Color App Vulnerable to “Geo-spoofers”

Actual location not a barrier for photo sharing

Josh Wolford | March 29, 2011 @ 10:38am

It has been well documented that if privacy is what you want, the Color app is not for you.  Color, of course, is the much talked about new app that allows users to share photos effortlessly with anyone and everyone in their vicinity.

Well, apparently that last part is a bit malleable.

Turns out the perception of one’s location is good enough to fool Color into letting you invade photostreams anywhere, anytime.  Within hours of its release, Veracode CTO Chris Wysopal tweeted:

@WeldPond
Chris Wysopal@threatpost with trivial geolocation spoofing the auth model of Color is broken 4 days ago via TweetDeck · powered by @socialditto

When he tested it out, he found that he could go anywhere and see anything – much easier than expected.  He used a jailbroken iPad and an app called FakeLocation.  With this app, he was allowed to bypass the iPad’s GPS and set his location to anywhere in the world.

I’m sure most of you can see where this is going.

When he opened the Color app, bingo!  He could now browse all the photos from an area hundreds of miles away.  “This only took about five minutes to download the FakeLocation app and try a few locations where I figured there would be early adopters who like trying out the latest apps,” Wysopal told Forbes’ Andy Greenberg. “No hacking involved.”

To prove his success, Wysopal (in New York City) sent Greenberg a screencap of Color CEO Bill Nguyen’s photostream (Palo Alto, California):

Once again, this “cheat” is not ruffling any feathers over at Color headquarters.  As a spokesman said to Forbes, they never promised privacy.  “It is all public, and we’ve been very clear about that from the very beginning. Within the app, there’s already functionality to look through the entire social graph. Very few people will probably do what you’re saying, but all the pictures, all the comments, all the videos are out there for the public to see.”

And how many Color users, happy to share their photos with any stranger around them, would really care that the stranger lives in another state – or country?

Implicit Social Graphs Rise From Interest Not Location

Color Launch Generates New Round of Social Graph Discussion

Rob Diana | March 25, 2011 @ 10:49am

There has been a ton of conversation about social graphs, location and photo sharing lately. Most of this conversation has arisen due to the release of the photo-sharing application Color. The photo-sharing part of the discussion is only a gateway to the larger discussion of social graphs. I have been looking at the basic location-based applications a lot as well. Facebook Places, Google Places, and Foursquare are all fighting for the location crown. Granted, location-based applications are becoming very popular, but they were quickly outpaced by the group discount services like Groupon and Living Social. There is a very good reason for this as well. Location alone does not denote interest or intent. This is also why implicit social graphs are so important, they are based on interest or intent. Group discount services have a location aspect, but they are driven by interest and intent. All of the people involved in buying a discount have interest in what they are purchasing.

This is also why Color’s launch was received with such mixed reviews. They are trying to use location as the implicit social graph, but there is no real interest. Even if there are several people at the same location, the location may denote different purposes. As an example, if I am at a restaurant I probably do not want the interruption that would come with a location based graph. However, if I am visiting a tourist attraction I may welcome the location-based interaction, mainly because there is implicit interest in the location.

Fred Wilson has a very good description of how he was introduced to implicit graphs:

My first experience with this sort of implicit social graph came almost six years ago via my musical neighbors graph at last.fm. I don’t think I actually know any of these people in real life, but they are the last.fm users who have the closest taste to mine in music, right now. That right now is important because my musical neighbors graph looked differently last year and will look differently next year.

Obviously, people’s musical tastes change over the years, so a static graph is not entirely useful. The “musical neighbors” concept and Pandora’s music genome concept allow for discovery because they are using similar interests to create the implicit graph. A person’s friends may not have the same musical tastes and thus would actually clutter the listening experience with music the listener is not interested in.

In addition to the creation of implicit graphs, sometimes there needs to be a conversion from the implicit to the explicit graph. Colin Walker talks about this in reference to sporting events and other interest-based interactions:

Repeated interactions within implicit graphs can lead to a bleed from the implicit to explicit – once you get to know them some of those from implicit graph become ‘friends’ and, after a while, can be invited over in to the explicit graph.

This bleeding complicates the structures of explicit graphs because these new “friends” are not initially the same type of friends as those people you have known for years. Then there are some people in your explicit social graphs that you lose contact with. Even though they could have been friends previously, differing interests and the effects of time can change their relationship to you. This is where the concepts behind Color become interesting. Obviously, there needs to be some flexibility or “elasticity” in your social graphs, regardless of whether the graph is explicit or implicit. Color CEO Bill Nguyen had an interesting comment about this in a ReadWriteWeb article:

In the world of Facebook, once someone is your friend, they’re your friend until you return and re-evaluate that relationship, regardless of whether or not you’ve ever spoken to them again. In reality, the relationship could have fizzled long ago, yet it’s still a bond as good as any. With Color’s “elastic” social graph, these ties can fade and disappear. Color’s ability to accurately determine location and user proximity is what makes this sort of social graph – an implied, impermanent and elastic social graph – even possible.

As I previously stated, I do not agree with the importance of location in this quote, but the general concept is important. Location and time can both be an attribute of the implicit social graph, as can be seen with the SXSW conference. Just because you are in Austin does not mean that you share the social graph with a bunch of people. However, if you happen to be near specific locations in Austin during the same time as the SXSW conference and you have previously shown interest in web and technology startups, then you would be part of the same implicit social graph. Without the interest part of the equation, you could become part of the implicit graph purely by coincidence, maybe you work or live in Austin.

Om Malik has an excellent post this morning that really hits the same points, but talks about them differently. He mentions “happiness” and “utility”:

One of the reasons Instagr.am works is because it has that “happiness” attached to it. When I see my friend’s baby boy, it brings me joy. I see Mathew Ingram at an ice hockey game; it makes me warms my heart to see him enjoying time with his family. I reward Instagr.am with my attention because it makes me happy. That is its utility.

His examples and Fred Wilson’s examples are excellent reasons why some social applications really work well and others don’t get traction.  Implicit social graphs are really driven by interests where time and location can be attributes of that interest but they are not the primary definition of that interest.

Color Privacy – If Privacy Is Your Thing, Color May Not Be For You

Color: Don't Want to Share Publicly? Don't Use it.

Chris Crum | March 25, 2011 @ 11:42am

Social media and privacy don’t tend to play well together, as we’ve seen in the past. Sure, there are always privacy settings, but these are usually emphasized as an afterthought. Things are a bit different with Color, however.

No, color doesn’t have a strict emphasis on privacy. In fact, it’s just the opposite. Color’s stance is basically: if you want privacy, use something else.

Color says it collects the name you give them when you set up the app, your email address, pictures, videos, comments, and actions you take through the app (the content), and location info. When a user has the app active, their device sends Color’s server their location, and Color shares content with others. “Sharing Content publicly with others from different locations is what this App is about,” the company says. ” If you find this objectionable, please consider not using our App or Site.” (emphasis added)

Here’s more on what they share and collect, directly from the Color privacy policy:

HERE’S WHAT WE (AND YOU) SHARE WITH OTHERS: We share the name you give us when you set up the App on your Device, your Content, and possibly, the location from which your Content was created. Our App also allows you to share your name and Content on some social media sites. If you choose to use this function, we neither store nor share the information you input to access those sites through our App.

HERE’S WHAT WE COLLECT WHEN YOU ACCESS OUR SITE: The usual stuff. Like most online companies, we capture your browser and operating system information, and your IP address. We also collect cookies, which are tiny data files your computer sends us. We use cookies to customize your experience on our Site. If you want to disable the cookies, follow the directions on your browser. Currently, you don’t need a login and password to visit our Site, (but we’re considering it). Stay tuned.

HERE’S WHAT WE COLLECT IF YOU LET US: If you say it’s OK, we’ll store your mobile number. That way, if you lose or replace your Device, we can re-associate your past activity and Content with your new Device. We won’t call you. We also collect information from your Device’s address book. We think you might be interested in seeing your friends’ Content. By collecting your mobile number and address book information, and linking it to your Device, our software makes the Content you see more relevant to you, and you’ll be able to use certain SMS functions we’re cooking up. It also allows you to link your Color experience to your other online social experiences. If you’re not OK with this, just say no and we won’t do it.

As is the case with most privacy sacrifices from social products, it’s essentially a trade-off of privacy for user experience.

“In many ways they are inviting the privacy tension, but it is memory about things made public that creates both a level of utility and more significant harm,” said SocialText CEO Ross Mayfield in another article we ran. “I wonder how much they have thought it through. Some like LinkedIn did, others died, other blasted through it regardless.”

One more interesting point brought up in Color’s privacy policy is that if Color is acquired or if it acquires another company, these other entities will gain the same info that Color has already collected. Pretty standard, but it does seem to suggest that Color is not launching with a not-for-sale sign.

CEO Ben Nguyen’s previous company, Lala, was acquired by Apple. I’m guessing there will be a number of potential buyers for Color if the price is right. As John Battelle said in a post about Color, “Note to Facebook, Twitter, and Foursquare: If you don’t get this feature into your service, pronto, you will more likely than not be rueing the day Color launched.”

Color promises to update users as its policy changes. It was last updated earlier this week. Privacy concerns can be sent to privacy@color.com.