Hacker News Reader

Comment by onphonenow | Hacker News Reader

The developer was scraping contact lists and using that to query third party servers. That is explicitly forbidden by google without permission from the user. He then repeatedly refused to fix the issue.

They should perm-ban folks like this who don't take user privacy concerns seriously.

Separately, it looks like he is using unsupported API calls potentially which are going to cause crashing problems - that may be a factor in their eval.

Having dealt with situations where user error / issues were 99 to 1 the source of problems, the majority for just a failure to read the instructions, whoever has to deal with this stuff on the google side has got to be annoyed at both these app devs and their social media followings.

View on HN

> He then repeatedly refused to fix the issue.

I'm not too sure if that is actually the case. I'm only going on what the developer has mentioned in the forum about it, specifically here : https://forum.xda-developers.com/t/app-5-0-fairemail-fully-f...

From his own words :

> The app most certainly doesn't upload any contact info, unless maybe your email address to login to the email server.

> but they don't provide any details about what the app presumably is doing wrong.

Where are you getting the info that it was scraping contact lists and sending it to 3rd party ?

He may not be intentionally “uploading” contact info, but the HTTP server could be configured to keep log of all the contacts email addresses.

Which HTTP server? the getFavicon method requests the favicon from each domain, so any one email provider only gets a single request for a favicon. It doesn't send all the contact info to any single server.

So reading the code, say you have in your contact

b@acme.com a@acme.com c@google.com

The code makes a single request to acme.com (to get the favicon) and one to support.google.com to get that favicon (there's a special case for google to avoid getting the new doodle of the day). That's it.

I don't really see how that's sharing contact details.

Yeah I read the runthrough here : https://news.ycombinator.com/item?id=31432334

It's a bit harsh, but I would have thought that the domain filtering would be done on device and favicon retrieval also on device. I must check the source code tbh.

An interesting case though.

It appears domain filtering and favicon retrieval are indeed done on the device, looking at the code. It also appears to be off by default, requiring a user to turn it on manually. It looks like this also excludes any mail in the junk folder (to preserve privacy even when someone turns this on, presumably)

I can't see how to do it in any more private way than this - it seems akin to a claim of "browser leaks details of requests to a third party", where said third party is the user's DNS server.

Can you provide a source for the contact list scraping?

I currently use FairEmail, so that's a concern for me, but I'd not heard that it was happening in this conversation so far.

It seems like this was an opt-in feature, that was off by default, that allowed users to have a domain's favicon shown alongside the message. It doesn't seem like any contact info was sent. Indeed, if you go to the effort of turning on favicon showing, it also seems pretty obvious and intuitive the app will retrieve the favicon. And the way it's done here seems to be more privacy preserving than having a central server do this (and see what you request).

This feels a bit to me like Google saying "web browser leaks details of your requests to a third party" - alarming, until you realise the third party is the DNS server, and that's how the internet works.

This has some details and a code link: https://news.ycombinator.com/item?id=31434975

Thank you!

It was getting the favicon for the domain name of the emails not sending the actual contact list to anyone so you're spreading misinformation by shortening this to "The developer was scraping contact lists and using that to query third party servers".

Also that's very different than "sending/sharing contact list data.", it's not, it's querying the domain names to get the favicons. So I get why the author wouldn't want to declare that he is doing that when he isn't.

To repeat what I said below, reading the code, say you have in your contact list:

b@acme.com a@acme.com c@google.com

No one gets the contact list, the most anyone gets is that your ip requested a favicon.

I took a look at code. This is an edge case.

He does use users contact lists without clear disclosure. He uses their contact list to retrieve DOMAIN favicons. That's better than systems retrieving gravatars or similar which I thought this was.

My guess is still technically a violation (using contact list to generate a bunch of HTTP requests). For some folks this could be sensitive maybe (if contact list has some onlyfans.com "friends" on it and your corp DNS / web tracking thing starts flagging it for the weekly report).

But not as bad as I feared. That said, the whole, I refuse to change x is going to fall flat with google who probably don't care about nuance that much.

Reply on news.ycombinator.com