FaceApp Lets You ‘Age’ a Photo by Decades. Does It Also Violate Your Privacy?
A developer could not have asked for better publicity.
This week, two years after being widely panned for a filter that critics described as little more than “digital blackface,” FaceApp, a photo-altering smartphone app, found itself at the center of a popular social media challenge.
A range of celebrities had been using the app’s age filter to modify photographs of themselves and provide realistic glimpses of what they could look like decades in the future. But then the backlash started.
The app, which was created by Wireless Lab of St. Petersburg, Russia, and was ranking among the top free offerings in both the Apple and Android app stores on Wednesday, was uploading much more data than users realized, one Twitter user contended in a widely shared, since deleted post. “Russians now own all your old photos,” The New York Post proclaimed in a headline.
這款應用由俄羅斯圣彼得堡的無線實驗室(Wireless Lab)開發，周三在蘋果和安卓應用商店的免費應用中都名列前茅。一條被大量轉發但之后被刪的推文稱，這款應用上傳的數據比用戶意識到的要多得多。“你的所有老照片都在俄羅斯人手上，”《紐約郵報》(New York Post)的新聞標題宣稱。
On Wednesday afternoon, the Democratic National Committee even sent out an alert, urging staff members on presidential campaigns to delete the app immediately, citing its ties to Russia.
周三下午，民主黨全國委員會(Democratic National Committee)甚至發出警告，敦促總統競選團隊的工作人員立即刪除這款應用，理由是它與俄羅斯有關。
But at least some of those concerns are overblown, according to several security researchers.
“The info sent by the application was only my device model, my device ID and Android version, which is very limited information and is quite common for an application,” said Baptiste Robert, a French security researcher who specializes in smartphone apps that abuse user data.
Mr. Robert did find one other piece of data uploaded to FaceApp servers without user consent, though: the photograph that a user wanted to manipulate.
The program says that its three age filters — two for younger-looking images, one for older — use “artificial intelligence” to produce plausible alterations to existing photos. Celebrities who have shared such manipulated images of themselves include Drake, Gordon Ramsay, the Jonas Brothers and Dwyane Wade.
該應用稱，它的三個年齡濾鏡——兩個用于讓人物變年輕，一個用于人物變老——使用“人工智能”對現有照片做出逼真的修改。分享這種被修改的照片的名人包括德雷克(Drake)、戈登·拉姆齊(Gordon Ramsay)、喬納斯兄弟(Jonas Brothers)和德維恩·韋德(Dwyane Wade)。
The company did not respond to multiple requests for comment, but it explained how the software works in a lengthy statement published on Wednesday by TechCrunch. When a user of the app selects a photograph to alter, that image — and only that image — is uploaded to FaceApp servers for processing, it said.
“We might store an uploaded photo in the cloud,” the statement read. “The main reason for that is performance and traffic: We want to make sure that the user doesn’t upload the photo repeatedly for every edit operation. Most images are deleted from our servers within 48 hours from the upload date.”
Even though its research-and-development team is based in Russia, the company said that user data was not transferred there. Photo processing is performed on servers operated by Amazon and Google, FaceApp’s founder, Yaroslav Goncharov, told TechCrunch.
In a letter on Wednesday, Senator Chuck Schumer, Democrat of New York, asked both the F.B.I. and the Federal Trade Commission to investigate the app, citing “serious concerns” about security, data retention and transparency.
在周三的一封信中，紐約州民主黨參議員查克·舒默(Chuck Schumer)要求聯邦調查局和聯邦貿易委員會(Federal Trade Commission)對這款應用進行調查，理由是安全、數據保存和透明度方面的“嚴重關切”。
“It would be deeply troubling if the sensitive personal information of U.S. citizens was provided to a hostile foreign power actively engaged in cyber hostilities against the United States,” he wrote.
But Ivan Rodriguez, a software engineer at Google who in his free time investigates suspicious iOS apps, including FaceApp, said he found little cause for concern. Like Mr. Robert, he found that the app collected little identifiable data beyond the photos users chose to alter.
“I don’t understand where these ‘fears’ come from, other than the parent company being based in Russia,” he said in a Twitter exchange. “I mean, I definitely don’t have the resources the F.B.I. or even the F.T.C. have, but so far I haven’t found anything that’s alarming or that shows this app trying to hide functionality that can be harmful.”
Like many other applications, FaceApp uses services provided to developers by Facebook and Google, known as Application Programming Interfaces, according to Mr. Robert. And although he was disappointed by the rapid spread of misinformation about what the program collected, he said, he was pleased by the impulse behind it.
“I’m quite happy, to be honest, because people are starting to be interested by this kind of question,” Mr. Robert said, “and they start to understand that, O.K., maybe there are some privacy concerns.”
Still, he noted, such concerns often take a back seat to novelty. “The cool factor is working a lot,” he said.
Mr. Robert and two other researchers who investigated the issue all said they had found no evidence on Apple or Android phones that FaceApp was secretly uploading entire photo galleries. But each voiced concern that the app, like many others, failed to alert users that their data was being uploaded to remote servers.
“If they don’t take privacy seriously, how seriously do they take security?” asked Will Strafach, the founder and chief executive of Guardian Firewall, a tool coming soon for iOS that aims to give users more control over their data. “If they don’t take security seriously, what’s the risk of either an insider threat or their company being breached?”
“如果他們不把隱私當回事，又怎么會把安全當回事呢?”衛士防火墻(Guardian Firewall)的創始人兼首席執行官威爾·斯特拉法奇(Will Strafach)問，他的這款即將登陸iOS的工具可以讓用戶對自己的數據有更多控制。“如果他們不認真對待安全問題，公司遭到內部威脅或被攻破的風險有多大？”
其他人則對FaceApp的隱私政策和條款提出了擔憂，主要是其中一條讓FaceApp獲取了對用戶照片的廣泛權利。但非營利性公民自由組織電子前沿基金會(Electronic Frontier Foundation)的技術項目總監杰里米·吉盧拉(Jeremy Gillula)表示，它與其他應用的情況類似。
“We always have concerns,” he said. “The fact that a lot of apps and services usually contain this catchall clause that says you grant us worldwide license to reproduce, modify, adapt, create derivative works from, distribute, publicly perform and display your user content always seems a little over the top to me.”