“We are only collecting the list of applications you have installed.” | Hacker News Reader

“We are only collecting the list of applications you have installed.”

support.twitter.com

349 pointssome1else159 comments

> If you’re not interested in a tailored experience you can adjust your preferences at any time

I don't mean to nitpick language, but does this sound incredibly condescending to anyone else? They might as well have written "If you're a paranoid loser I guess you can have the shitty experience where we don't try to ham-fistedly guess at your interests"

The funny thing is I think if they just didn't speak in idiotic PR-speak people probably wouldn't care. Sometimes I'm more annoyed that companies aren't just direct. The direct case isn't even that bad: "Hey, so we have to sell ads to make our business work and feed our families. It's better for you and the advertiser if we can try to give you ads that you might like so we can waste less of your time and the advertisers bandwidth. There's nothing in it for us to mess with your important private info, and a world of legal and PR downside. We're just asking to take a peek at your interests so we can guess at what you might like."

You'd still be justified in saying "nope", but at least you'd feel like you were treated like not an idiot.

It sounds like pretty typical obfuscatory doublespeak to me. "tailored" really means "targeted" and "experience" is a word used so often that it has lost almost all meaning.

The other words that evoke an almost visceral reaction of disgust for me are "offers" and "deals".

It's a disruptive synergistic cloud experience!

You mean it's a disruptive synergistic cloud experience offer!

There seems to be some kind of institutional mental illness that forces corps to think of users as exploitable prey who can be herded down a value-extracting marketing funnel, and not as people who want a service.

It's disturbingly common, IME.

I have alway thought "converting users to our brand" sounds suspiciously like "converting people to our religion/cult" just say you want loyal customers, not "devoted followers."

You mean a 'transformative' disruptive synergistic cloud experience offer?

They also avoid to say that this doesn't stop collection of the app lists, but just the "tailoring". They still snoop and you can't stop it.

Every time I see stuff like this, it reminds me of Betsy Haibel's article, "The Fantasy and Abuse of the Manipulable User: When mistreating users becomes competitive advantage."[1]. Once I started to see how much a lot of current tech tries to softly coerce us without our consent, it's been hard to unsee and hard to be okay with it.

[1] https://modelviewculture.com/pieces/the-fantasy-and-abuse-of...

100% agree, but I can't help but make note: if a company the size of Twitter ever had the audacity to talk about "feeding families" I would go ballistic.

Who is your family---the entire state of Nevada? If your family is eating that much, you don't need targeted ads but a doctor.

Twitter just wants to maximize profits. Fine, but if you're gonna be honest: be honest.

Exactly, this kind plain speaking talk works well with tiny startups, but it becomes blatant manipulation when written by a marketing department

Apple should ban the app for this, right?

http://danielamitay.com/blog/2015/5/29/shutting-down-a-500mm...

Unlikely considering they work closely with Apple on integration with Twitter. Double standard sure but I doubt Apple cares.

Apple's integration is independent of the Twitter app, though.

They are "too big to ban".

It's sad how true that is. Reminds me of the early days when Apple would ban all "sexy" apps, except Playboy and such.

Playboy has good articles...

If Apple applied their rules evenly across publishers, they would.

I hope so!

Is there an API in iOS to get information about other apps? How is Twitter doing it? I thought all apps were 'sandboxed' in iOS.

Apps can register custom URL schemes to enable other apps to open them, pass them data and even deep-link to within them. There is an official API called canOpenUrl: which will let you check if a particular URL scheme is registered on a particular device. So that, along with a database of public URL schemes published by other apps, lets you detect which apps are installed.

I wasn't aware of this before but apparently you can also use sysctl() to check the names of running processes (which is less reliable as processes will get bumped off if the foreground app requires more memory).

More here: http://danielamitay.com/blog/2011/2/16/how-to-detect-install...

There is also private API that is not very difficult to hide, which gives you all the installed app bundle identifiers.

How would you hide calls to private APIs?

Hardcode the address on all known platforms and skip it on unknown ones, or disassemble a public function that calls it and figure out the address from there, or read the Mach-O headers and write your own dlsym, etc. etc.

Apple once blocked a updates for everyone using a common SDK because it had named a symbol something that happened to be the name of an unrelated private API, and the review process couldn't tell the difference. That implies things about the rigor of the review process.

Apparently Apple has closed the "canOpenURL" loophole: https://www.ihasapp.com/

You can

1.) Scan for custom URL schemes the applications register so you can open them from other apps or web URLs. 2.) Retrieve a list of currently running processes in the background

Apparently Apple will shut you down if you overuse the canOpenUrl method: https://www.ihasapp.com/

Raise your hand if you feel like this is an unwarranted breach of privacy, but you have a gmail account and heavily depend on Google services.

<ashamed>Raises own hand.</ashamed>

I was so trusting and willing to give away my emails to Google when I was a kid (despite being fully aware of their intentions), but now, even though privacy infringements from all these other companies disturb me, I'm still a hypocritical sheep in Google's herd.

Time to make some pretty heavy changes...

It takes planning and plenty of work, but I have almost completed migration to my own domain and away from gmail. I wish I had done it sooner, everyone needs to make their own place on the net. No need to be a serf.

Are you hosting your own email server?

and if you are rolling your own are you having any issues with spf or spam flags?

I run my own email server [1] using Postfix. I use greylisting [2][3] and it easily stops 50% of all spam. I looked into adding SPF, but decided against it as the effective rate was too low [4]. I've also recently looked at RBL [5] and while there were a few false positives (enough that I decided against immediately adding it) what it did catch was quite impressive [6].

Oddly enough, if I simply drop email addressed to my domain registration email [7] that is NOT from my registrar, then the amount of spam I receive would drop about 70%.

But frankly, with the greylisting, the spam that does get through is easy enough to deal with. And I'm the only person who uses my domain for email.

[1] I started in the web hosting business in '96 or '97 so this is pretty much old hat for me.

[2] Definition: http://projects.puremagic.com/greylisting/

[3] Software I use: http://www.x-grey.com/

[4] http://boston.conman.org/2015/04/12.1

[5] http://en.wikipedia.org/wiki/DNSBL

[6] http://boston.conman.org/2015/05/11.1

[7] Yeah, I don't bother with the privacy settings on the domain registration.

I think ironsides was referring to sending email, not receiving it. Sending email from a mail server without a good reputation can often land your email in spam filters these days.

It's all very well saying that the amount of spam you get is manageable, but that doesn't really matter if your own outgoing email becomes unreliable because you aren't using a recognised provider.

Jim, what can we do to increase the odds of our email reaching the intended destination on self-hosted domains?

I'm not Jim, but what I've done is:

1) have a valid PTR record for the email server.

2) Set up SPF records.

3) Just run email on it. If you do run a webserver on the same server, DON'T RUN PHP! In my experience [1] the single most abused attack vector on webservers is PHP and about 60% of the time it's abused to install spam sending software on the server and that leads to the IP address getting marked as a spammer.

[1] About fifteen years in web-hosting.

This is sadly true. With just greylisting, spam isn't much of a problem. I get some spam, most of it to an address leaked from the adobe-hack (I don't drop mail to it, I just keep the few spam emails that get through greylisting, for possible future use for training a bayesian spam filter), and some sent to my publicly registered company email (mandated by law in Norway).

It's unfortunately pretty hard to tell the difference between people being slow to reply to mails to gmail addresses, and google flagging your mail as spam for no discernibly good reason.

Anecdotally they don't care about anyone other than gmail users, so there's not much to do about it other than a) give up on the idea that gmail interops with standard email, b) hope that more people move away from gmail, or c) just tell people that you don't care that your email is filtered as spam because they're using an email provider (gmail) that doesn't deal well with email.

That's not much of a concern for me. My email server also handles outgoing email as well. I'm fortunate in that I've been running my own server on that domain since 1998. And on the current IP address for probably a decade by now.

Over the years, there have been only two domains where my email had issues being delivered: AOL [1] and Google mail. For AOL, I had to inform AOL that I was responsible for the IP address of my server and promise not to send spam and that I take care of any spams from my IP address, etc. Annoying, but once done, no issues. Google on the other hand ...

I've had a few times where my email was being dropped by Google mail. Annoying, but the issues did seem to clear up on its own after time. I do have a gmail account [2] that I use for testing when I think there are issues but I don't recall the last time I had one. But I have had them.

[1] My dad is still on AOL.

[2] Google's spam catching ability isn't 100% either. I don't use gmail at all for email, so anything I get there is either 1) a mistake because someone is trying to email a person with my name at gmail or 2) spam. It's mostly spam [3]

[3] I just checked my gmail account. 140 new messages since I last cleaned it out in mid-October. All spam. Way to go, Google! (but to be fair, it shunted 726 messages to the spam folder).

I run my email server (it actually does not provide any extra privacy, as it's on a linode), and 99% of the time, no, I don't have problems with spf and spam flags. (In fact, spf is great, I don't get the blame of sending spam anymore since I've set it.)

There's an odd email server here and there that suspects anything that isn't gmail, there was even a mail server once that required me to prove I exist, but those are very few, and normally single user installations.

The secret is that besides not sending spam, you must receive email. If you don't get enough email, other servers start suspecting you. And, of course, there are configuration problems - since I'm writing my own mail server, I get a few of them, but even on standard software you have to make sure you set it correctly.

For most people it is just search and email. Replacing email is easy, but search is harder since only Google has really accurate and relevant results( besides other giants that also snoop ). The best way to replace search is to use engines that respect privacy and if you need relevant results, those that convey Google's results to you.

Use https://search.disconnect.me/ .

You can use Bing, DuckDuckgo, Google or Yahoo as the search engine. "We don’t collect any of your personal info, including your IP address, other than information you voluntarily provide." See https://disconnect.me/privacy .

If too many people use this site, Google (and probably others too) will ban the IP.

I doubt it. Even if Google can't use the data they're getting from searches done via that service to target ads to specific people, they're still getting valuable data on what people search for generally.

Replacing email should be easy, but a surprising number of people, even tech people (which makes no sense at all as they should know better), not only use Gmail for their email storage but also for their email address, and so can never entirely extricate themselves from Gmail.

Search is the easier: DDG. I've been using it all-but-exclusively for nearly three years solid (and another couple on-and-off before). I do still make use of some Google special collections (Scholar, Books), and for time-bound searches (really wish DDG would support those).

Email took me a while longer to sort, but while I have a primary personal account somewhere safe, anonymous / pseudonymous accounts were harder to provision. Yahoo and Microsoft both throw barriers (phone confirmation required) in the way. I ended up with an inbox.com account, like that.

The main feature I'm missing from DDG is the ability to filter results by date. I end up going to google often without it.

DDG is the fastest of all the privacy-respecting engines, but it consistently gives me the least accurate results. It works if you search for mainstream keywords, otherwise it mostly doesn't.

Google's strength lies in (and always has been in) the tail and ambiguous queries. Everyone can get the query "facebook" right; try the query "how to disassemble tile" on Google[1] and Yahoo[2] or Bing[3]. Google knows the difference between "tile" (the gadget) and "tiles".

[1] https://www.google.com/#safe=off&q=how+to+disassemble+tile

[2] https://search.yahoo.com/search?p=how+to+disassemble+tile&fr...

[3] http://www.bing.com/search?q=how+to+disassemble+tile

Interesting example. The results for ddg improve dramatically if you add "tracker" ("tile tracker"). I'm not sure I'd consider Google's default results better -- but then I don't own a "Tile". I do get that inferring that the connection "disasemble tile" implies something other than ceramic tiles (as opposed to "repair tile" -- here ddg and google are very similar for "repair tile" and "repair tile tracker" -- although none seem to give a result for software/a device to track progress of repairing ceramic tiles...).

I use it for all manner of searches. Knowing how to tune a search appropriately helps. Tossing in an additional keyword, or a set of associations can help:

    (phrase one| phrase two|phrase three)

Using bang syntax is also quite useful.

In my experience, where a DDG search doesn't turn up good results, an SP or Google search (both bang-searchable) are generally not much better. I'll revise my terms at that point.

Again, date-range is the notable exception, and it's not a minor issue.

I really like using https://swisscows.ch their search results are quite good and they respect my privacy.

EDIT: https://swisscows.ch/agreement

I've been using qwant with pretty good results lately.

Still a bit hit and miss but getting better every day.

For me it's waaay more than just that. Email, search, stock Android, DNS, browser, texts, phone calls, GPS, calendar, tasks, file storage, music, stocks, and certainly more that I'm forgetting.

The most absurd bit is that, since I use stock Android, Google knows exactly what I've installed and even monitored my behavior while using their app store, and yet I get so irked by Twitter getting a list too. It's like I've completely forgotten that I've already thrown away my privacy.

You can always start collecting it back.

> despite being fully aware of their intentions

Those being....? Google earns its revenue by selling ads. They make more money when they show you ads that are likely to earn your business for the advertiser. Is it really so horrendous for Google to use information about you to show you ads for products you are more likely to purchase? Or are you concerned about something else?

Their stated goal is to "organize the world's information" but notice there's never a qualifier of the world's public information.

While they've been able to determine a ton of information about social circles from interactions (gmail, voice, gchat, hangouts), the real understanding comes from G+ where we've categorized our contacts.

Odds are you have circles that represent locations, employers, family, friends, clubs, etc. By analyzing those groupings, they can determine the relationships that aren't obvious just from the interactions.

Now, combine that with the previous information and they know when you're talking with someone from HR from another company and how closely that company is linked to yours via shared/common circles. Sounds like a opportunity to sell an ad for 401k rollovers. :)

That was my though exactly when I started, but I've realized that Google gains a greater power than showing tailored ads. Google remembers who I was better than I do, knows everything that I do today, and can probably guess who I will become. They have the power to shape the information I see and influence me to do things that will drive their bottom line with unparalleled precision.

We're really giving Google the power to read our minds: are you comfortable with that?

Aside from that, I'm vaguely concerned about keeping everything about me so centralized. There's too much to lose too easily if someone manages to hack me despite the 2FA and insane passwords.

I'm a little biased because I currently work at Google (not on anything related to ads or user data).

Still, I am comfortable with giving Google enough information to understand and predict my behavior. The more I learn about the company from the inside, the more I trust them to do the right thing with my personal information to prioritize my quality of life over their bottom line. My perception is that Google genuinely believes that if they create high quality products that improve their user's lives, the revenue will follow.

As for centralization, I agree that it is good to diversify for robustness and security. Still I trust Google's security measures more than I would trust my own if I were to set up email servers myself. Plus now that Google properties have U2F support and Chrome autogenerates passwords, I don't mind putting all my security eggs in the Google basket.

I have around 10 gmail accounts, each of which only receives random junk from various sites and mailing lists. I create compressed, encrypted archives that contain only random data, and use them to fill my "drive".

Google is welcome to analyze as much of that as they want.

That behaviour is damaging. What is your reasoning and justification for it?

Why is it damaging?

Because it upsets people like you.

It's also the way I personally choose to protest the corporate and government surveillance state we're living in.

It actually isn't. Sometimes data has too much purity. Noise can actually help.

db poisoning can help, but just having an account (10 is even worse) inflates their numbers and strengthens the perception that people should use gmail.

A long time ago, before the PC, market share perceptions lead to the idea that "Nobody got fired for buying IBM". It was a very effective trump card a salesman could use with managers to scare them away from the competition. In the PC era, "Nobody got fired for buying Microsoft" was abused in the same way.

This is really just a consequence of Metcalfe's Law-style network effects, which is why it is usually a bad idea to use anything that is known to be a problem; even if you use it maliciously, just the fact that someone gets to legitimately claims they have a larger clientèle becomes an additional barrier in the path of any competitor.

Is there one program which can create such archives? Or do I need one for generating, one for encryption and one for compression?

That's just slacktivism.

Google is quite capable of detecting and ignoring chaff, and they wouldn't be giving away free space if they couldn't afford to host a small number of people doing stuff like you're doing.

Further, if you think that behavior doesn't contain any data about you, you're wrong. They can extrapolate from that behavior that you're interested in privacy and have some technical understanding of the problems with corporate surveillance. You've almost certainly received targeted ads for computer products, particularly stuff like Lenovo or Yubikeys, which are popular in security-conscious crowds. You may have ad-blocked these ads, but you've probably been tracked anyway, even if you used something to block trackers.

Right now you're totally ineffectual. If you want to actually do something, you should write your senators and stop using Google products entirely.

You make many assumptions.

That's not a very convincing counterargument if you don't say what assumptions you think I'm making.

I've never been able to understand why anyone with a clue uses Gmail. I just have all my devices sync to an IMAP server provided by an ISP. Android phones have a perfectly good IMAP client. No ads, reasonably good spam filtering, and reasonably good search capability.

To me that's even worse. You are stuck with your ISP. What if you move home to a place where this ISP isn't available?

There are commercial email providers in jurisdictions that do respect privacy. And it usually only costs the price of a couple of coffees per year.

You're not locked in if you own the DNS registration.

You're still depending on the ISP's archives.

Building your own Postfix server isn't hard. (It's certainly not easy, but it's not too hard either.)

If you're paying someone for hosting anyway it's a few days of extra work from a cold start to set up a server on Linode or Digital Ocean and become your own ISP/hosting co.

Remember that Digital Oceans’ ToS allow them to access "all and any information" in case they "consider it necessary".

This is an important point many overlook (despite being aware of Google Apps for Work (nee Business)) -- registering a personal domain in order to have at least one email that will follow you for as long as you want -- does not mean you have to run your own incomming/outgoing email servers!

Most domain registrars will forward email for free, and most offer some form of cheap, but reasonable email service (smtp+imap).

Right. I have several domains, and my email comes in via them. The IMAP server just aggregates them.

Sorry, I don't understand your reasoning.

Why do you trust your ISP more than Google? ISPs have much more shady practices and are able to match your online and real persona with 100% accuracy.

If you care about privacy, why do you use Android(non-cyanogen I assume)?

Theoretically the ISP is being paid for providing the service, while Google ... well...

The implicit suggestion that one stops "being the product"[0] if one is paying for the service has no roots in reality.

[0] This oversimplification has to die.

Note that he could be living in a jurisdiction where the law provides better protection for electronic communications (email being one of them), thus preventing his ISP from reading/analyzing/reselling his emails.

Which jurisdiction would you trust in this matter?

For all the problems we've manage to create, I'll trust Norwegian provider Telenor much more than I do Google. If only because they share my jurisdiction (Norway) -- where I have rights. I have no rights in the US -- at least when I'm not physically there.

>>Why do you trust your ISP more than Google?

Presumably because the ISP doesn't generate the vast majority of its revenue from targeted ads based on information it collects from them.

All this talk of 'having a clue' - where exactly in my daily list of conflicting and competing daily priorities should I put "Worry about Google profiling me via my email content"?

Advertising aside, I also understand there's a valid argument that we should all use strong encryption and secure email to give (those of us that need it) the benefits of herd immunity against government snooping. However - once again it's a not terribly high up my list of things to worry about right now. That makes me a slightly worse person on par with not recycling enough and leaving my electronic devices on standby overnight.

I willingly - and I hope knowingly - accept the trade-offs in using GMail. At least 3 people in this thread think I'm lacking in clue. Can someone please explain to me why?

> > What is Twitter using my app graph for?

> Twitter is using your app graph to help build a more tailored experience for you on Twitter.

No thanks.

> Some examples of how we may use your graph data include:

> - Improved “who to follow” suggestions that share similar interests

No.

> - Adding Tweets, accounts, or other content to your timeline that we think you'll find especially interesting

Good lord, no.

> - Showing you more relevant promoted content.

Please, no.

Amazing they're doing all this trying to make their service "better," yet they continuously show me a feed of content I resent.

They didn't say it was better for you.

They're likely making it better for their customers. (Hint: if you're not paying them, you are not the customer).

There's a big difference between a user and a customer. Users are the raw materials used to make the product that gets delivered to customers.

I've noticed this with other services, apparently it's difficult to distinguish between "love thing X so much you share it" and "hate thing X so much you complain about it"

A lot of people seem to enjoy complaining. If you like posting this kind of thing to your friends, what's the difference?

> they continuously show me a feed of content I resent.

Then why do you use Twitter at all?

To be clear, I don't hate the content I choose to view from the people I follow, I hate the content that Twitter provides for advertising. There was a weird time when Twitter was actually showing me relevant ads - about computer stuff, startups (close enough). Now the ads are all random.

Maybe they'd do a better job if they knew what asps you have installed? /s

Allow me to translate:

> Twitter is using your app graph to help build a more tailored experience for you on Twitter.

The more we can prove to advertisers we deliver targetted content, the more they will pay us.

> Improved “who to follow” suggestions that share similar interests

We will continue to suggest you to follow people who paid us but they are more likely to actually be remotely interesting to you (no promise, though).

> Adding Tweets, accounts, or other content to your timeline that we think you'll find especially interesting

See first item.

> Showing you more relevant promoted content.

See first item.

Why is it called a graph? Isn't it just a plain list?

A sneaky attempt at making the idea more digestible by associating it with 'social graph', for which we are already used giving access to.

Please leave a comment on the app store. That is the only way these companies will learn to not snoop on their users:

iOS - https://itunes.apple.com/us/app/twitter/id333903271?mt=8

Android - https://play.google.com/store/apps/details?id=com.twitter.an...

I wonder if the Twitter app will also be removed from the Apple Store due to using "public APIs in a manner nor prescribed by Apple." Hint: it won't.

Apple may not remove it, they'll just refuse updates.

We've designed app graph to exclude apps that appear to be especially sensitive, such as ones dealing with your health, sexual orientation, or religious beliefs.

I was alarmed until I read this. It is really nice of them to choose to keep our sensitive private information private. Thanks Twitter!

( Of course I completely trust Twitter to make the right decision on which apps are considered sensitive. )

The sarcasm is strong in this one. Hopefully.

I feel sorry for the apps that are trying hard to fit in and "appear" unsensitive. They probably still get snooped. That must really hurt their feelings.

Use MyFitnessPal

get spammed with weight loss products

The majority of Twitter's revenue comes from mobile ads, and app install ads are a major component of that major component. Knowing what apps you do or don't have installed allows them to better target app install ads, and I imagine that's the reason for collecting this data.

So, if you don't have Clash of Clans installed, they can show you a Clash of Clans ad. If do you have Clash of Clans installed, they can then prompt you to reengage with it, or suggest other apps you're likely to install on the basis of your having shown an interest in games.

Ironically, currently a few entries away from this article on HN, there's this one [1] about iHasApp that has shut down due to "using public APIs in a manner not prescribed by Apple".

[1] https://news.ycombinator.com/item?id=9625916

That article links to this Twitter support page, which is undoubtedly why someone submitted this to HN.

This is such bullshit. I refuse to use any app that does this kind of snooping. Twitter ought to be ashamed of itself.

Simply put: if you have to setup a help page like this, you probably shouldn't have added such feature first place.

That sounds rather scummy. Any time you are collecting information unrelated to your own application is inexcusable.

I do not trust Twitter to do the right thing with the special level of trust Apple has granted them.

I agree. And I should have the option to refuse by removing app permissions.

btdollar it appears you've been hell banned.

I really think this is a cruel waste of peoples time, and HN should strongly reconsider this method of moderation.

EDIT: Down votes for telling someone they are hell banned? Pathetic.

I didn't down vote, but it might be because it doesn't appear that btdollar is hell banned. I though hell ban = all their comments are dead, but it's plausible that his [dead] comments were just down voted.

How would you know if someone else is hellbanned?

Just removed the Twitter app... Sorry Twitter but no thank you.

Notice how they casually slip in "..and occasionally updating". This means that Twitter now has a nice list of all apps on your Mobile via the malicious Twitter app that snoops on your phone. They get to then sell this info to advertisers so that they can tailor their "tweets" to you.

And Twitter is a relatively good citizen as far as apps go. Just imagine what other apps who don't care where their next buck comes from are capable of...truly scary stuff.

The worse problem is that even if you do research on the developers and owners of an app before allowing a permission that warrants a lot of trust, they can at any time be sold to a scummy company or data-mining agency who exploits the trusting user-base. This is exactly what happened to SourceForge.

"App graph". Something about that phrase makes it sound even sneakier, like an innocuous technical thing that has nothing to do with people. Nothing to see here. Just an app graph.

I think I will build a social network where your profile pic is a split screen of your headshot and your exposed genitals. You will use your real name, home address, and cell phone number, and frequently upload your credit card statements.

This way, we can all just get it over with already.

Hah! That cracked me up

So basically just a frontend to Experian?

Yeah..how is it a graph? Isn't it just an unordered list of data points?

"You can opt out any time...three stages deep in the settings." What a cop out.

That's provided because 99% will never even know it's there. It doesn't matter if it's technically an option.

When your product is used by millions of people and updates automatically, the defaults matter.

Not only that, I followed the instructions (on iOS) and there is no "Tailor Twitter based on my apps", only "Tailor ads based on info from ad partners".

Twitter really is a terrible: Refer to first comment in link below. In the name of providing open source tools to Developers, They are collecting Contact lists of app users that has their SDK's: http://www.reddit.com/r/androiddev/comments/37hx7y/twitter_j...

"We will notify you about this feature being turned on for your account by showing a prompt letting you know that to help tailor your experience, Twitter uses the apps on your device. Until you see this prompt, this setting is turned off and we are not collecting a list of your apps. If you do not see Tailor Twitter based on my apps in your account settings, app graph collection is not occurring for your account."

This should be opt-in not opt-out.

This is how they do it: https://github.com/danielamitay/iHasApp

The read me explains that Apple does not approve of this.

Twitter should back off on this. The goodwill lost is not worth what they are getting here.

Upon reading this, this is the first thing that came to my mind: https://i.imgur.com/WiOMq.jpg

Now, how do we get people to pay for the services they use? Is that even desirable for us, the consumers?

Why do iOS and Android give apps this data in the first place? Mobile apps will invariably abuse any trust granted to them, so platforms should just stop granting any more trust than necessary.

They don't explicitly provide it. Twitter uses a form of IPC built into iOS (canOpenUrl) to find out by brute force whether or not well known apps are installed.

In other words if you just submitted mynewobscureapp to the AppStore, Twitter would not be able to detect it until they added your app to their targeted list.

Sounds like the technique that uses CSS to "brute force" your browser history. http://davidwalsh.name/jquery-spyjax

They don't explicitly give it. You can define your own URL schemes, e.g. hackernews://, and the OS will tell you if a handler for that URL scheme is installed.

I hate how this is opt-out instead of opt-in.

I can see why they want to do this but it just feels kind of icky or something.

One more reason I'm glad I don't use the official Twitter app. I highly recommend Twidere.

It's been said, but really, it should be opt-in rather than opt-out. If you really need this, just ask. If I'm feeling particularly nice that day, I might even allow it, but when I discover their mischief after they've done it, there's no way I'll be okay with it.

If there's one good thing, they remove the data they've collected from you if you opt-out. (But it'll be already fed to the machine learning system, I guess.)

I removed Twitter and Facebook from my phone because I found them too distracting. Not having them snoop on what else is on my phone is just a bonus.

to be fair the web apps work well. I did the same on my mobile, no more snooping. But i had to root my phone to remove Twitter and Facebook so everybody can't do that.

And while making the UX of their Android app shittier and shittier, they block popular 3rd party clients. This time on the shitlist: tweecha (https://twitter.com/tweecha_en).

Seriously, I like Twitter but the way they keep degrading the user experience, it's no wonder people leave en masse.

Ugh! It's such a shame companies like Twitter do this shit. I'll admit, twitter and facebook provide useful services, they really do, but it's all this sneaky invasive stuff that makes me hate it all. I know you have to make money, but this kind of behavior is going to be their downfall.

I am using the latest iOS version and the setting to disable this is nowhere to find. This is fucked up.

It's hilarious how these guys have spent billions looking for the lost city of targeted advertising and all they've done is invent new ways of scaring away customers.

How about telling us what's on sale at nearby grocery or hardware stores?

Only? I don't want Twitter to collect a list of applications I have installed. That is none of their business, massively violates my privacy, is an illegal practice in many countries, and constitutes a unique fingerprint.

Ihasapp (2011): https://github.com/danielamitay/iHasApp/blob/master/README.m...

Discussion here: https://news.ycombinator.com/item?id=8671080

Fun fact: Lots of major analytics SDKs read out your app list in this way (Android is even simpler). Your app list is already known to lots of 3rd parties if you have downloaded any of about 80% of the top 100 apps in the last 4 years.

Questions about using an older version. I no longer update my mobile apps. Twitter state:

"On versions of Twitter for iOS before 6.19.1, the Tailor Twitter based on my apps setting may not display correctly. If you are impacted by this issue, please upgrade to the latest version of Twitter for iOS."

Does this mean that it is disabled for those old versions? Does it mean that they will do it but users will not be able to disable it? Does it imply that the old apps are already sending this data to them? Or is it a ploy to get people to upgrade, and not upgrading could also be a way to remain more private?

Well that took about 2 seconds to delete..

How does Twitter actually do this on iOS? Is it only apps that use Twitter logins? Are they using canOpenURL (I kind of doubt it)? sysctl()?

Hehe, well yeah... thanks but no thanks. I mean at least they are honest about it, but when this option exists within the app, doesn't mean that they are not using it. Maybe they are just not giving you your "tailored" information but are still grifting your data.

I would say it's safe to assume many, many apps do this. For anyone looking to tailor ads/recommendations to their users, the opportunity to peek at all the apps you have installed is too tempting to resist.

My solution is to install as few apps as possible. Go to mobile website, from browser menu select "Add to Home Screen". I get fewer features that way but fewer distractions.

> I get fewer features that way but fewer distractions.

Not necessarily. I use the Facebook web app because I'm not crippled from using Messenger as I am on their main app. Who needs the notifications anyway?

And seriously, why does Facebook need to be a >30 MB download? It's just a frontend pulling from an API.

Stick this in 140 characters: "Twitter has and always will suck, as a service and as a corporation".

The medium is ridiculous, I really see it as the dumbing down of our society.

Just out of curiosity, is there even something else in the "other" part of the Twitter client's settings, or is that just a typical obfuscation?

Geee thanks twitter ... you can learn nothing for me from the fact that I have grindr installed /sarcasm

I see a lot of (rightfully) upset comments but this doesn't really come as a surprise to me given that Twitter (and others like FB, GOOG, ad networks) already track websites you visit.

I know there are ways of blocking that but I would have a hard time believing that many (outside of HN readers) block that type of tracking.

stopped using their native app few months ago , hope they won't remove their mobile web app . even if they do I will just spend more time on hacker news !

What the F* is wrong these big money makers?

Android user? Just go to settings > applications and count how many times 'Google' appears in there. Twitter is a small child

What the fuck? Is it April Fools?

It amazes me that people are still dumb enough to install apps from any of the social networks.

If the app checked what other apps were installed and used that data locally, no big deal. Calling home with private user data is evil.

I'm trying to think of a scenario wherein an app would wholesale collect all other installed apps for local use. Querying for specific capability via the existence of an app or URL handler, maybe. But iterating all installed apps?

Tasker (for Android) does, to let you choose one to launch automatically when something happens. But apart from automation and possibly "personal analytics", I don't remember any other use case.

Reply on news.ycombinator.com