News for hackers. Stuff that matters.

A comment on Twitter says an attacker used its API to match usernames to phone numbers. Parent comment

Re:Twitter says an attacker used its API to match usernames ... by twodave on Wednesday February 05, 2020 @04:47PM (#22251311)
This certainly would break plenty of valid use cases for a feature like this. More likely they ought to have policy in their developer docs to scope reasonable uses of the full contact list and start rejecting updates for applications that violate the new rule.
[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by rhacker on Wednesday February 05, 2020 @06:02PM (#22251819)
What's a valid use case for being able to read all contacts vs asking the user for a specific contact selection and choosing to approve sharing it?
[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by bcrosby95 on Wednesday February 05, 2020 @06:52PM (#22252122)
Any application whose primary concern is something with contact lists. Maybe it offers a special view into it. Maybe special searches. Maybe a better management interface.
[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by np_tedious on Wednesday February 05, 2020 @09:35PM (#22252984)
An alternate phone or texting app
[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by loh on Wednesday February 05, 2020 @09:52PM (#22253061)
I can't imagine it would be difficult to implement a "Select All Contacts" functionality, in addition to selecting individual contacts and/or selecting all then deselecting some. Automatically allowing access to future contacts also shouldn't be difficult. There is no need for apps to always have access to all contacts.
[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by twodave on Thursday February 06, 2020 @10:37AM (#22256767)
I’m not sure how that would be functionally different than the current situation. Instead, simply regulating how contacts are allowed to be used would remove the need to build a logically complex system, and since Apple already reviews every app submission it would just be one more thing for a reviewer to check.
[ Parent | on HN ]