News for hackers. Stuff that matters.
Re:Twitter says an attacker used its API to match usernames ... by amluto on Wednesday February 05, 2020 @04:10PM (#22251020)
Apple could nip this in the bud: don’t allow apps to read a full contact list at all. Use a contact picker when needed.
Re:Twitter says an attacker used its API to match usernames ... by twodave on Wednesday February 05, 2020 @04:47PM (#22251311)
This certainly would break plenty of valid use cases for a feature like this. More likely they ought to have policy in their developer docs to scope reasonable uses of the full contact list and start rejecting updates for applications that violate the new rule.
Re:Twitter says an attacker used its API to match usernames ... by rhacker on Wednesday February 05, 2020 @06:02PM (#22251819)
What's a valid use case for being able to read all contacts vs asking the user for a specific contact selection and choosing to approve sharing it?
Re:Twitter says an attacker used its API to match usernames ... by bcrosby95 on Wednesday February 05, 2020 @06:52PM (#22252122)
Any application whose primary concern is something with contact lists. Maybe it offers a special view into it. Maybe special searches. Maybe a better management interface.
Re:Twitter says an attacker used its API to match usernames ... by np_tedious on Wednesday February 05, 2020 @09:35PM (#22252984)
An alternate phone or texting app
Re:Twitter says an attacker used its API to match usernames ... by loh on Wednesday February 05, 2020 @09:52PM (#22253061)
I can't imagine it would be difficult to implement a "Select All Contacts" functionality, in addition to selecting individual contacts and/or selecting all then deselecting some. Automatically allowing access to future contacts also shouldn't be difficult. There is no need for apps to always have access to all contacts.
Re:Twitter says an attacker used its API to match usernames ... by twodave on Thursday February 06, 2020 @10:37AM (#22256767)
I’m not sure how that would be functionally different than the current situation. Instead, simply regulating how contacts are allowed to be used would remove the need to build a logically complex system, and since Apple already reviews every app submission it would just be one more thing for a reviewer to check.
Re:Twitter says an attacker used its API to match usernames ... by what_ever on Wednesday February 05, 2020 @06:11PM (#22251864)
How will apps like Whatsapp work then?
Re:Twitter says an attacker used its API to match usernames ... by diebeforei485 on Wednesday February 05, 2020 @08:44PM (#22252768)
I don't give WhatsApp access to my contacts. Few enough people in my life use it, and they all have different profile pictures.

I find it very weird to find, for example, my boss, or certain specific coworkers, on any social app. I don't want them to be able to find me either. This design decision of giving apps your entire contacts book by default has to die, and individual users need more choice instead.

Re:Twitter says an attacker used its API to match usernames ... by what_ever on Wednesday February 05, 2020 @11:47PM (#22253498)
Whatsapp has 1.5B MAU. I don't think people are interested in adding each and everyone manually. I want to know how that would work for majority of those people and not you personally.
Re:Twitter says an attacker used its API to match usernames ... by u801e on Thursday February 06, 2020 @08:55AM (#22255928)
> I don't think people are interested in adding each and everyone manually.

If they are interested, then they'll find a way.

Re:Twitter says an attacker used its API to match usernames ... by a254613e on Thursday February 06, 2020 @02:05AM (#22254059)
That's great for you, but whatsapp is de facto standard messaging app in a lot of countries. Memorizing hundred numbers, or profile pictures (assuming that everyone has one) is just not feasible.

An app (such as whatsapp) getting access to all contacts is a valid use case, even though it doesn't apply to you.

Re:Twitter says an attacker used its API to match usernames ... by netsharc on Thursday February 06, 2020 @07:54AM (#22255616)
And sadly for him, it doesn't matter anyway, presumably most if not all his friends already uploaded their address books, so WhatsApp already knows his real name and phone number and network of friends...
Re:Twitter says an attacker used its API to match usernames ... by majewsky on Thursday February 06, 2020 @06:46AM (#22255312)
No. When you want to chat with a new person, WA just needs the contact of that single person.
Re:Twitter says an attacker used its API to match usernames ... by funfhander on Wednesday February 05, 2020 @06:21PM (#22251932)
I use WhatsApp without allowing them access to my contacts. I have to just add people's numbers manually and I have to memorize who is who based on # and profile picture (thankfully the people I talk to with WhatsApp all have different area codes).

I don't use Facebook nor Instagram, and I only use WhatsApp for 3 Android users, the rest of the people I talk to I use iMessage.

Re:Twitter says an attacker used its API to match usernames ... by zrm on Wednesday February 05, 2020 @06:48PM (#22252100)
> I use WhatsApp without allowing them access to my contacts.

That appears to be impossible for WhatsApp on Android. Someone wanted me to install it a bit ago, I refused to give it access to my contacts and it refused to do anything else until I did.

So I deleted it and we used Signal instead.

Re:Twitter says an attacker used its API to match usernames ... by londons_explore on Thursday February 06, 2020 @02:45AM (#22254252)
It is possible on Android, but if you do, you can't initiate any conversation - the remote party has to speak first.
Re:Twitter says an attacker used its API to match usernames ... by zrm on Thursday February 06, 2020 @11:25AM (#22257339)
We did try that and it supposedly claimed to the other party that I didn't have the app installed. Not that that would have been a scalable solution anyway, since then no pair of people could use it unless one of them gave it all their contacts.

Meanwhile the option remains available to use a different app that doesn't behave that way.

Re:Twitter says an attacker used its API to match usernames ... by what_ever on Wednesday February 05, 2020 @11:48PM (#22253502)
So why should iMessage get all of your contacts by default?
Re:Twitter says an attacker used its API to match usernames ... by funfhander on Thursday February 06, 2020 @12:11AM (#22253581)
I made the choice for Apple to have my contacts by buying an iPhone. If I didn't want Apple to have my contacts (as I do not want Google or Facebook to have mine) I would have not bought an iPhone.
Re:Twitter says an attacker used its API to match usernames ... by Diti on Thursday February 06, 2020 @03:59AM (#22254595)
Personally, I made the choice for Apple NOT to have my contacts (by entirely disabling iCloud). The only company I accept handling my contacts is the one I paid (Fastmail).
Re:Twitter says an attacker used its API to match usernames ... by johnebgd on Thursday February 06, 2020 @01:30AM (#22253889)
Apple doesn’t get all your contacts.

Your local Apple device has a messaging app (iMessage) that can see all the contacts on it.

iCloud puts contacts on Apple servers.

Re:Twitter says an attacker used its API to match usernames ... by jrochkind1 on Wednesday February 05, 2020 @06:27PM (#22251968)
Yes, you sound like a very typical whatsapp user, I can see how whatsapp could work fine without contacts access, since most users are like you. 3 total contacts, all with different area codes -- very typical, I don't know why whatsapp even asks for contact access, probably something nefarious.