do this, since at least two years ago.

The NSContactsUsageDescription string (in the Info.plist file) is the place to specify this.

https://developer.apple.com/library/archive/documentation/Ge...

Why do people keep saying clearly wrong stuff. You sound like you know what you are talking about, but are 100% wrong.

Your friends/family probably won’t do this, so your phone number is going to be shared with Twitter anyways.

Well then the obvious solution is to start treating phone numbers as you would an email address - effectively public.

I would love a version of privacy.com for phone numbers..

> Well then the obvious solution is to start treating phone numbers as you would an email address - effectively public.

> I would love a version of privacy.com for phone numbers..

I've used google voice and twilio for something similar, though nowhere near as plug and play as a privacy.com-like solution.

Start? It wasn't that long ago that the phone company published a book with near everyone's phone number in it.

There was no book with everyone's phone number in it. There were many books that covered small regions. If you lived in Oshkosh Wisconsin and wanted the number for someone in Kansas City, or even Madison Wisconsin it wasn't that easy to get that book. Maybe your library had it. Phone numbers on paper aren't that useful. You can't robodial a paper phone book without hiring actual people. But no matter what you couldn't get millions of phone numbers while sitting on your couch, and if you could they would be useless because they were all on paper.

None of that let you treat your phone number as anything other than public.

I mean we realize this thread of argument has nothing to do with the point right?

A cell phone number does not equal your kitchen phone in terms of access to information. The whole this is moot. The issue now is that this is my personal phone number, me, personally, and is being used as a piece of validating information in a variety of compromises databases.

The books were hard to get, but directory assistance did exist if you called the operator.

I'll bet there are quite a few people on HN that have never dialed 411 or 1-<area-code>-555-1212.

This just isn’t true. Ever heard of the Haines Directory?

I used it at a summer job in the late 80’s. You could order reverse lookup books for anywhere you wanted, and of course could get that data electronically too. You could also call information for anywhere you could think of by dialing the area code plus 555-1212.

Never heard of it, but how much did it cost? How much did the reverse lookups cost? And even if you could get it electronically there was no way practical way to do much with them.

With the twitter leak millions of phone numbers/names are available for free instantly, and the technology to do some harm with them is readily available.

In my country it is voluntary to be listed in such a phonebook whereas with already a small number of friends the chances approach 100% that at least one of them has my contact info stolen by Twitter, FB, WA, etc. If i dont like this i would have to stop giving out numbers and not be reachable by sms/call.

You might find this interesting: https://phoneprivacy.co/

I have a friend of mine who flat out refuses to give email address or any contact info of the people I meet at his house. It has been a bit annoying one time or two.

Phone numbers used to be really public. As in "Someone has collected your phone number, your address and family name and put it in this huge book they update every year. And they drop a copy of this book on everybody's porch.".

This is completely correct behaviour if you ask me. So you met me at someone's house, so what, it gives you the right to contact me?

You could always ask your friend to relay a message right?

These people I have been seeing them at his house on numerous occasions, we are on a first name basis and open jokes.

It's not like I had glimpsed someone's shoulders and wanted to cold call them to pitch them my startup idea of the week or creepily ask for a date (I remember it was to follow through with a conversation about DIY hydroponic with one and coffee brewing with another). Friend got tired of relaying messages at some point :). We rarely got to the point of giving out contact information on the moment though (that was the flow of those meetings and I think it's not a cultural thing to exchange business card in such settings in my country). Also, we are not the kind of people to hang on facebook, so discovery is weak.

Totally agree it is correct behaviour with strangers though.

And it was only a minor annoyance at some point so well... no biggie. (Except that time he divorced and he wouldn't give me his ex-wife's number so I could get back some DVD she had borrowed)

edit: also, I wouldn't ask for contact info if I wasn't confident that it was okay for the person to get a call from me and I am confident that my friend knows I won't mess up things by being inappropriate.

Why not just ask the people directly for their contact information? Or vice versa ask your friend to ask them if it's okay to hand out your contact information?

I've had several friends ask if it's okay to give out my contact information to third parties who were interested in acquiring this information to continue conversations through more private channels.

But there was always an element of consent involved on my part.

I see where you are coming from. I just meant as a general rule it is better to not give out people’s information.

The message your friend could have relayed could have been “hey is it ok if I get your contact info?”.

What your friend isn’t getting right is that maybe you and his friends DO want to contact each other. He is deciding for both parties that they don’t. He could adjust his behaviour on that front a bit.

> I have a friend of mine who flat out refuses to give email address or any contact info of the people I meet at his house.

Is there a reason you do not ask those people for their contact information directly?

I get nuisance phone calls all the time, it is a lot more disruptive than nuisance emails.

I wish there was an easy way to effectively only allow white listed callers to call you directly (and the rest of the calls to go to voice mail). That's what I do with my email at least.

Unless you have no Twitter account.

That doesn't matter.

As long as one of your friends or relatives has and accepts to upload their contact list (with your number included).

Ideally, iOS would have an option to say "always deny Contacts access and never bring up a dialog again".

I don't share my contacts with any app, and I hate being asked again and again for every single new app. No means no.

Actually for most things in iOS, once the system dialog has been brought up, the operating system won't allow it to be brought up again. It won't stop the application in question from nagging you, but at least then even if you click "allow" on the application pop-up the system will still require you to go into the app permissions and explicitly allow it.

That's exactly what iOS does, the app is making a fake system popup to ask multiple times and only brings you the real system popup if you agreed to the first one.

this worked for me also.

Note this trick is also generalizable to apps/websites asking for notification permissions.

I've had apps ask me to go to system settings myself to enable some permissions because I've disabled it via the said OS prompt.

Similar to being asked "do you like this app?" If you say "Yes", you are directed to rate it, if "No", you are not.

>Anyone affected by this should be suing twitter for even collecting this information! My friend can give away my phone number because of this data collection.

Given the ramifications on leaking Name with phone number of people who didn't agree directly anything with Twitter and just had there contact details trawled by any of their friends signing up. Not good as with that, hijacking phone numbers has been done many ways and times, even the CEO of Twitter had that stunt pulled upon him. What with 2FA for many being a text message sent to your phone number. The ramifications of this could be bigger than they first appear and remember. They only found this, how long has this been open to such abuse. So anybody who had their phone number hijacked in X period of time, this `might` be a possible explanation in some of those instances.

Legally - no idea how this will pan out, but certainly not be the last we read about this.

You can also match phone numbers and Instagram accounts

> What with 2FA for many being a text message sent to your phone number

We should also sue companies who continue to use SMS as part of their 2FA system and/or for account recovery.

Apple could nip this in the bud: don’t allow apps to read a full contact list at all. Use a contact picker when needed.

This certainly would break plenty of valid use cases for a feature like this. More likely they ought to have policy in their developer docs to scope reasonable uses of the full contact list and start rejecting updates for applications that violate the new rule.

What's a valid use case for being able to read all contacts vs asking the user for a specific contact selection and choosing to approve sharing it?

Any application whose primary concern is something with contact lists. Maybe it offers a special view into it. Maybe special searches. Maybe a better management interface.

An alternate phone or texting app

I can't imagine it would be difficult to implement a "Select All Contacts" functionality, in addition to selecting individual contacts and/or selecting all then deselecting some. Automatically allowing access to future contacts also shouldn't be difficult. There is no need for apps to always have access to all contacts.

I’m not sure how that would be functionally different than the current situation. Instead, simply regulating how contacts are allowed to be used would remove the need to build a logically complex system, and since Apple already reviews every app submission it would just be one more thing for a reviewer to check.

How will apps like Whatsapp work then?

I use WhatsApp without allowing them access to my contacts. I have to just add people's numbers manually and I have to memorize who is who based on # and profile picture (thankfully the people I talk to with WhatsApp all have different area codes).

I don't use Facebook nor Instagram, and I only use WhatsApp for 3 Android users, the rest of the people I talk to I use iMessage.

Yes, you sound like a very typical whatsapp user, I can see how whatsapp could work fine without contacts access, since most users are like you. 3 total contacts, all with different area codes -- very typical, I don't know why whatsapp even asks for contact access, probably something nefarious.

> I use WhatsApp without allowing them access to my contacts.

That appears to be impossible for WhatsApp on Android. Someone wanted me to install it a bit ago, I refused to give it access to my contacts and it refused to do anything else until I did.

So I deleted it and we used Signal instead.

It is possible on Android, but if you do, you can't initiate any conversation - the remote party has to speak first.

We did try that and it supposedly claimed to the other party that I didn't have the app installed. Not that that would have been a scalable solution anyway, since then no pair of people could use it unless one of them gave it all their contacts.

Meanwhile the option remains available to use a different app that doesn't behave that way.

So why should iMessage get all of your contacts by default?

I made the choice for Apple to have my contacts by buying an iPhone. If I didn't want Apple to have my contacts (as I do not want Google or Facebook to have mine) I would have not bought an iPhone.

Apple doesn’t get all your contacts.

Your local Apple device has a messaging app (iMessage) that can see all the contacts on it.

iCloud puts contacts on Apple servers.

Personally, I made the choice for Apple NOT to have my contacts (by entirely disabling iCloud). The only company I accept handling my contacts is the one I paid (Fastmail).

I don't give WhatsApp access to my contacts. Few enough people in my life use it, and they all have different profile pictures.

I find it very weird to find, for example, my boss, or certain specific coworkers, on any social app. I don't want them to be able to find me either. This design decision of giving apps your entire contacts book by default has to die, and individual users need more choice instead.

Whatsapp has 1.5B MAU. I don't think people are interested in adding each and everyone manually. I want to know how that would work for majority of those people and not you personally.

> I don't think people are interested in adding each and everyone manually.

If they are interested, then they'll find a way.

That's great for you, but whatsapp is de facto standard messaging app in a lot of countries. Memorizing hundred numbers, or profile pictures (assuming that everyone has one) is just not feasible.

An app (such as whatsapp) getting access to all contacts is a valid use case, even though it doesn't apply to you.

No. When you want to chat with a new person, WA just needs the contact of that single person.

And sadly for him, it doesn't matter anyway, presumably most if not all his friends already uploaded their address books, so WhatsApp already knows his real name and phone number and network of friends...

> If you say no, twitter asks again and again every day / every login until you finally allow it to.

Any proof about this claim? I use Twitter on Android and web frequently and I only refuse such request once or twice.

Bottom line, it doesn't "ask again and again every day".

Consider yourself lucky, any account i create without a phone is immediately flagged\blocked and if i do use mine(personal), i get asked to add permissions like the parent said every single time.

Account associated with a phone number is totally different from "scan your contacts".

If you use the web client, they have a header that asks for your phone number repeatedly until you give it.

OP was talking about "Twitter asks to scan your contacts", not to add a phone number.

I've been using Twitter daily pretty much continuously since 2008 and I don't remember ever being prompted to upload contacts. I can believe it has happened at some point, but it certainly doesn't repeatedly ask me. I use the web interface and the first-party iOS app (though over the years I have also used various third-party apps on both iOS and macOS).

That's not the only way Twitter uses to collect phone numbers. It can arbitrarily block your account and require to confirm a phone number to unblock it (under excuse of "better security"). How disclosing your phone number helps being safer I don't understand.

Now those collected and leaked phone numbers will be available not only to Twitter and US government but to anyone wishing to buy them from hackers.

>Anyone affected by this should be suing twitter for even collecting this information! My friend can give away my phone number because of this data collection.

If you made some agreement as to how your friend could use your phone number and 'sharing with Twitter' is a violation then you could sue them I suppose. Annoying as this data collection is, labeling information about you as only yours is incorrect, it's your friends and Twitters's (and Google/FB/AMZ/etc.) information too.

Twitter should be seen as an asylum if you ask me. But yes, if they leaked numbers from third parties not involved in Twitter at all, there should be severe legal consequences.

But I doubt there is much incentive to even create a legislative basis for such transgressions. Complicated topic to be fair, but we will only see improvements if there are severe penalties for "loosing" data. Since no system is safe, there is only the alternative left not to collect info you do not need.

It's for this reason that I use PWAs wherever possible. Right now I'm using it for Twitter and Uber. Tired of turning off permissions and then having to do it again when apps auto-update and restore the original permissions.

> Twitter asks users on sign up to scan their contacts

To be clear, this applies to the Twitter app for iOS and Android, correct?

I exclusively use the Twitter web interface (even on my Android phone) and I have never been asked this.

I just quit when they finally said I had to to log in.

In some countries (including mine), all sim cards/phone numbers are registered to an individual, so this is a pretty big deal.

Twitter has never asked to access my contacts before. Where are you seeing this?

I think they’re selecting target demographic to do this, because for e.g. Japanese it means having Twitter account associated with their real names means they’ll be laughed at from everyone close to(maybe 25% literal) death. Same for follow suggestions based on IP.

Yes, totally. Thieving from a thief logic applies here.

Quick & dirty fix: never use built-in/default apps for storing contacts list on your devices.

Reply on news.ycombinator.com