The FaceApp app has gone viral over the last day or so, especially on Twitter, with people sharing pics of themselves, and others, as they’ll look when they get old.
The pics are fun, the viral nature harmless, but there are a few questions:
- How does FaceApp gain access to your photos even if you mark access to your photo library as “Never”?
- Does FaceApp upload those photos to their servers? And what happens to those photos after FaceApp hands you back your aged version?
Matthew Panzarino does a great job exploring and explaining these issues. Personally, I think someone at FaceApp should lay all this bare in a blog post, avoid turning all this viral exposure into a black eye.
One point Matthew makes that stands out to me:
While the app does indeed let you pick a single photo without giving it access to your photo library, this is actually 100% allowed by an Apple API introduced in iOS 11. It allows a developer to let a user pick one single photo from a system dialog to let the app work on.
An app can let you pick out a single photo, even if you mark access to photos as Never. This strikes me as a decision made long before privacy was even a consideration, left in place over the years as privacy moved to the forefront.
As Panzarino points out, maybe it’s time to reconsider that option.
Absolutely. The user made a conscious decision but his preference hasn’t changed otherwise.
If FaceApp is downloading all a person’s photos though, that’s totally different and an abrogation of those preferences. This [“An app can let you pick out a single photo, even if you mark access to photos as Never”] just gets us sidetracked.
Well explained and this make a lot of common sense !
This is allowed because it is a direct and intentional user action when the user chooses a photo. The app makes a request to the system to ask the user to pick a photo. The system presents a photo picker and then returns a copy of the photo the user chooses. In no way does that app ever “see” anything other than that copy of that photo, which is saved into the apps data pool. So, “Never” still applies, as that app “never” gets access to the library.
This is how Drag&Drops works… it is an intentional user action, so the system allows it to happen. Security and privacy are great, but the system should be smart enough to know the difference when the user/owner is making a reasonable request and when an App is trying to gain access to something.
I think they recently mentioned these types of security/privacy issues and users interactions during the WWDC keynote while referring to the nightmare that was Windows Vista Security monitor. And the constant barrage of warnings and authorizations that they didn’t want to the user to deal with.
Exactly. The “access to photo libraries” permission is to the let the app itself have unfettered access to the entire photo library.
Though few applications have used it (most preferring to instead reinvent the wheel increasingly poorly), iOS has long offered the ability to instead use a system-provided photo picker which only ever exposes the photo the user selected. This doesn’t need any permissions approvals because there’s no outside code involved: it’s pure OS-to-OS interaction.
Similarly, Google’s started moving to largely deprecate direct photo library access in favor of a system-provided picker on Android.
No, Dave, this isn’t time to reconsider. Intent based security should be even more common in iOS.
Yeah, I can’t see a problem with letting *the user and only the user* pick a photo, even if the user has also marked it “never”.
“Never” means “never let software do it for me”, not “don’t let ME do that”.