7 ms·

Doesn't this mean that anybody agreeing to those terms needs to ask permission from each and everybody in their address book? And if they don't, can I sue them

Doesn't this mean that anybody agreeing to those terms needs to ask permission from each and everybody in their address book? And if they don't, can I sue them (at least in the EU) or ask my contact to be removed before the agree to the terms?

yulaow 6y ago
technically it is facebook in violation of GDPR considering that all the data in the addressbook is easily considered personal data for a commercial entity and so facebook should ask the permission to each owner of those numbers before collecting them.
- omk 6y ago
  https://faq.whatsapp.com/general/contacts/about-contact-upload https://faq.whatsapp.com/general/contacts/about-contact-uplo... Based on this they do not store information of users who have not signed up and only store a cryptographic hash. The hash isn't created on the device, so the servers definitely get it.
  - stiray 6y ago
    Just a small detail about cryptographic hash: https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;" Cryptographic hash of phone number is still uniquely identifying natural person and is by GDPR still under the definition of personal data. The GDPR authors knew what they were doing - or they were lucky although also other parts of GDPR suggest that they had some technical think-tank behind it. Anyway, hashing doesn't solve anything, whatever "obfuscation" is used/invented, as long as information points to "natural person" it is considered personal data.
  - pfortuny 6y ago
    There are just 10^9 phone numbers in Spain. Say 0.01 sec/hash (which is A LOT), you have 10^8 seconds. You can decrypt all the hashes in 0.3 years... "Cryptographic hash" is as bullshit as "MD5 encrypted passwords".
    - daemin 6y ago
      Or you know just create a rainbow table of all the phone numbers in the world and match the hashes against that. Would probably be faster.
    - Rygian 6y ago
      If I'm being optimistic, the hashes of a user's contacts are salted with the user's own phone number, so the space could be 10^18.

yulaow 6y ago

technically it is facebook in violation of GDPR considering that all the data in the addressbook is easily considered personal data for a commercial entity and so facebook should ask the permission to each owner of those numbers before collecting them.

omk 6y ago
https://faq.whatsapp.com/general/contacts/about-contact-upload https://faq.whatsapp.com/general/contacts/about-contact-uplo... Based on this they do not store information of users who have not signed up and only store a cryptographic hash. The hash isn't created on the device, so the servers definitely get it.
- stiray 6y ago
  Just a small detail about cryptographic hash: https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;" Cryptographic hash of phone number is still uniquely identifying natural person and is by GDPR still under the definition of personal data. The GDPR authors knew what they were doing - or they were lucky although also other parts of GDPR suggest that they had some technical think-tank behind it. Anyway, hashing doesn't solve anything, whatever "obfuscation" is used/invented, as long as information points to "natural person" it is considered personal data.
- pfortuny 6y ago
  There are just 10^9 phone numbers in Spain. Say 0.01 sec/hash (which is A LOT), you have 10^8 seconds. You can decrypt all the hashes in 0.3 years... "Cryptographic hash" is as bullshit as "MD5 encrypted passwords".
  - daemin 6y ago
    Or you know just create a rainbow table of all the phone numbers in the world and match the hashes against that. Would probably be faster.
  - Rygian 6y ago
    If I'm being optimistic, the hashes of a user's contacts are salted with the user's own phone number, so the space could be 10^18.