6 ms·

It's particularly interesting to see that they are cross-checking registered test device UDIDs across developer accounts. Suddenly UDIDs need to be kept confid

by 0x0 10y ago

It's particularly interesting to see that they are cross-checking registered test device UDIDs across developer accounts. Suddenly UDIDs need to be kept confidential, or a fraudster might add a high profile developer's UDID to their own developer account and then drive it into the ground. Doing iOS consultancy work for other people's dev accounts could also be more risky than expected now if you use your personal test devices there. Remember also that there are probably thousands of third party databases out there linking millions of UDIDs with real world identities, as it is only in the last few iOS versions that the device uniqueIdentifier API started returning blanks. Earlier, many apps and adtracking libraries almost certainly would include the UDID in server calls during login etc.

eridius 10y ago
> Doing iOS consultancy work for other people's dev accounts could also be more risky than expected now if you use your personal test devices there. I don't think so. The fact that you have your device registered on two different accounts is unlikely to be sufficient to link the two accounts. It's merely one of the ways in which the accounts were linked. Using the same CC and/or bank details is another. And there's probably other links too that Apple didn't disclose (because they're only effective at combating fraud if fraudsters don't know about them).
- 0x0 10y ago
  I do agree with your points here. Still gives me some pause with how I treat my UDIDs going forward.
moduspwnens14 10y ago
You're reading into this too much. If this were happening all the time and people were raising concerns left and right, then yes--it'd indicate this was caught by an automated system that makes big assumptions. That's not the case here. They reiterated many times on that phone call that they're sure they didn't make a mistake and they have no financial interest in banning his account. They gave him an "out" by letting him post a carefully worded post without even admitting wrongdoing and he instead recorded their phone call and posted part (!) of it on his blog. How people are seeing Apple as in the wrong here is mindblowing.

by 0x0 10y ago

eridius 10y ago

> Doing iOS consultancy work for other people's dev accounts could also be more risky than expected now if you use your personal test devices there. I don't think so. The fact that you have your device registered on two different accounts is unlikely to be sufficient to link the two accounts. It's merely one of the ways in which the accounts were linked. Using the same CC and/or bank details is another. And there's probably other links too that Apple didn't disclose (because they're only effective at combating fraud if fraudsters don't know about them).

0x0 10y ago
I do agree with your points here. Still gives me some pause with how I treat my UDIDs going forward.

moduspwnens14 10y ago

You're reading into this too much. If this were happening all the time and people were raising concerns left and right, then yes--it'd indicate this was caught by an automated system that makes big assumptions. That's not the case here. They reiterated many times on that phone call that they're sure they didn't make a mistake and they have no financial interest in banning his account. They gave him an "out" by letting him post a carefully worded post without even admitting wrongdoing and he instead recorded their phone call and posted part (!) of it on his blog. How people are seeing Apple as in the wrong here is mindblowing.