FaceApp Lets You ‘Age’ a Photo by Decades. Does It Also Violate Your Privacy?
A developer could not have asked for better publicity.
This week, two years after being widely panned for a filter that critics described as little more than “digital blackface,” FaceApp, a photo-altering smartphone app, found itself at the center of a popular social media challenge.
A range of celebrities had been using the app’s age filter to modify photographs of themselves and provide realistic glimpses of what they could look like decades in the future. But then the backlash started.
The app, which was created by Wireless Lab of St. Petersburg, Russia, and was ranking among the top free offerings in both the Apple and Android app stores on Wednesday, was uploading much more data than users realized, one Twitter user contended in a widely shared, since deleted post. “Russians now own all your old photos,” The New York Post proclaimed in a headline.
这款应用由俄罗斯圣彼得堡的无线实验室(Wireless Lab)开发，周三在苹果和安卓应用商店的免费应用中都名列前茅。一条被大量转发但之后被删的推文称，这款应用上传的数据比用户意识到的要多得多。“你的所有老照片都在俄罗斯人手上，”《纽约邮报》(New York Post)的新闻标题宣称。
On Wednesday afternoon, the Democratic National Committee even sent out an alert, urging staff members on presidential campaigns to delete the app immediately, citing its ties to Russia.
周三下午，民主党全国委员会(Democratic National Committee)甚至发出警告，敦促总统竞选团队的工作人员立即删除这款应用，理由是它与俄罗斯有关。
But at least some of those concerns are overblown, according to several security researchers.
“The info sent by the application was only my device model, my device ID and Android version, which is very limited information and is quite common for an application,” said Baptiste Robert, a French security researcher who specializes in smartphone apps that abuse user data.
Mr. Robert did find one other piece of data uploaded to FaceApp servers without user consent, though: the photograph that a user wanted to manipulate.
The program says that its three age filters — two for younger-looking images, one for older — use “artificial intelligence” to produce plausible alterations to existing photos. Celebrities who have shared such manipulated images of themselves include Drake, Gordon Ramsay, the Jonas Brothers and Dwyane Wade.
该应用称，它的三个年龄滤镜——两个用于让人物变年轻，一个用于人物变老——使用“人工智能”对现有照片做出逼真的修改。分享这种被修改的照片的名人包括德雷克(Drake)、戈登·拉姆齐(Gordon Ramsay)、乔纳斯兄弟(Jonas Brothers)和德维恩·韦德(Dwyane Wade)。
The company did not respond to multiple requests for comment, but it explained how the software works in a lengthy statement published on Wednesday by TechCrunch. When a user of the app selects a photograph to alter, that image — and only that image — is uploaded to FaceApp servers for processing, it said.
“We might store an uploaded photo in the cloud,” the statement read. “The main reason for that is performance and traffic: We want to make sure that the user doesn’t upload the photo repeatedly for every edit operation. Most images are deleted from our servers within 48 hours from the upload date.”
Even though its research-and-development team is based in Russia, the company said that user data was not transferred there. Photo processing is performed on servers operated by Amazon and Google, FaceApp’s founder, Yaroslav Goncharov, told TechCrunch.
In a letter on Wednesday, Senator Chuck Schumer, Democrat of New York, asked both the F.B.I. and the Federal Trade Commission to investigate the app, citing “serious concerns” about security, data retention and transparency.
在周三的一封信中，纽约州民主党参议员查克·舒默(Chuck Schumer)要求联邦调查局和联邦贸易委员会(Federal Trade Commission)对这款应用进行调查，理由是安全、数据保存和透明度方面的“严重关切”。
“It would be deeply troubling if the sensitive personal information of U.S. citizens was provided to a hostile foreign power actively engaged in cyber hostilities against the United States,” he wrote.
But Ivan Rodriguez, a software engineer at Google who in his free time investigates suspicious iOS apps, including FaceApp, said he found little cause for concern. Like Mr. Robert, he found that the app collected little identifiable data beyond the photos users chose to alter.
“I don’t understand where these ‘fears’ come from, other than the parent company being based in Russia,” he said in a Twitter exchange. “I mean, I definitely don’t have the resources the F.B.I. or even the F.T.C. have, but so far I haven’t found anything that’s alarming or that shows this app trying to hide functionality that can be harmful.”
Like many other applications, FaceApp uses services provided to developers by Facebook and Google, known as Application Programming Interfaces, according to Mr. Robert. And although he was disappointed by the rapid spread of misinformation about what the program collected, he said, he was pleased by the impulse behind it.
“I’m quite happy, to be honest, because people are starting to be interested by this kind of question,” Mr. Robert said, “and they start to understand that, O.K., maybe there are some privacy concerns.”
Still, he noted, such concerns often take a back seat to novelty. “The cool factor is working a lot,” he said.
Mr. Robert and two other researchers who investigated the issue all said they had found no evidence on Apple or Android phones that FaceApp was secretly uploading entire photo galleries. But each voiced concern that the app, like many others, failed to alert users that their data was being uploaded to remote servers.
“If they don’t take privacy seriously, how seriously do they take security?” asked Will Strafach, the founder and chief executive of Guardian Firewall, a tool coming soon for iOS that aims to give users more control over their data. “If they don’t take security seriously, what’s the risk of either an insider threat or their company being breached?”
“如果他们不把隐私当回事，又怎么会把安全当回事呢?”卫士防火墙(Guardian Firewall)的创始人兼首席执行官威尔·斯特拉法奇(Will Strafach)问，他的这款即将登陆iOS的工具可以让用户对自己的数据有更多控制。“如果他们不认真对待安全问题，公司遭到内部威胁或被攻破的风险有多大？”
其他人则对FaceApp的隐私政策和条款提出了担忧，主要是其中一条让FaceApp获取了对用户照片的广泛权利。但非营利性公民自由组织电子前沿基金会(Electronic Frontier Foundation)的技术项目总监杰里米·吉卢拉(Jeremy Gillula)表示，它与其他应用的情况类似。
“We always have concerns,” he said. “The fact that a lot of apps and services usually contain this catchall clause that says you grant us worldwide license to reproduce, modify, adapt, create derivative works from, distribute, publicly perform and display your user content always seems a little over the top to me.”