iOS Photo and Video Privacy Issues Highlighted with New Test Application

[Born2run45]

Anyone that cares about this should go back to using a landline.

 

[petsounds]

This also hurts legitimate app developers -- especially indie developers who have no reputation to stand on yet -- who need to request location access for the operation of their app. Now that location permission dialog is tainted in the eyes of many customers until Apple fixes the permissions issue.

 

[-hh]

...I fully understand that the loophole needs to be closed regardless. And I assume that this is not the only one. Probably browsing history, documents and others are accessible without asking for proper permission somehow. I know, I assume a lot here, but since this is already the second major workaround the users' proper permission, I am probably not too far off.

Edit:
I hope they integrate something like a rights library which defines categotries of data, each prompting a different permission pop-up box so that Apps still work. The oposite, the pure sandbox where Apps can only access their own data, would be horrible. The user just has to be aware what which App is allowed to do and has to have control of it.

This problem reminds me of automotive racing ... there's a set of rules that everyone's expected to follow, but teams seek out loopholes which bring them some advantage...things that used to be innocuous only become a clear problem after someone has found an exploit.

Where has this cutting edge journalism been for the last couple decades? Every OS I know allows this behavior. Why is it a problem all of the sudden?

The current motivation for "misbehavior-ware" has only recently come about because of the revenue potential gained from having peoples' data. Some of these are clearly illegal (ie, identity theft), but there's also a lot of interpretational grey areas ... for example, if I give an App permission to access my photos, did they also trick me into giving them a free & perpetual license to my copyright works, including a right for them to resell it to a third parties? It makes all of those fine print paragraphs all the more important.

Where the NY Time's Journalism has problems in its failure to point out that this problem isn't unique to just the iOS system...for them to infer that it is only iOS issue is incorrect and an Ethics of Journalism concern.

The problem with that approach is that it isn't granular enough....

A better question is if it can ever be made granular enough? Afterall, even if a curated approach were to literally review every line of source code, all data sent off the device is beyond that ability to review what is done with it next.

Moot.

On a computer, all programs have access to your personal photo library and can do the same thing for years.

Except that motivations have changed and the idea of a programmer hiding a subroutine that systematically scrapes your data is what didn't exist. The broader issue that the NY Times misses is that all OSs are currently vulnerable to this type of attack.

What's the big deal about this???

This message comes app for any app you run that requires access to your Photos.
If you don't trust the app, just "Don't Allow" it!

While I somewhat agree, I disagree that it is a "problem" that was ignored. It was never a problem until someone decided to make it one. The only problem here is that a developer has abused a user's trust (or I'd even whittle that down to a user not understanding what an application is doing and how it does it).

This of course leads to pandemonium that eventually leads to user's needing to be coddled even further than they were before. This reminds of that art project where the artist attached a warning label to every barb on a barbed wire fence, to make sure people knew they could get pricked by it. This was a great statement on modern society's need to be reminded that not everything is safe and there may be dangers in the world beyond our own control

Exactly. The real news is the growth in software that contains deception.

From there, the bigger question is if technology can ever solve that problem.


-hh

 

[jacobj]

I hope they integrate something like a rights library which defines categotries of data, each prompting a different permission pop-up box so that Apps still work. The oposite, the pure sandbox where Apps can only access their own data, would be horrible. The user just has to be aware what which App is allowed to do and has to have contol of it.

I would like to see a list of the core personal data access required being listed in the App store alongside the app. I'd like to know whether it remains local access (i.e. it is never sent from the phone). It is a critical part of my decision as to whether to get and app or not.

 

[Nielsenius]

I would like to see a list of the core personal data access required being listed in the App store alongside the app. I'd like to know whether it remains local access (i.e. it is never sent from the phone). It is a critical part of my decision as to whether to get and app or not.

Yes, exactly. This privacy violation stuff is just getting out of hand. I'm not that concerned, at the moment. But, what will developers and corporations get away with in the future? I think some kind of precedent needs to be set for what's acceptable and what's not.

 

[newagemac]

True. Just my opinion that the benefits do outweigh the annoyance, that's all.



It wouldn't, but at least you are informed of this. The whole kerfluffle over the iOS app was that the user didn't know his/her contacts were being accessed (at least this is my perception of the controversy), not the act itself. Important distinction.

Again, I think you are missing the point. Knowing whether or not an app is accessing your contacts is not the problem. What an app actually DOES with that access is the crux of the matter. And that is something that no permissions system can handle. It can only be done with a curation process. You have to actually test the app and/or view the code.

 

[BaldiMac]

This also hurts legitimate app developers -- especially indie developers who have no reputation to stand on yet -- who need to request location access for the operation of their app. Now that location permission dialog is tainted in the eyes of many customers until Apple fixes the permissions issue.

What's wrong with the location permissions? They protect location data (which can be embedded in photos.)

 

[apple.of.my.eye]

Would be great if simple toggles were available to allow for sharing or not sharing video, photos, address book, etc with these apps. Serious privacy issue it is.

 

[charlituna]

They should have treated this data, the way they treat locations in general. Too lenient.

shame on them for believing in the good of people.

they learned their lesson and they are working to rewrite the rules to require that you ask for every little thing. Since they can't trust developers.

----------

When I first looked at this, I wondered why it even has to request permission for location data.

Location data allows for tracking. and that service can be a bit of a battery hog. two very good reasons for said rule

----------

I find it intriguing that you're blasting jail breaking when in fact Apple hasn't exactly done a mash-up job concerning privacy issues with their "official" apps.

Apple set a policy saying that apps needed to let folks know what info was being used, uploaded etc. They believed they could trust developers not to be asshats. They were wrong. But that's no reason to blast them for being jerks about the issue. If anything, from a honest developer's point of view, I'm glad that they were willing to trust us and it's the asshats that ruined it that are the problem.

----------

Wow, the NYT really have taken it on themselves lately to "hold Apple accountable". Must be something to this behind the scenes.
Only problem though, is they are so hopelessly incompetent at it!

It's all good. Gizmodo was getting lonely. Now they won't be.

 

[gkpm]

I would like to see a list of the core personal data access required being listed in the App store alongside the app. I'd like to know whether it remains local access (i.e. it is never sent from the phone). It is a critical part of my decision as to whether to get and app or not.

Short of Apple reading the source code of all apps (apps would take months to review, cost a fortune, not to mention the liability of giving Apple proprietary source code) it's not possible to know what data remains local or goes to servers. Most good developers encrypt the data they transmit.

It's the same for all platforms, you can limit access to data but you'll never be able to control the data once it's in the app.

I think the best is what's coming already: have developers state a privacy policy shown alongside the app and make them legally responsible for keeping their word.

 

[charlituna]

That's the common theme I keep hearing: if you get burned by malware on Android it's your own fault, you should have rooted the phone and installed privacy protectors (like you yourself did with CyanogenMod).

That right there is why I will never get anything Android. I shouldn't have to root my phone to put in privacy protection. That's just backwards

----------

Anyone that cares about this should go back to using a landline.

But the government listens to those. They listen to everything. They have this machine that records everything about us. It's on this island that is kept hidden with alien cloaking technology they stole from the Roswell crash. and every 108 minutes someone pushes a button

----------

This also hurts legitimate app developers -- especially indie developers who have no reputation to stand on yet -- who need to request location access for the operation of their app. Now that location permission dialog is tainted in the eyes of many customers until Apple fixes the permissions issue.

Many folks just say no. Because they are given that choice. What would be nice is if the apps said why they want permission. Many folks don't know that the Camera app wants to record where you are for sorting photos later (the Places in iPhoto and such). so they say no and then they are mad cause they just came back from a trip around Europe and can't remember where they were for half the photos. An explanation in the pop up would be nice

 

[samcraig]

This is an example of just how much you could be risking downloading an app from a store that doesn't have an approval process in place. If there is an app that hasn't been vetted, you really don't have any type of clue what they might be doing behind the scenes. At least Apple and other curated stores have the ability to know what is actually going on before allowing the app on the market.

I think it's safe to say that while Apple "vets" the apps to some degree - it's been shown often that the job they are doing isn't foolproof. Not even by a longshot.

At least iPhones don't come pre-installed with carriers' spy ware package where you don't even have an option to say No!

You realize that Carrier IQ was on the iPhone until recently?

 

[pmz]

Sorry I don't see what you're trying to say. I thought the point was that the Path app proved things can make it through the approval process. This is simply an extension on top of that, demonstrating what else can be accessed.

Not sure what you were expecting.

Couldn't have been any more clear.

To repeat myself, which I don't enjoy doing, they should have developed an app that does not ask user permission, and was submitted to and approved by Apple.

Then, their example, would be the same, as their claims.

Did I spell it out enough?

 

[BaldiMac]

I think it's safe to say that while Apple "vets" the apps to some degree - it's been shown often that the job they are doing isn't foolproof. Not even by a longshot.

Nobody claimed they are perfect. They don't need to be for their strategy to work.

You realize that Carrier IQ was on the iPhone until recently?

And you do realize the significant difference between requiring opt in and not having the ability to opt out.

 

[xStep]

"Update: The Verge reports that "sources familiar with the situation" have indicated the photo and video access is a bug and that a fix is in the works."

I find that amusing. It isn't a bug. The ALAssetsLibrary framework that causes the initial prompt is designed to allow the extra access. This long winded blog, Confusing iOS Location Services Prompt, describes why the message can be misleading too. Apps that cause the prompt don't necessarily use location data.

Although the app I'm working on currently doesn't use location information, the prompt still appears, in iOS 5. On iOS 4.3, the prompt does not appear and in fact under the Location Services menu, the permission is automatically set to YES. That is a bug. It will be interesting if Apple releases a fix for that.

 

[dethmaShine]

shame on them for believing in the good of people.

they learned their lesson and they are working to rewrite the rules to require that you ask for every little thing. Since they can't trust developers.

Exactly. Nonetheless, exactly even though if that's sarcasm.

Developers/humans are the same who end up terrorising the world OR hack governments. You're not supposed to open your systems to anyone.

 

[jacobj]

Short of Apple reading the source code of all apps (apps would take months to review, cost a fortune, not to mention the liability of giving Apple proprietary source code) it's not possible to know what data remains local or goes to servers. Most good developers encrypt the data they transmit.

It's the same for all platforms, you can limit access to data but you'll never be able to control the data once it's in the app.

I think the best is what's coming already: have developers state a privacy policy shown alongside the app and make them legally responsible for keeping their word.

How about explicit permission to use each data type and for that data to be set to servers?

 

[BaldiMac]

How about explicit permission to use each data type and for that data to be set to servers?

How do you control what data gets sent to remote servers?

 

[jtara]

Location permission gives the developer complete access to your entire photo library?! As much as I like Apple products, I'll be the first to call this out as an absolute disgrace.

Not exactly. It's more like a side-effect.

There is no specific "photo library permission". But, since photos might contain geotags, (by default, photos taken on iPhones are geotagged) the application needs location permission to access the photo library.

----------

How do you control what data gets sent to remote servers?

There is no way. The OS couldn't possibly inspect what is being sent and definatively determine what it is. All it can determine is what data is being ACCESSED by the app.

Data could be encrypted with SSL and if the built-in SSL implementation is used, then, yes, data could be inspected. If the app has it's own SSL implementation, no. And if the app encrypts using some other means, no. And there are non-encrypted encodings that might make it difficult to identify inspected content.

 

[kalsta]

The problem that we are discussing can only be solved through curation. No permission system is going to stop an app from uploading your information to a remote server if it's willing to masquerade as an trusted app.

The problem that we are discussing here is that an app asks for permission to access your location (nothing more) but then also gains the capability to 'copy [your] entire photo library, without any further notification or warning'. That is the problem we are discussing. Sure, if a user were able to knowingly give an app permission to access all their photos, and then the app did something naughty with them, like delete them, or upload them to a server, you might have a point. But that really isn't the issue you and I were discussing.

Did you notice the update to the article by the way…?

Update: The Verge reports that "sources familiar with the situation" have indicated the photo and video access is a bug and that a fix is in the works.

"We spoke to sources familiar with the situation, and were informed that a fix is most likely coming for the loophole. According to the people we talked to, Apple has been made aware of the issue and is likely planning a fix with an upcoming release of iOS. Those sources also confirmed that the ability to send your photos and videos to a third-party is an error, not an intended feature. If we had to guess, the fix will likely come alongside a patch for Apple's other recent security issue — the ability for apps to upload your address book information without warning."

So it seems some good does come from people holding Apple to a higher standard than you seem willing to.

 

[BaldiMac]

The problem that we are discussing here is that an app asks for permission to access your location (nothing more) but then also gains the capability to 'copy [your] entire photo library, without any further notification or warning'. That is the problem we are discussing. Sure, if the user where able to knowingly give an app permission to access all their photos, and then the app did something naughty with them, like delete them, or upload them to a server, you might have a point. But that really isn't the issue we're discussing.

I'm not sure what your point is. iOS already does more than any other operating system to protect your photos. It appears that they are planning to do even more to confirm access to this information on an app by app basis. What are you suggesting?

 

[kalsta]

I'm not sure what your point is. iOS already does more than any other operating system to protect your photos. It appears that they are planning to do even more to confirm access to this information on an app by app basis. What are you suggesting?

Oh gosh, this discussion is like a merry-go-round! I don't care about 'other operating systems', and I'm not 'suggesting' anything. I'm stating openly that this issue is a serious one. A request to the user for permission should be precise and explicit. Perhaps someone else said it better than me here:

Asking for permission for the wrong thing is a major glitch—it is NOT asking the user for permission in any way that is meaningful to the user. It’s like asking your friend “can I have your french fries?” and then taking his bike. Can you really say, “but I asked permission!”?

And so it needs to be fixed.

Amen to that. Now it appears Apple is going to fix it. Enough said.

 

[BaldiMac]

Oh gosh, this discussion is like a merry-go-round! I don't care about 'other operating systems', and I'm not 'suggesting' anything. I'm stating openly that this issue is a serious one. A request to the user for permission should be precise and explicit. Perhaps someone else said it better than me here:



Amen to that. Now it appears Apple is going to fix it. Enough said.

Now I understand. You don't understand what is actually happening. The location warning is precise and explicit. It is there to protect location data. Which happens to be embedded in photos.

 

[petsounds]

Many folks just say no. Because they are given that choice. What would be nice is if the apps said why they want permission. [...] An explanation in the pop up would be nice

Actually, the iOS SDK does allow developers to put a message in that popup, but no one even notices them because at a quick glance it looks like every other message. People have become trained to just click No.

I think this is a big UX issue with Apple's use of modal popups for requests. People hate modal popups because they block interaction with the software, and so they instinctively try to get rid of them as quickly as possible to get on with their task (just like they do with software license agreements). As Apple moves to a more fine-grained permissions structure, I hope that Apple just does away with the modal popup completely and moves to something like a full-page screen that clearly denotes what is being used and why. It would be better if these requirements would also be listed on the app store page, where I think people are more likely to read. But once they get the app installed, they just want to use it.

 

[kalsta]

Now I understand. You don't understand what is actually happening. The location warning is precise and explicit. It is there to protect location data. Which happens to be embedded in photos.

*Bangs head against wall*