‘Honesty app’ Sarahah is dishonest, as it uploads your phone contacts to the server
Sarahah, the anonymous feedback messaging app, is all over the place. Be it Facebook, Twitter, Instagram or Snapchat, everyone is talking about the app for the past couple of weeks.
For those unaware, ‘Sarahah’ – means ‘honesty’ in Arabic, is an app that allows the users to send anonymous messages to others registered with the app. Created by Saudi Arabian developer Zain al-Abidin Tawfiq, the app is aimed to help people identify their strengths and weaknesses. However, users have no way of knowing who sent the message or how to reply to them. The app is available in two languages, English and Arabic, for iOS and Android users.
โSarahah helps you in discovering your strengths and areas for improvement by receiving honest feedback from your employees and your friends in a private mannerโ, the app description explains.
However, it now appears that the app is collecting more just than feedback messages. Apparently, the app is uploading usersโ phone numbers and email addresses in the address book to the companyโs servers, which was spotted by Zachary Julian, a senior security analyst at Bishop Fox when he installed the app on his Android smartphone, a Galaxy S5 running Android 5.1.1.
When this news was reported by The Intercept, Zain al-Abidin Tawfiq responded by tweeting that the contact lists were being uploaded โfor a planned โfind your friendsโ feature.โ However, the removal of the functionality was โdelayed due to a technical issue.โ He now claims that the functionality has removed from the server and the data request will be removed in a future release. He also tweeted that Sarahah currently stores no contacts in its databases, which is impossible to verify.
Sarahah uploading address book data from The Intercept on Vimeo.
Julian discovered the behaviour of Sarahah by using BURP Suite, a traffic analyzer, which intercepts internet traffic entering and leaving the device, allowing the owner to see what data is sent to remote servers. When Julian launched Sarahah on the device, BURP Suite caught the app in the act of uploading his private data.
โAs soon as you log into the application, it transmits all of your email and phone contacts stored on the Android operating system,โ he said. The same occurrence was later determined on Appleโs iOS too, although after a prompt to โaccess contacts,โ which also appears in newer versions of Android.
The above occurrence clears that the app is somewhere interested in your contacts. For instance, on iOS, the app says โthe app needs to access your contacts to show you who has an account in Sarahah,โ and allows the user to select between โOkayโ and โDonโt allow.โ On the other hand, in some cases on Android, the app requests access to contacts without providing any explanation for needing such access, while in other cases it makes no such request. On both iOS and Android, there is no mention of data being uploaded to a server.
โThe privacy policy specifically states that if it plans to use your data, itโll ask for your consent,โ Julian said. โWhile the appโs entry in Googleโs Play Store does indicate the app will access contacts, thatโs not โenough consentโ to justify โsending all of those contacts over without any kind of specific notification,โ he added. On the other hand, the app on iOS platform claims to use contact data in the userโs address book to show them their list of friends using Sarahah, which it actually does not do, reveals the testing done by Julian.
Even though the appโs privacy policy states that, โWe will never sell the data you provide to any third party as part of personal marketing without your prior and written consent unless it was a part of bulk data used for statistics and research and it won’t contain any data to identify you,โ it is not completely clear as to what Sarahah uses uploaded contact lists for.
For those who really want to use Sarahah and are concerned about their privacy can take comfort from the fact that they do not require to download the app to use the service. You can instead register yourself on Sarahah via a website after which you be allowed to send and receive messages. The site doesnโt ask for or require access to your contacts in the digital address books for you to use Sarahah.