There's an Easy Fix to Apple's Latest iPhone Privacy Problem
Apple can make this whole iPhone address book fiasco all better with a simple fix. Following last week's Path scandal, amid the blogger fighting, turns out tons of other apps are also uploading user address book information to servers without asking the phone owner's permission. In fact, the way the iPhone works, any app can access contacts without a notification of any sort. These apps then have access to any phone numbers, email addresses and the names attached to them without users knowing. That's a privacy mess. But, the phone doesn't have to have this power. Apple can (and should) fix this.
RELATED: The Government Steps in on App Privacy
Apple already knows the answer to this problem, as Steve Jobs explained it as part of the Apple privacy philosophy back at a 2010 D8 conference. "Privacy means people know what they are signing up for. In plain English," said Jobs in an interview flagged by Gizmodo's Jesus Diaz. "Ask them. Ask them every time. Make them tell you to stop asking if they get tired of you asking. Let them know precisely what you are going to do with their data." The iPhone does this for location services, asking if a user will allow the iPhone to track its location, enabling the GPS function. The iPhone should have the same mandatory barrier for uploading contact information.
RELATED: Apple Does the Right (and Easy) Thing with iPhone Privacy
As of now, it leaves that decision up to the individual app developer. Each application can decide if it wants to covertly upload contacts, or if it wants to inform users of its intrusion. Users hold these companies responsible for their choices, as we saw with Path. But Path was just one of the many taking data. The others went undetected. Apple should take responsibility; make this mandatory and consistent, rather than something users have to worry about with each new application.
RELATED: One Year of Tim Cook: Is He a Visionary or a Genius Executive?
Until Apple changes its policy, however, Forkly, an iPhone application, has discovered a better way to help users find friends. Rather than upload all of the contact information, it discovered it only needed the "hash" -- a code that corresponds to contact information without actually detailing said information -- to make matches. Here's how it works:
So, instead of sending a user’s address book contents to our servers, we only sent the hashed entries (with some normalization, such as lowercasing strings, and cleaning up phone numbers prior to hashing).
Then, we could just compare the hashes on our servers and inform our iPhone app that entry X in a user’s address book matches Brightkite user Y, all without ever “seeing” any actual phone numbers, names or email addresses. This enabled us to implement the same “Find Friends” functionality that so many apps nowadays use without compromising the privacy of the address book.
Any app makers hoping to avoid a privacy controversy, and, you know, do the right thing, might want to take this road instead of the Path-way.
