News for hackers. Stuff that matters.

A comment on Twitter says an attacker used its API to match usernames to phone numbers. Parent comment

Re:Twitter says an attacker used its API to match usernames ... by loh on Wednesday February 05, 2020 @09:52PM (#22253061)
I can't imagine it would be difficult to implement a "Select All Contacts" functionality, in addition to selecting individual contacts and/or selecting all then deselecting some. Automatically allowing access to future contacts also shouldn't be difficult. There is no need for apps to always have access to all contacts.
[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by twodave on Thursday February 06, 2020 @10:37AM (#22256767)
I’m not sure how that would be functionally different than the current situation. Instead, simply regulating how contacts are allowed to be used would remove the need to build a logically complex system, and since Apple already reviews every app submission it would just be one more thing for a reviewer to check.
[ Parent | on HN ]