{"id":45344,"date":"2022-08-31T13:53:44","date_gmt":"2022-08-31T17:53:44","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=45344"},"modified":"2022-08-31T13:53:44","modified_gmt":"2022-08-31T17:53:44","slug":"poparazzi-privacy-issues","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/poparazzi-privacy-issues\/45344\/","title":{"rendered":"“To pop, or not to pop \u2014 that is the question”"},"content":{"rendered":"

In a world already chock full of social networks, new services have to fight for user attention and come up with something original. In doing so, the creators of new platforms sometimes forget about basic features such as privacy and security. A striking example of this was the security fiasco with the social network Clubhouse<\/a>, which became a smash hit in the spring of 2021.<\/p>\n

The social network Poparazzi, which is the subject of this post, appeared a few months after<\/a> Clubhouse and is still pulling in users. On the very first day of launching, Poparazzi topped the App Store chart<\/a> in the U.S., and over the past year it\u2019s been downloaded five million+ times<\/a>. In this post we explain the privacy issues of the social network.<\/p>\n

How Poparazzi works <\/h2>\n

Poparazzi\u2019s main feature is that it doesn\u2019t let you post photos or videos of yourself. Instead, users post shots of other people, which are called \u201cpops.\u201d<\/p>\n

A Poparazzi user-account has two sections: the first with photos and videos of you posted on your page by others; the second \u2014 with shots that you yourself uploaded to other users\u2019 profiles; (this section is visible only to you). At the same time, pops don\u2019t have to be real photos or videos; they can be memes or your favorite cat pictures from the internet.<\/p>\n

What also sets the new social network apart from other such services is that no user can find out the real number of your subscribers and subscriptions. Instead, it lists the total number of poparazzi \u2014 that is, the number of people who \u201cpopped\u201d you and the number of pops themselves.<\/p>\n

Only users you follow can freely upload pops to your profile. At the same time, in order to do so, they themselves don\u2019t have to follow you.<\/p>\n

What permissions does Poparazzi need?<\/h2>\n

For a friendly social network supposedly lacking pretensions<\/a>, Poparazzi is quite pushy. During registration, the app immediately requests a whole host of permissions: access to the camera, contacts, notifications, and all photos on the device. And all are mandatory! If, say, you give access to only some photos, or revoke some permissions later, you won\u2019t be able to add friends and post pops.<\/p>\n

\"Poparazzi<\/a>

Poparazzi wants access to your camera, contacts, notifications, and every single photo<\/p><\/div>\n

How to unblock a Poparazzi profile<\/h2>\n

After granting the service all the access it requires, you are taken to a page with a \u201cProfile blocked\u201d message. The developers explain that to unblock the profile someone needs to post a pop on your page. Before that, it seems you can\u2019t fully use the app: viewing your profile, posting pops, viewing other accounts, etc. are all off limits for now.<\/p>\n

You are immediately prompted to add three people from your contact list as friends, so that (hopefully) one of them will pop you and activate your profile. If none of your friends uses Poparazzi yet, the app lets you send them invitation links.<\/p>\n

<\/a>

\u201cProfile blocked\u201d message after registration in Poparazzi<\/p><\/div>\n

In actual fact, as our experiment showed, it only takes one follower in your profile to activate it. By friending them, you open all your account options: viewing other people\u2019s pages, commenting, posting pops. So, as it turns out, you don\u2019t need someone to pop you to unblock your profile after all.<\/p>\n

What to do if you don\u2019t like a pop<\/h2>\n

There isn\u2019t much you can do to stop others viewing photos and videos in which you appear. Profile content is open to all users of the social network by default. You can\u2019t hide your account from random guests \u2014 there\u2019s simply no such option in the privacy settings. All you can do is manually delete unwanted pops from your profile, ban specific individuals from popping you, or add users to a deny list. If you ban a user from posting a photo to your profile, they\u2019ll remain among your followers and be able to view your feed. If deny-listed, however, the user is removed from your followers list and won\u2019t be able to pop you or view your pops and longer.<\/p>\n

How to prevent friends from posting photos of you <\/h3>\n

By default, anyone you follow can post pops of you. They don\u2019t need your consent to do so. You\u2019ll see what\u2019s been posted only after logging in to your profile. And that could be an hour, or even a week, after the pop was uploaded. If you don\u2019t want a particular pop hanging around on your page, you can delete it. To do this, click on it and then on the three-dots icon in the upper-right corner, and after that select Delete<\/strong>.<\/p>\n

There are two ways to block a friend from posting pops in your profile: either unfollow them, or restrict their access to your account. Remember, even after you do this, your followers (and all Poparazzi users \u2014 save for those in your deny list) will still be able to view your feed. <\/p>\n

To unfollow a user, go to their profile and click Following<\/strong>. If you want to unfollow several friends in one go, on your profile tab, click on the gear icon in the upper-right corner of the screen, go to Privacy Settings<\/strong>, and click on the crosses next to the user\u2019s nickname. Remarkably, apart from the list of your followers, this section contains nothing at all.<\/p>\n

\"Restrictions<\/a>

Restrictions on the publication of pops in your Poparazzi account<\/p><\/div>\n

If you want to continue following a user but block them from uploading pops to your profile, go to their account, click on the three-dots icon in the upper-right corner of the screen, and select Remove Poparazzi<\/strong>.<\/p>\n

Can people I don\u2019t follow pop me?<\/h3>\n

Poparazzi\u2019s developers claim<\/a> that if you don\u2019t follow someone, they can\u2019t post pops in your feed without your approval. If such person tries to post a pop, it will simply not be published. <\/p>\n

If you add the author of unpublished pops as a friend, then all<\/strong> photos they were trying to post will immediately show up in your profile. Another way to achieve the same result is to click on the three-dots icon in the upper-right corner of the person\u2019s profile and select Approve Poparazzi<\/strong>. Clicking this button essentially duplicates the follow feature.<\/p>\n

\"User<\/a>

User approval in Poparazzi<\/p><\/div>\n

During our experiment, we discovered that you can\u2019t view pops uploaded by a new poparazzi before adding them as a friend \u2014 they\u2019re visible only to their author. Nor do notifications about pops from unfamiliar accounts arrive, as things currently stand. Thus, it turns out that adding a new follower is a pig in a poke, because you never know what pops might pop up in your profile as a result.<\/p>\n

How to block users in Poparazzi<\/h2>\n

Fully restricting a user\u2019s access to your page is possible only by blocking. To do this, in their profile, click on the three-dots icon in the upper-right corner and select Block<\/strong>.<\/p>\n

\"User<\/a>

User blocking in Poparazzi<\/p><\/div>\n

In that same section, you can report a user to the developers if you think they\u2019ve violated the rules of the service: for example, by posting pornographic content or disclosing other people\u2019s personal data (although the developers don\u2019t explain what is considered such data). To do so, click Report<\/strong> and describe the issue. The developers state that they\u2019ll take action against violators<\/a>.<\/p>\n

How to delete a Poparazzi account<\/h2>\n

We found the answer to this question in the FAQ section<\/a> on the Poparazzi site. It provides a link<\/a> to a no-frills page. You\u2019re prompted here to enter the phone number you used for Poparazzi registration in the field under a message from the developers. That done, click Delete My Account Including Photos I\u2019ve Taken & Photos Of Me<\/strong>.<\/p>\n

\"Deleting<\/a>

Deleting your Poparazzi account<\/p><\/div>\n

It doesn\u2019t even matter if you logged out of your account before sending the application or not\u2014 either way your profile is deleted. However, if you open your feed while your request is still pending, it\u2019ll be canceled. The developers don\u2019t say how long it takes to process such requests, but our test account was deleted in just a couple of minutes.<\/p>\n

User risks<\/h2>\n

The main problem with Poparazzi privacy is that you cannot fully control which photos and videos of you will be seen by friends, family and colleagues. Users have an extremely limited set of tools for controlling who exactly can post pops of them on their own page.<\/p>\n

Also bear in mind that a large chunk of the social network\u2019s user base<\/a> is made up of teenagers, who may not yet realize that an ill-judged pop from a party could, years later, cost them their career.<\/p>\n

Another potential problem for Poparazzi users is doxing<\/a>. Photos, especially ones posted uncontrollably, can show not only a face, but a plethora of other information, too: who they mix with, where they go, and what they like doing. This can all be weaponized by a skilled doxer<\/a>.<\/p>\n

How to stay safe on Poparazzi<\/h2>\n

Poparazzi privacy leaves much to be desired, so think carefully before registering. If you still decide to open an account, follow our tips to minimize the risks:<\/p>\n