Last year, Facebook’s mobile apps received flak for uploading numbers of cell phone contacts without intimating the user. Unfortunately, it now appears that this practise is a lot more prevalent than most of us could have anticipated.

Earlier today, Arun Thampi discovered that the new social network Path is also doing pretty much the same thing. He made this startling discovery by snooping on the API requests made by Path’s iOS app with the help of a man-in-the-middle proxy tool. Thampi found that as soon as you create a new account or log into Path’s iOS app, your entire contact list is uploaded to its servers. Everything including your contacts’ name, email address, and phone number is silently uploaded over HTTPS, and there is nothing you can do about it.

Soon after, Mark Chang uncovered that location sharing social network Hipster also grabs your contact list. However, Hipster is even more callous with your personal data. It transmits email addresses from your phone’s address book to its servers without even bothering to encrypt them.

Path uploading user’s address book

After the news broke, Path’s CEO Dave Morin apologized to users and offered the following statement.

We actually think this is an important conversation and take this very seriously. We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and efficiently as well as to notify them when friends and family join Path. Nothing more.

We believe that this type of friend finding & matching is important to the industry and that it is important that users clearly understand it, so we proactively rolled out an opt-in for this on our Android client a few weeks ago and are rolling out the opt-in for this in 2.0.6 of our iOS Client, pending App Store approval.

As Morin explains, social networking apps like Path have a valid reason for requiring access to your address book. However, there is simply no excuse for failing to intimate the user about the same. Heck, Path and Hipster doesn’t even mention this in their FAQ, which most services use for covering their back while performing shady activities. The good thing is that Path has already rectified its mistake. In the latest version of its Android app, contact upload is opt-in, and the iPhone users will also get the same treatment as soon as Apple approves the latest update. Meanwhile, if you don’t want Path to have a copy of your phone book, you can request the deletion of data from its servers by sending a mail to service@path.com.

Update: Path 2.0.6 for iOS is now available in the App Store.

As I mentioned upfront, this practice is way more widespread than any of us could have imagined. Hacker News readers have already identified the same behavior in Beluga and Kik Messenger. Earlier today, Aurora Feint got delisted from the App Store for transmitting address book as plain text. However, with Feint, at least this is strictly opt-in.

Address book is something most users treat as extremely sensitive information, and it’s high time that the industry realizes that. Android does notify the user during installation, if the app accesses the address book. However, most users simply don’t have the habit of paying attention to the “Permissions” screen while installing apps. Moreover, there is no reason to conclude that if an app is reading contact data, it is uploading the same to its servers without permission. On the other hand, Apple, which often positions its App Store as more secure, gives apps full access to the address book without even requiring any additional permission.

One thing that Morin is right about is that this is an extremely important conversation. Hopefully, people will not just move on after expressing their knee-jerk reaction. An iOS app called MobileSubstrate that will alert users every time an app tries to access the phonebook is already under development for jailbroken devices. Ideally though, Apple and Google should take responsibility, and do a better job at protecting the user’s privacy. Perhaps, they should even consider changing their APIs to force apps into explicitly seeking permission before accessing the address book.

Quite recently, Google made several changes to their privacy policy to simplify it and merge several privacy policies into one. One of the changes Google made was to allow users to change their ads preferences easily across the board.

However, one interesting thing that Google has now disclosed through their Ad Preferences Manager is that, Google has been guessing a user’s age and gender based on the websites they have visited.

Google says that the gender and age are determined by the websites a user visits. In my case both the Age as well as the Gender were correct. Google does not say as to how they are coming up with that assumption but their algorithm looks pretty accurate for most users and might include data from Google Analytics as well. Of course, this information may not be right always and Google provides users with an option to correct it as well.

Google uses this age and gender information along with other preferences to display personalize ads for the users. If you are not comfortable with Google collecting this information, you can easily Opt out by visiting this page.

You can view your own Age and Gender information by visiting Google Ad Preferences Manager page, however, you will have to be logged in with a Google account to view this information. Do let us know if Google was correctly able to guess it for you or not.

In wake of privacy concerns, the W3C has recognized “Do Not Track” as a standard and has proposed the first bill, which lays the foundation of “Do Not Track” a.k.a DNT. This bill will prevent websites like Google and Facebook from selling user data to advertisers. While some users like to see personalized ads, others do not want any of their data to be used to serve ads. This can create a tricky situation and “Do not track” is the way to go.

This Monday, the W3C proposed the first draft of its standard for implementing DNT. The proposed bill works for both site owners and users. The  Tracking Preference Expression  or DNT is explained as:

The  DNT  header field is hereby defined as the means for expressing a user’s tracking preference via HTTP [HTTP11]. A user agent  must  send the  DNT  header field on all HTTP requests if (and only if) DNT is  enabled. A user agent  must not  send the  DNT  header field if DNT is  not enabled.

DNT-field-name   = “DNT”                                                   ; case-insensitive

DNT-field-value = ( “0″ / “1″ ) *DNT-extension     ; case-sensitive

DNT-extension     = %x21-2B / %x2D-7E                           ; visible ASCII except “,”

The draft will be published in the summer of 2012. A large part of this work is derived from Mozilla’s work with the DNT header.  Aleecia M. McDonald, a privacy researcher for the Mozilla Foundation is the co-chairman of the Tracking Protection working group, which is working on the DNT standard.

While the bill creates a reasonable protective barrier for privacy-concerned users, it also has the potential to hamper millions of online business that rely on advertisement revenue. In a way, this bill might break the Advertising industry at its present state. The advertising industry needs to reform itself and keep up with the bill to reach a reasonable balance between the world of publishers, consumers and advertisers.

(Image via)

Worried about privacy? Well you’re not alone. U.S Congressman Edward Markey has published an open letter to Amazon’s CEO, Jeff Bezos, demanding an answer to privacy issues.

With the recent announcement of the Amazon Kindle Fire, an Android tablet powering Amazon’s content store, the Silk browser came to the forefront as a great leap in browsing. While ‘proxy-browsing’ is nothing new, Skyfire and Opera Mini have been doing it for ages, Silk will be the primary way all Kindle Fire users browse the web. This allows for Amazon to collect a HUGE amount of data that can be used for advertising or other means of monetizing personal information. Imagine that, a company making money off your personal online habits.

What is the Congressman after? Answers about what Amazon is collecting, how they are collecting it and what they plan on doing with it. Markey specifically poses the questions and demands an answer within 3 weeks.

• What information does Amazon plan to collect about users of the Kindle Fire?
• Does Amazon plan to sell, rent or otherwise make available this customer information to outside companies?
• How does Amazon plan to disclose its privacy policy to Fire and Silk users
• If Amazon plans to collect information about its users’ Internet browsing habits, will customers be able to affirmatively opt in to participate in the data sharing program?

Thank you for your attention to this important matter. Please provide the responses to these questions no later than November 4, 2011.

Amazon has built a huge network of infrastructure to leverage “server-side browsing” and make it completely invisible to the user. Browsing data and purchasing information is constantly being sent to Amazon and there is no known way to opt-out.  You could, of course, purchase one of the 30 other Android tablets on the market, that have unfettered access to the Amazon Kindle service.

While the Congressman does have his heart in the right place with these questions, especially considering he is Co-Chairman of the Congressional Bi-Partisan Privacy Caucus, this seems like a play using a very well known product to raise awareness for his ‘Do Not Track Kids’ legislation which attempts to protect online privacy for children. Won’t somebody think of the children?!

Do you really care if Amazon knows what you’re browsing the internet for? You probably already give that information to numerous other companies like Google or Facebook — what does one more Big Brother matter when you already have 6 looking over your shoulder?

It seems like we hear horror stories about Facebook every day. There are writers who spend all their time at Techie Buzz warning you about Facebook scams. Joel just did a great write up on how to not get hacked on the worlds largest social network. Now, it looks like Facebook is ready to help you control your sharing and privacy setting.

Announced today on their official blog, Facebook is introducing a slew of changes to their privacy and sharing settings. These are some seriously good changes for Facebook, which hasn’t always been known for giving users control over their sharing. There are a large number of smaller changes, but they can be broken down into two big categories. Let’s take a look at each one.

Tagging Changes

The first tagging related change is the ability to control when tagged photos appear on your profile. In the past, when someone tagged you in a photo, it would appear on your profile automatically. That lead to many spam tags appearing on profiles, and that was a huge problem for users. Now, you can choose to approve or reject each tagged photo posting individually, giving you more control over what appears on your Facbook profile.

The next major tagging change is an old feature brought back. In the old days of Facebook, you had the ability to approve or reject tags people added to your photos or posts. Facebook has brought that back for users, which is good news. Now random people tagging your photos without your knowledge won’t be a big deal anymore.

The next tagging change revolves around the tagging of non-friends and locations. Previously, Facebook only allowed you to tag people you are friends with in your posts. That meant that if you were with someone who you weren’t friends with, you couldn’t tag them. Now, you can, with their approval.

In addition to that, you can now tag locations without checking into them, which makes locations much more useful. Interestingly enough, this change means that Facebook is now phasing out the mobile-only version of Places. That means that all settings associated with that will be removed, and will need to be replaced in the new location settings.

The final tagging change revolves around the removal of tags and content on Facebook. In the past, the process of untagging and removing of content was unclear for many users. Now, Facebook will prompt you for a reason, which will allow you to take one of a set of actions against a piece on content. This marks a new phase for controlling your persona via Facebook, giving you the ability to request the takedown of a photo or even block a user based on a tag.

Sharing Changes

The next big set of changes from Facebook revolves around sharing controls. Many of us (myself included) are enthralled by Google’s sharing system on Google+. Facebook now has something very similar with its Inline Sharing Controls. When you make a post on Facebook going forward, you will have the ability to select who gets to see it. Options include Public, Friends, and Custom, and will grow to include Facebook Lists in the near future.

In the past, once a post was posted you could not change the sharing settings. Now, you are given the option to change those settings after you hit ‘Post.’ This will allow you to stop that secret message for your best friends going out to everyone on the internet.

The last change Facebook announced is a change in the way you handle your profile visibility. In the past, if you wanted to see what your profile looked like to the public, it was hard to do. Now, you will have a button on your Facebook profile to access these previews. This button is labeled ‘View Profile As…’, and will do just what I described.

Facebook: Now More Privacy Friendly

There you have it. Facebook is now working very hard to help users get more control over their content. These changes are, together, the most sweeping sharing and privacy changes Facebook has ever released. These new features will be released to all users over the next few days, starting today. When you receive them, you will get a walkthrough to see all the new changes.

What do you think of Facebook’s changes? Are you happy to see this kind of user privacy become a priority at Facebook? Is there a change you were hoping to see sometime soon? Let us know what you think in comment section below.

Google+ recently caused privacy concerns with its unique idea of tagging and sharing. Name-tagging people in a Picasa Web Albums exposes the entire album to the public in Google+ quite badly. Once you name-tag someone in a Picasa Web Album, your entire album becomes publicly visible to people tagged in the album. Not only this, people can also reshare all other photographs from those albums in which they are tagged.

In its Picasa help document, Google claims “Tagging is sharing”. Since when is that? Well, that is since Google+ came to be.

Google has recently taken interest in this problem. Their reply at the help forum says,

The Google+ project is currently in Field Trial and we’re making rapid iterations on feedback we’ve received. We’re aware of the requests for more control over who can share albums and we’re working to address this.

That does not give an assurance for a fix but it echoes the fact that Google+ is open for change at the moment. Google+ has also listed a few dubious  suggestions like deleting your Picasa Web album or downgrading to move out of Google Plus. Either way, the solution to a problem cannot be another bigger problem, which is exactly what is being suggested here.

Google+ has a nice networking site going on. People love the concept of circles. They appreciate huddles and are intrigued by how simple, yet how elegant the entire Google+ system is. Fresh out of the incubator and that too half-baked, Google+ needs some more honing before it can go mainstream. Bugs keep springing up every now and then. However, bugs with a privacy concerns edge are dangerous. They attract a lot of negative press.

Google should work fast to resolve this issue and nip it in the bud. The issues can be seen on the Google Picasa Support forum at  this link.

The Nissan LEAF (Leading, Environmentally friendly, Affordable, Family) car is currently being put through the paces in the hands of Casey Halverson, a network engineer at InfoSpace. At the heart of the LEAF is CARWINGS, a “telematics system” used for plotting and displaying various internal functions such as energy consumption, charge status as well as the ability to display content pulled from the internet.  Nissan has taken the technology of the car and is attempting to empower users with it by providing information about the car instantly through iPhone apps and an always-connected web app. Unfortunate for many LEAF owners, it would seem that Nissan may have overlooked customer privacy when developing the system.

In addition to requesting data through an RSS feed, CARWINGS takes it upon itself to pass along your current location in the form of  GPS co-ordinates, speed, direction and more. What’s worse, is that any configured feed is given the information and it can be harvested by third parties.

While there are many legitimate uses for providing these details, such as location-aware feeds for weather, driving directions or even traffic details – it would seem that at no time is this told to users and no option is available for opting out.

A video documentation shows off CARWINGS in use, set up with a simple feed that takes the information the LEAF has stored and provides it back to the user. Whether or not LEAF owners will consider this a gross invasion of privacy due to how such information can be leverage or if they find it a nice luxury that they don’t have to enter in their current location to see it’s raining will largely depend on how Nissan explains to the general customer why they share this information.

Mark Zuckerberg, Facebook founder, wants kids under 13 years of age to be allowed to use social networking sites. Though there are millions of kids already using Facebook who are under 13, Zuckerberg wants to make it legal as Children’s Online Privacy Protection Act (COPPA)  restricts websites from collecting personal information of children under the age of 13.

According to  Fortune, Zuckerberg said he wants younger kids to be allowed on social networking sites like Facebook. Currently, the Children’s Online Privacy Protection Act (COPPA) mandates websites that collect information about users aren’t allowed to sign on anyone under the age of 13. But Zuckerberg is determined to change this.

Zuckerberg’s philosophy is that for education, kids need to start learning at a very young age. Allowing kids onto social networking site, will help them learn new things quickly.

“Education is clearly the biggest thing that will drive how the economy improves over the long term,” Zuckerberg said.

Right or wrong, but I’m sure parents won’t like their kids using Facebook or any other social networking sites at a very young age because they might get addicted to it (You know, there are many useless games on Facebook). With a number of scams spreading on Facebook, I don’t think it’s safe for children to use it. Mark Zuckerberg should rather be concerned about on how he could prevent Facebook from scams.

The United States Government’s National Security Agency (aka the where-privacy-goes-to-die agency) is apparently building a new supercomputer called the for its High Performance Computing Centre. The supercomputer will cost about $895.6 million, as revealed by unclassified documents. The supercomputer is to be built at the headquarters of the agency in Fort Meade, Md. and is slated for completion by 2015.

The NSA is a surveillance organization (to use a nonspecific and broad generalization) that has been operating since 1952 and is responsible for the decryption of foreign intelligence and the safeguarding and encryption of USA’s domestic signals. The agency has a history of using supercomputers, starting with the purchase and use of one of the first Cray supercomputers (The Cray X-MP/24) which is now decommissioned and is on display at the National Cryptologic Museum.

While exactly how large this computer that the NSA is building is unknown, it is very likely that the computer will be able to perform at 1 exaFLOP. A FLOP, or FLoating point OPerations per Second is a measure of how fast a computer is. It is basically the number of floating point calculations performed in unit time by the computer. A simple hand-held calculator is about 10 FLOPS on an average to show instantaneous results.

An exaFLOP is 10 followed by 18 zeroes (10^18)

In comparison, the combined computing power of the top 500 supercomputers in the world is about 32.4 petaFLOPS (32.4 x 10^15). That is, the new supercomputer being constructed by the NSA is about 31 times faster than the top 500 supercomputers in the world taken together.

However, all this is still speculation, garnered by the power requirements for the new computer about 60 megaWatts. The calculation is based on the Sequoia BlueGene/Q IBM supercomputer that is also under production that needs performs around 20 petaFLOPS and needs 6 megaWatts of power.

Of course, the NSA needs more computing power to sift through all the emails, phone calls and messages we send each day, right?

The internet has always been obsessed about itself. Its narcissistic tendencies have been the driving factor in the making of data visualization about its own technologies, semantic web technology and other endless lists full of the emerging science of the hive mind and the self’s position in this meta-world.

Did you understand that previous paragraph? I sure didn’t but that’s how you start these intellectual and deep posts about the internet, data and other characters of the philosophical nature of the World Wide Web.

However, we are not talking about the philosophical nature of the World Wide Web. We are here to talk about the launch of an extremely new kind of experimental game that takes social browsing and networking to a completely new level.

Meta Assassins is a new appthat promises to rid you of your social life, more or less. It is a game in which gamers will be given specific targets (other gamers), who will surf the web. Your job is to track your quarry to the site they are on and kill them in a [virtual] shootout. But, beware you are also someone’s target. You accomplish all this with a Google Chrome or Mozilla Firefox plugin.

The game is currently on a hiatus from the 12th of February. The short playtesting stint was apparently a success, so the developers will be making a redoubled effort into a new avatar.

Although the game works mostly on the world wide web, the amount of data privacy issues this could cause if it were not a game is quite staggering. I would totally turn this into a Hollywood blockbuster (given the right amount of nudging here and there), call it Meta Assassins, and mint money.

If you are interested in this, do check their web page out.