‘Honesty app’ Sarahah is dishonest, as it uploads your phone contacts to the server
For those unaware, 'Sarahah' - meaning 'honesty' in Arabic, is an app that allows users to send anonymous messages to others with the app. Created by Saudi Arabian developer Zain al-Abidin Tawfiq, the app is aimed to help people identify their strengths and weaknesses. However, users have no way of knowing who sent the message or how to reply to them. The app is available in two languages, English and Arabic, for iOS and Android users.
"Sarahah helps you in discovering your strengths and areas by taking the right idea from your employees and your friends in a private manner", the app description explains.
However, it now appears that the app is collecting more than just feedback messages. Apparently, the app is uploading users' phone numbers and email addresses in the company's book to the company's servers, which was spotted by Zachary Julian, a senior security analyst at Bishop Fox when he installed the app on his Android smartphone, a Galaxy S5 running Android 5.1.1.
Zain al-Abidin Tawfiq responded by tweeting that "for a planned 'find your friends' feature." However, the removal of the functionality was "delayed due to a technical issue. "He now claims that the functionality is removed from the server and the data request will be removed in a future release. He also tweeted that Sarahah currently stores no contacts in its databases, which is impossible to verify.
Julian discovered the behaviour of Sarahah using BURP Suite, a traffic analyzer, which intercepts internet traffic entering and leaving the device, allowing the owner to see what data is sent to remote servers. When Julian launched Sarahah on the device, BURP Suite caught the app in the uploading of his private data.
"As soon as you log into the application, it transmits all the email and phone contacts stored on the Android operating system," he said. The same occurrence was later determined on Apple's iOS, although after a prompt to "access contacts", which also appears in newer versions of Android.
The above occurrence clears that the app is somewhere interested in your contacts. For instance, on iOS, the app says "the app needs access to Sarahah," and allows the user to choose between "Okay" and "Do not allow." On the other hand , in some cases on Android, the app requests access to contacts without needing such access, while in other cases it makes no such request. On both iOS and Android, there is no mention of data being uploaded to a server.
"The privacy policy specifically states that if it plans to use your data, it'll ask for your consent," Julian said. "While the app's entry in Google's Play Store does indicate the app will access contacts, that's not" enough consent "to justify" sending all of those contacts over without any kind of specific notification, "he added. On the other hand, the app on iOS platform claims to use contact information in the user's address book to show them their list of friends using Sarahah, reveals the testing done by Julian.
Even though the app's privacy policy states that, "We will never sell the data you without a third party without your prior and written consent unless it is a bulk of data used for statistics and research and it won ' t contain any data to identify you, "it is not clear as to what Sarah uses uploaded contact lists for.
For those who really want to use Sarahah and are concerned about their privacy can take comfort from the fact that they do not need to download the app to use the service. You can replace yourself on Sarah via a website after which you will be allowed to send and receive messages. The site does not ask for or require access to your contacts in the digital address books for you to use Sarahah.
Comments
Post a Comment