How do Apps get MY phone number to find friends?

Question

I'm currently working on a cordova web-app.

I wonder how Apps like Runkeeper show me contacts of my addressbook, that are also using Runkeeper. On each contact there is a little telephone symbol, so i guess the link is somehow established via the phone number.

Runkeeper has never gotten my or my friend's phone number and it is not readable from the SIM cards, though.

The only possible way that i could think of is, that Runkeeper reads my other Accounts from the AccountManager and makes a connection using my WhatsApp-ID...

Does anybody know how that happens and can I do it too in my cordova app?

Answer 1

Runkeeper read your contacts as per their own website. When you install the app, they store your install in their database with your number or something that was originated from your number (encrypted version for example).

When you want to know who has the app, they do the same encryption on your contacts numbers, and correlate with what they have.

For example:

User1 : [Phone 1234] 
User2 : [Phone 2341] 
User3 : [Phone 3412]

User1 installs the app, Runkeeper stores the sha1 of his number, salted or not, in their database:

Runkeeper database of installs:
    7110eda4d09e062aa5e4a390b0a572ac0d2c0220

User2 installs the app, Runkeeper stores the sha1 of his number in their database:

Runkeeper database of installs:
    7110eda4d09e062aa5e4a390b0a572ac0d2c0220  <-user1
    52c88b165a3a614a5e3ceac0074bad92d5bb1c0a  <-user2

When User2 loads the activity that shows him his contacts that are using the app, Runkeeper reads your contacts then for each contact they contact their database and correlate without ever sending your phone number or your contacts outside.

Disclaimer

This is an example approach, I have no idea if this is the way they're doing it. It's overly simplified on purpouse for sake of clarity.

Follow-up While it may be true that you never provided the phone number to the app, it doesn't necessarily mean that it doesn't have it already. Test yourself the code in this answer to check whether or not it's readable

Apparently op's Settings / About Phone / Status / My phone Number is empty, as is the google account phone number, which would be another way of accessing it.

Answer 2

As you asked in the question cordova has plugins which can retrieve the details from the current Android phone, by which you can get the information about the current user Some of the plugin you can for this is:
- https://github.com/vliesaputra/DeviceInformationPlugin
- https://github.com/pbakondy/cordova-plugin-sim, it has property 'phoneNumber' which can give phone no of the owner

When you login/signup they collection your device information and store it on server by some mechanism

---

To Get all the contacts there is also some plugins by which you can get all the contacts from the contact list like this:
https://github.com/apache/cordova-plugin-contacts, with this plugin you can find some contact in the address book or get all the contacts

document.addEventListener("deviceready", init, false);
function init() {

    navigator.contacts.find(
        [navigator.contacts.fieldType.displayName],
        gotContacts,
        errorHandler);

}

function errorHandler(e) {
    console.log("errorHandler: "+e);
}

function gotContacts(c) {
    console.log("gotContacts, number of results "+c.length);
    for(var i=0, len=c.length; i<len; i++) {
        console.dir(c[i]);
    }
}

Ref and more information: https://www.raymondcamden.com/2014/12/23/cordova-demo-viewing-all-contacts/

Another plugin for get all contacts: https://github.com/dbaq/cordova-plugin-contacts-phone-numbers
By this ways you can get your and other users contact/phone number in the your project

I don't know how they are mapping your contacts to find which friends are using this app. May be there are doing some server/client side processing on your contact list or it may be something like 'Juan Cortes' mention in his answer

Answer 3

There are some workarounds to fetch user's phone number since some of the sim card providers doesn't allow to read it.

1. First try to use TelephonyManager to check if you can read from sim card (mostly can't).

2. Most of the devices have whatsapp / telegram / or similar apps installed. So check their account using Accountmanager

3. If phone number is must for your app it is better to ask user to enter it and store in sharedprefs after verify.

4. Read users Sent SMS messages and fetch sender address(which is phone number)

Here is the link for 1, 2 and 3

And the link for 4

I haven't tried them yet but these are the basic workarounds as i know so far.

Hope it helps