Open Radar

 
01-Jul-2011 02:45 PM John Brayton:
Summary:

There is one entitlement key that grants an app full access to the address book:
com.apple.security.personal-information.addressbook

My app, CloudPull, uses the address book in a very limited fashion.  Specifically, it retrieves the customer's own email addresses from the address book.  It uses those to populate default values in a feedback reporter window and in a mailing list subscription window.

I am able to do what I need with this entitlement, but this is far more access than my app needs.  An entitlement that only provides access to "My Card" (the individual user's address book entry) would be more secure.

My specific concerns are:
* My app does not need access to the customer's entire address book, therefore my app really should not have it.
* I am concerned that my app could be rejected from the Mac App Store for making such limited use of an important entitlement.
* I am concerned that a future version of the Mac App Store or OS X could tell customers that my app needs access to the entire address book, even though it really only wants the customer's email address.

Steps to Reproduce:

N/A

Expected Results:

N/A

Actual Results:

N/A

Regression:

N/A

Notes:

N/A