Color App Vulnerable to “Geo-spoofers”

Actual location not a barrier for photo sharing

Josh Wolford | March 29, 2011 @ 10:38am

It has been well documented that if privacy is what you want, the Color app is not for you.  Color, of course, is the much talked about new app that allows users to share photos effortlessly with anyone and everyone in their vicinity.

Well, apparently that last part is a bit malleable.

Turns out the perception of one’s location is good enough to fool Color into letting you invade photostreams anywhere, anytime.  Within hours of its release, Veracode CTO Chris Wysopal tweeted:

@WeldPond
Chris Wysopal@threatpost with trivial geolocation spoofing the auth model of Color is broken 4 days ago via TweetDeck · powered by @socialditto

When he tested it out, he found that he could go anywhere and see anything – much easier than expected.  He used a jailbroken iPad and an app called FakeLocation.  With this app, he was allowed to bypass the iPad’s GPS and set his location to anywhere in the world.

I’m sure most of you can see where this is going.

When he opened the Color app, bingo!  He could now browse all the photos from an area hundreds of miles away.  “This only took about five minutes to download the FakeLocation app and try a few locations where I figured there would be early adopters who like trying out the latest apps,” Wysopal told Forbes’ Andy Greenberg. “No hacking involved.”

To prove his success, Wysopal (in New York City) sent Greenberg a screencap of Color CEO Bill Nguyen’s photostream (Palo Alto, California):

Once again, this “cheat” is not ruffling any feathers over at Color headquarters.  As a spokesman said to Forbes, they never promised privacy.  “It is all public, and we’ve been very clear about that from the very beginning. Within the app, there’s already functionality to look through the entire social graph. Very few people will probably do what you’re saying, but all the pictures, all the comments, all the videos are out there for the public to see.”

And how many Color users, happy to share their photos with any stranger around them, would really care that the stranger lives in another state – or country?

Color Privacy – If Privacy Is Your Thing, Color May Not Be For You

Color: Don't Want to Share Publicly? Don't Use it.

Chris Crum | March 25, 2011 @ 11:42am

Social media and privacy don’t tend to play well together, as we’ve seen in the past. Sure, there are always privacy settings, but these are usually emphasized as an afterthought. Things are a bit different with Color, however.

No, color doesn’t have a strict emphasis on privacy. In fact, it’s just the opposite. Color’s stance is basically: if you want privacy, use something else.

Color says it collects the name you give them when you set up the app, your email address, pictures, videos, comments, and actions you take through the app (the content), and location info. When a user has the app active, their device sends Color’s server their location, and Color shares content with others. “Sharing Content publicly with others from different locations is what this App is about,” the company says. ” If you find this objectionable, please consider not using our App or Site.” (emphasis added)

Here’s more on what they share and collect, directly from the Color privacy policy:

HERE’S WHAT WE (AND YOU) SHARE WITH OTHERS: We share the name you give us when you set up the App on your Device, your Content, and possibly, the location from which your Content was created. Our App also allows you to share your name and Content on some social media sites. If you choose to use this function, we neither store nor share the information you input to access those sites through our App.

HERE’S WHAT WE COLLECT WHEN YOU ACCESS OUR SITE: The usual stuff. Like most online companies, we capture your browser and operating system information, and your IP address. We also collect cookies, which are tiny data files your computer sends us. We use cookies to customize your experience on our Site. If you want to disable the cookies, follow the directions on your browser. Currently, you don’t need a login and password to visit our Site, (but we’re considering it). Stay tuned.

HERE’S WHAT WE COLLECT IF YOU LET US: If you say it’s OK, we’ll store your mobile number. That way, if you lose or replace your Device, we can re-associate your past activity and Content with your new Device. We won’t call you. We also collect information from your Device’s address book. We think you might be interested in seeing your friends’ Content. By collecting your mobile number and address book information, and linking it to your Device, our software makes the Content you see more relevant to you, and you’ll be able to use certain SMS functions we’re cooking up. It also allows you to link your Color experience to your other online social experiences. If you’re not OK with this, just say no and we won’t do it.

As is the case with most privacy sacrifices from social products, it’s essentially a trade-off of privacy for user experience.

“In many ways they are inviting the privacy tension, but it is memory about things made public that creates both a level of utility and more significant harm,” said SocialText CEO Ross Mayfield in another article we ran. “I wonder how much they have thought it through. Some like LinkedIn did, others died, other blasted through it regardless.”

One more interesting point brought up in Color’s privacy policy is that if Color is acquired or if it acquires another company, these other entities will gain the same info that Color has already collected. Pretty standard, but it does seem to suggest that Color is not launching with a not-for-sale sign.

CEO Ben Nguyen’s previous company, Lala, was acquired by Apple. I’m guessing there will be a number of potential buyers for Color if the price is right. As John Battelle said in a post about Color, “Note to Facebook, Twitter, and Foursquare: If you don’t get this feature into your service, pronto, you will more likely than not be rueing the day Color launched.”

Color promises to update users as its policy changes. It was last updated earlier this week. Privacy concerns can be sent to privacy@color.com.