Sarahah app uploads your address book without your knowledge

‘Honesty app’ Sarahah is dishonest, as it uploads your phone contacts to the server

Sarahah, the anonymous feedback messaging app, is all over the place. Be it Facebook, Twitter, Instagram or Snapchat, everyone is talking about the app for the past couple of weeks.

For those unaware, ‘Sarahah’ – means ‘honesty’ in Arabic, is an app that allows the users to send anonymous messages to others registered with the app. Created by Saudi Arabian developer Zain al-Abidin Tawfiq, the app is aimed to help people identify their strengths and weaknesses. However, users have no way of knowing who sent the message or how to reply to them. The app is available in two languages, English and Arabic, for iOS and Android users.

โ€œSarahah helps you in discovering your strengths and areas for improvement by receiving honest feedback from your employees and your friends in a private mannerโ€, the app description explains.

However, it now appears that the app is collecting more just than feedback messages. Apparently, the app is uploading usersโ€™ phone numbers and email addresses in the address book to the companyโ€™s servers, which was spotted by Zachary Julian, a senior security analyst at Bishop Fox when he installed the app on his Android smartphone, a Galaxy S5 running Android 5.1.1.

When this news was reported by The Intercept, Zain al-Abidin Tawfiq responded by tweeting that the contact lists were being uploaded โ€œfor a planned โ€˜find your friendsโ€™ feature.โ€ However, the removal of the functionality was โ€œdelayed due to a technical issue.โ€ He now claims that the functionality has removed from the server and the data request will be removed in a future release. He also tweeted that Sarahah currently stores no contacts in its databases, which is impossible to verify.

Sarahah uploading address book data from The Intercept on Vimeo.

Julian discovered the behaviour of Sarahah by using BURP Suite, a traffic analyzer, which intercepts internet traffic entering and leaving the device, allowing the owner to see what data is sent to remote servers. When Julian launched Sarahah on the device, BURP Suite caught the app in the act of uploading his private data.

โ€œAs soon as you log into the application, it transmits all of your email and phone contacts stored on the Android operating system,โ€ he said. The same occurrence was later determined on Appleโ€™s iOS too, although after a prompt to โ€œaccess contacts,โ€ which also appears in newer versions of Android.

The above occurrence clears that the app is somewhere interested in your contacts. For instance, on iOS, the app says โ€œthe app needs to access your contacts to show you who has an account in Sarahah,โ€ and allows the user to select between โ€œOkayโ€ and โ€œDonโ€™t allow.โ€ On the other hand, in some cases on Android, the app requests access to contacts without providing any explanation for needing such access, while in other cases it makes no such request. On both iOS and Android, there is no mention of data being uploaded to a server.

โ€œThe privacy policy specifically states that if it plans to use your data, itโ€™ll ask for your consent,โ€ Julian said. โ€œWhile the appโ€™s entry in Googleโ€™s Play Store does indicate the app will access contacts, thatโ€™s not โ€œenough consentโ€ to justify โ€œsending all of those contacts over without any kind of specific notification,โ€ he added. On the other hand, the app on iOS platform claims to use contact data in the userโ€™s address book to show them their list of friends using Sarahah, which it actually does not do, reveals the testing done by Julian.

Even though the appโ€™s privacy policy states that, โ€œWe will never sell the data you provide to any third party as part of personal marketing without your prior and written consent unless it was a part of bulk data used for statistics and research and it won’t contain any data to identify you,โ€ it is not completely clear as to what Sarahah uses uploaded contact lists for.

For those who really want to use Sarahah and are concerned about their privacy can take comfort from the fact that they do not require to download the app to use the service. You can instead register yourself on Sarahah via a website after which you be allowed to send and receive messages. The site doesnโ€™t ask for or require access to your contacts in the digital address books for you to use Sarahah.

Kavita Iyer
Kavita Iyerhttps://www.techworm.net
An individual, optimist, homemaker, foodie, a die hard cricket fan and most importantly one who believes in Being Human!!!

Read More

Suggested Post