Sarahah app has been all the craze lately and you have probably used it at one point in time. Well, it has emerged that the famous app actually uploads your contacts phone numbers and emails in the background without your knowledge.
In case you have no idea what Sarahah is, it’s an app that lets people sign up to receive anonymous messages. The app prides itself with the slogan, “Get honest feedback from your coworkers and friends.” Sarahah has so far garnered around 18 million downloads on both iOS and Android.
Contrary to its honesty claim, when you launch Sarahah app for the first time, it immediately uploads all phone numbers and email addresses in your address book. Zachary Julian, a senior security analyst at Bishop Fox did an analysis on the app and made the discovery. He says that as soon as you log into the app, it transmits all of your email and phone contacts stored your phone. Julian also noticed that if you haven’t used the app in a while, it uploads all of your contacts again.
“Sarahah has between 10 and 50 million installs on just the Play Store alone for Android, so if you extrapolate that number, it could easily get into hundreds of millions of phone numbers and email addresses that they’ve harvested,” Julian said.
Sarahah’s creator, Zain al-Abidin Tawfiq, responded to these claims in a tweet saying, “Sarahah App asked for contacts for a planned ‘find your friends’ feature… It was delayed due to a technical issue. The database doesn’t currently host contacts and the data request will be removed on next update.”
Sarahah App asked for contacts for a planned "find your friends" feature
— Zain-Alabdin زين العابدين (@ZainAlabdin878) August 27, 2017
The Intercept later spoke to Zain and he informed them that “the feature was stymied by ‘technical issues’ and that a partner, who he has since stopped working with, was supposed to remove it from the app but ‘missed that.’ He claims the functionality was, however, removed from the server and that Sarahah stores no contacts in its databases.”
Interestingly, on iOS, Sarahah claims that it needs to access your contacts to show you who has an account in Sarahah but does not mention anything about uploading your data. However, the app does not actually show you who in your address book is on Sarahah. On Android, the app requests access to contacts without giving any reason for requiring such access.
Advice for those who still insist on using Sarahah, you can use the web app which will not have access to your contacts and you can still send and receive messages.
