Some thoughts on the iPhone contact list controversy and app security

1. I’ve heard rumors that lots of apps have been uploading user contact lists for years. One person who knows the iOS world well told me “if you download a lot of apps, your contact list is on 50 servers right now.” I don’t understand why Apple doesn’t have a permission dialog box for this (that said, I’m not sure that’s the best solution – see #4 below). Apple has dialogs for accessing location and for enabling push notifications. Accessing users’ contact lists seems like an obvious thing to ask permission for.

2. I don’t know what the product design motivations are for uploading contacts, but I assume there are legitimate ones. [commenters suggest it is mainly to notify users when their friends join the service].  If this or something similar is the goal, you could probably do it in a way that protects privacy by (convergently?) encrypting the phone numbers on the client side (I’m assuming the useful info is the phone numbers and not the names associated with the phone numbers since the names would be inconsistent across users).

3. Many commentators have suggested that a primary security risk is the fact that the data is transmitted in plain text. Encrypting over the wire is always a good idea but in reality “man-in-the-middle” attacks are extremely rare. I would worry primarily about the far more common cases of 1) someone (insider or outsider) stealing in the company’s database, 2) a government subpoena for the company’s database. The best protection against these risks is encrypting the data in such a way that hackers and the company itself can’t unencrypt it (or to not send the data to the servers in the first place).

A bad outcome from this controversy would be to have companies encrypt sensitive data over the network and then not encrypt it on their servers (the simplest way to do this is to switch to https, a technology that is much more about security theater than security reality). This would make it impossible for 3rd parties (e.g. white-hat hackers) to detect that sensitive data is being sent over the network but would keep the data vulnerable to server side breaches / subpeonas. Unless Apple or someone else steps in, I worry that this is what apps will do next. It is the quickest way to preserve product features and minimize PR risk.

4. I worry that by just adding tons of permission dialogs we are going back to the Microsoft IE/Active X model of security. With lots of permission popups, users get fatigued and confused and just end up clicking “Yes” to everything. And then the security model says: If the user says “yes”, and the app uses “best practices” like https, it can do whatever it wants. We saw how this played out with the spyware/adware epidemic on the web from 2001-2006 and it wasn’t pretty.

 

App store shenanigans

I’ve downloaded and tested a few hundred iPhone and iPad apps.  One thing that I’ve noticed is that many of the top rated and ranked apps are pretty scammy.  Take for example “Night Vision.”

It’s a top app in under Utilities for both paid and free iPhone apps.

If you actually download and test the app, you’ll find it doesn’t work at all. In fact, I found it made objects darker, not brighter.  See these photos with and without the app of the exact same room in the exact same lighting.

The app tries to get you to download other apparently scammy apps.  I’m guessing this kind of “cross selling” is how Night Vision got  most of its downloads.

Another clever trick they play is when you look at the app customer ratings on the iPhone App Store you see that it has 4.5 stars:

But when you look on the desktop web you see the overall ratings are vastly lower and that they seem to game the system by releasing “new versions” to reset their ratings and then probably paying people to write positive reviews:

Companies like TapJoy let you pay to get in the Top 25, and then once you are there you can get “organic” downloads by being on the toplists.

Another platform, another way to game it.

Steve Jobs single-handedly restructured the mobile industry

With the introduction of the iPhone, Steve Jobs achieved something that might be unique in the history of business: he single-handedly upended the power structure of a major industry.  In the US, before the iPhone, the carriers (Verizon, AT&T, Sprint, T-Mobile) had an ironclad grip on the rest of the value chain – particularly, handset makers and app makers.

Ask anyone who ran or invested in a mobile app startup pre-iPhone (I invested in one myself). Since the carriers had all the power, getting any distribution (which usually meant getting on the handset “deck”) meant doing a business development deal with the carriers. Business development in this case meant finding the right people at those companies, sending them iPods, taking them to baseball games, and basically figuring out ways to convince them to work with you instead of the 5,000 other people sending them iPods and baseball tickets.  The basis of competition was salesmanship and capital, not innovation or quality.

The carriers had so much power because consumers made their purchasing decisions by choosing a carrier first and a handset second. Post-iPhone, tens of millions of people started choosing handsets over carriers. People like me suffer through AT&T’s poor service and aggressive pricing because I love the iPhone so much.

I’ve talked to a number of mobile app startups lately who say their former contacts at the carriers are shell shocked: no one is knocking on their doors anymore. I guess they have to buy their own iPods and baseball tickets now.

Yes, Apple has rejected some apps for seemingly arbtrary or selfish reasons and imposed aggressive controls on developers. But the iPhone also paved the way for Android and a new wave of handset development. The people griping about Apple’s “closed system” are generally people who are new to the industry and didn’t realize how bad it was before.

enigmo = awesome

Ok, Enigmo is awesome.  i downloaded (and purchased!) the mac os X version of Enigmo and also the sequel Enigmo 2.

I am embarassed to say it is so addictive I won all 50 levels on Enigmo last weekend.  It’s really an incredibly clever and fun game and better on the Mac (although still good on the iPhone).

I found Enigmo 2 interesting at first (the laser and magnets are neat) but the true 3d interface gets kind of tedious.  Instead I downloaded some user created levels for Enigmo 1, and continue to enjoy it (albeit in smaller, healthier doses!).

iphone apps- the good, bad, and mediocre

best game so far:  Enigmo – really addictive!

dissappointing games: monkey ball (too hard to control), cro-mag (ok mario kart clone),

need to play more to decide:  AquaForest

really fun to show off your iphone and cool technology:  shazam

what’s the point: nytimes (no better than website), AIM (can’t run in background)

seems like they have a lot of potential:  AOL Radio, Pandora

Useful if you live in NYC: CityTransit

Kind of useful no matter where you live:  BoxOffice

Silly free ones that are kind of fun:  World 9, phone saber, life game

don’t really get it and it seems overhyped: Loopt

UPDATE:  aquaforest isn’t good.   AIM would be good if you could run apps in the background on the iphone. actually the only iphone apps i’ve liked so far are labyrinth and enigmo.