{"id":31742,"date":"2021-02-26T17:05:22","date_gmt":"2021-02-26T22:05:22","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=31742"},"modified":"2021-03-15T13:44:55","modified_gmt":"2021-03-15T17:44:55","slug":"clubhouse-wants-to-upload-your-contacts-phone-numbers","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2021\/02\/26\/clubhouse-wants-to-upload-your-contacts-phone-numbers\/","title":{"rendered":"Clubhouse Wants to Upload Your Contacts’ Phone Numbers"},"content":{"rendered":"

Will Oremus<\/a>:<\/p>\n

When you join the fast-growing, invite-only social media app Clubhouse — lucky you! — one of the first things the app will ask you to do is grant it access to your iPhone’s contacts. A finger icon points to the “OK” button, which is also in a bolder font and more enticing than the adjacent “Don’t Allow” option. You don’t have to do it, but if you don’t, you lose the ability to invite anyone else to Clubhouse.<\/p><\/blockquote>\n\n

Via Nick Heer<\/a>:<\/p>\n

\n

The permission dialog iOS presents users before an app is able to access their contacts is, in a sense, being presented to the wrong person: can you really consent on behalf of hundreds of friends, family members, and acquaintances? From a purely ethical perspective, the request ought to be pushed to every contact in the directory for approval, but that would obviously be a nightmare for everyone.<\/p>\n

There are clearly legitimate uses for doing this. Allowing people to find contacts already using a service, as Clubhouse is doing, is a reasonable feature. It does not seem like something that can be done on-device, so the best solution that we have is, apparently, to grant apps permission to collect every contact on our phones. But that is a ludicrous tradeoff.<\/p>\n<\/blockquote>\n\n

Guilherme Rambo<\/a>:<\/p>\n

\n

Just had a poke at the Clubhouse app with a proxy, given the recent concerns about contacts usage. The bad part is that it uploads all of your contact’s phone numbers (surprise!). The good part is that that’s the ‘only’ thing it uploads about them.<\/p>\n

[…]<\/p>\n

Another problem is that the API used to upload the phone numbers doesn’t seem to be using SSL pinning.<\/p>\n<\/blockquote>\n\n

Dave Verwer<\/a>:<\/p>\n

I saw some suggestions that Apple should solve this with a Photos.app style “select which contacts can be accessed” permission, but is anyone going to go through their contacts manually, picking and choosing? I have just under a thousand records in mine from many years of personal+work life, and I bet that’s nothing compared to some people. It’s not practical. Maybe a solution would be to let the permission be on groups rather than individual contacts, but who’s contact database is that well organised? Mine isn’t.<\/p>\n

The other popular theory on how to solve this is that Apple should provide an API to hash contact information, allowing apps to match people without getting access to personal information. That’s one of those ideas that feels better and solves one aspect of the problem, but bad situations are inevitable<\/a> when you match a full contacts database.<\/p>\n<\/blockquote>\n\n

Previously:<\/p>\n