Short Bytes: The anonymous feedback app Sarahah has been in controversies since its popularity exploded. After the allegations of cyber bullying, a security researcher has found that Sarahah keeps uploading your email and phone contacts to its servers. This action is surprising as the app doesn’t make any apparent use of the contacts. The app’s founder has said that the functionality will be removed in the next release.
Earlier this month, viral anonymous app Sarahah took the internet by storm when its popularity rose exponentially. The teenagers, as well as adults, were engrossed in this Sarahah-mania to receive “anonymous” feedback from their friends and co-workers.
While Sarahah app was already criticized for its possible aid in cyber bullying incidents, a new revelation has been made by a senior security analyst. As reported by The Intercept, Zachary Julian found out that Sarahah is collecting the private information of users.
As soon as you launch the app for the first time, Sarahah immediately uploads all the phone numbers and email addresses in your phone book. While it asks for user-permission for the access, it doesn’t disclose the upload act.
Moreover, Sarahah doesn’t even make any apparent and functional use of the uploaded data. Julian discovered the same when he installed Sarahah app on his Android smartphone, which was a Samsung Galaxy S5 running Android 5.1.1. Using BURP Suite, he was able to intercept the incoming and outgoing internet traffic.
Sarahah performs this sneaky action on iOS devices as well. It’s worth noting that if a person doesn’t use the app for some time, it shares the contacts again.
On iOS, the app says, “the app needs to access your contacts to show you who has an account in Sarahah.” It doesn’t do so. On Android, the app, in some cases, makes a request to access contacts without giving any reason.
After this revelation, app’s creator, Zain al-Abidin Tawfiq, said that the functionality will be removed in a future update. He further said that the feature was intended for a “find your friends” feature, something that doesn’t exist at the moment. The validity of Tawfiq’s statements is impossible to verify.
While such acts of uploading contacts by applications aren’t uncommon, it’s concerning if that app isn’t making any use of the information. Apart from worrying about the security of data on your device, you also need to worry about the integrity of the company who has your data.
Did you find this story on viral Sarahah app useful? Don’t forget to share your views and concerns with us.
