Mikey Campbell
On the day of Path's $800,000 settlement with the U.S. Federal Trade Commission, a new security issue has been discovered in which a user's location may be posted alongside uploaded photos even when Location Services has been disabled.
Update: Path has informed AppleInsider that an updated version of the app is now available on the App Store after having been pushed to and accepted by Apple.
The apparent flaw was found by security researcher Jeffrey Paul, who detailed the backend problem that allows Path's iOS app to geotag a user's photos without permission. Paul's discovery is of particularly poor timing for Path, as the popular social network is once again in the news for settling with the FTC over similar privacy concerns.
Path’s iOS app will use the embedded EXIF tag location information from photos in the iOS Camera Roll to geotag your posts, even when you’ve explicitly disabled Location Services for the Path application. (The app knows, of course, that it’s not getting location data via normal means from Location Services, yet behaves this way even in that case.)According to The Next Web, Path has been made aware of the discrepancy and is looking into how to correct it. In a follow-up post to Paul's blog, Path Product Manager Dylan Casey was careful to point out that the app was not recording the location information of its users, the reason for the company's settlement with the FTC.
We take user privacy very seriously here at Path. Here is what we have discovered and how we are responding:
1. We were unaware of this issue and have implemented a code change to ignore the EXIF tag location.
2. We have submitted a new version with this fix to the App Store for approval.
3. We have alerted Apple about the concerns you’ve outlined here and will be following up with them.
One note to clarify: If a Path user had location turned off and an image was taken with the Path camera, Path does not have the location data. This only affected photos taken with the Apple Camera and imported into Path.Path was at the center of a small controversy regarding the harvesting and uploading of contact data from users' address books. The system was supposedly in place to make it easier for friends to connect with one another.
As per the settlement's arrangement, in addition to the $800,000 penalty, Path is prohibited from making misrepresentations about the extent to which it maintains the privacy and confidentiality of users' personal information. Information collected from children under age 13 will be deleted, but the company has said it already removed the previously collected data.
Andrew Orr
Christine McKee
Sponsored Content
Wesley Hilliard
AppleInsider Staff
Amber Neely
10 Comments
Ars has an article up on this too. Apparently it's also an iOS issue that Apple can probably fix without too much effort. "Paul said his discovery also underscored the need for Apple to build safeguards into iOS that prevent EXIF or Exchangeable Image File format data embedded in photos from being detected by individual apps unless users explicitly approve. Apple added similar fine-grained protections last year preventing apps from accessing contacts, photos, and location data. The changes followed revelations that Path's iOS app uploaded users' entire address books to its servers, a controversy that touched off the FTC investigation resulting in Friday's settlement. Path said it has alerted Apple to Paul's concerns." http://arstechnica.com/apple/2013/02/path-promises-fix-for-new-privacy-liberties-taken-by-ios-app/
1. We were unaware that this feature, by design, would be discovered and have implemented a code change to ignore the EXIF tag location.
2. We have halfheartedly submitted a new version with this change we are legally obligated to call a fix to the App Store for approval.
3. We have alerted Apple about the concerns you've outlined here because we know they read your site and we want to come off as "on top of it" and will be following up with them.
Does this sound more accurate?
Path-etic
Why would part of the settlement be that they are not allowed to make misrepresentations about anything?!? Shouldn't that not require a settlement?
Why would part of the settlement be that they are not allowed to make misrepresentations about anything?!? Shouldn't that not require a settlement?
It's their experience dealing with Google, where they learned that, especially for privacy violators, it does require a settlement, and even then it doesn't always stop them.