7 ms·
From the article, explained: At the time, Uber was dealing with widespread account fraud in places like China, where tricksters bought stolen iPhones that were
by pdog 10y ago
From the article, explained:
At the time, Uber was dealing with widespread account fraud in places like China, where tricksters bought stolen iPhones that were erased of their memory and resold. Some Uber drivers there would then create dozens of fake email addresses to sign up for new Uber rider accounts attached to each phone, and request rides from those phones, which they would then accept. Since Uber was handing out incentives to drivers to take more rides, the drivers could earn more money this way.
To halt the activity, Uber engineers assigned a persistent identity to iPhones with a small piece of code, a practice called “fingerprinting.” Uber could then identify an iPhone and prevent itself from being fooled even after the device was erased of its contents.
- Kallikrates 10y agoCould be via other apps using ubers native sdk writing to a common key store. ala Google sharing auth between apps on iOS.
- azinman2 10y agoSuch key stores are wiped on erase. They more likely used the wifi MAC address.
- Kallikrates 10y agoKeychain used to persist data and are shared, this was a very recent change in iOS to "fix"
- azinman2 10y agoIt can be backed up to iCloud but in the context of scammers they're likely not using the same iCloud over and over.
- Kallikrates 10y agoThe wifi Mac address is obscured from native code
- babuskov 10y agoCan't one simply change the MAC address like you can do on PC?
- azinman2 10y agoMaybe if you're jail broken? But if you're not then no way. I believe I tried long long ago on iOS and couldn't get it to work, but I don't know if I'm remembering correctly.
- eecks 10y agoIs it against the rules to track via the mac address?
- geofft 10y agoNear the bottom of the article: To halt the activity, Uber engineers assigned a persistent identity to iPhones with a small piece of code, a practice called “fingerprinting.” Uber could then identify an iPhone and prevent itself from being fooled even after the device was erased of its contents. I also interpreted "track" as "report geolocation data," but that's not what the reporter means, and honestly the reporter's meaning is more consistent with, e.g., "this website is tracking users" or "Do-Not-Track".
- babesh 10y agoI have heard that it is quite possible. Supposedly if you measure enough characteristics of the phone, the combination of such characteristics is enough to uniquely identify a phone. May be able to poll such information you measure with those measured by other apps.
- azinman2 10y agoThere are quite a bit of SKUs, but not enough to make the phone unique itself. You'd ultimately need something more special to do so, such as the MAC address. It's not clear if such code would work today on the latest iOS version but maybe. They probably used a private API to do so, and that itself was obfuscated in the compiled binary such that apples automatic analysis would fail to catch it.
- jamiek88 10y agoNo, they fingerprint the phone like browser fingerprinting. Unique settings, apps installed etc. Very hard to have a non-unique set up with enough data points.
- azinman2 10y agoNo? Did you work on this code and know for sure? Let's look at roughly what's available: iPhone model (2 orders of magnitude of possibilities) Device storage -- increases entropy with iPhone model but still not that much Device name -- easily changeable by scammer, so not enough iOS version -- changes over time, not great for a long term fingerprint but might help short term IP address -- short term attribution ok, but not against scammers. People in china have multiple sims very often so even relying on carrier isn't enough Cell phone carrier -- same as above Other apps installed -- as of iOS 9 you have to pre-declare what you want to be able to query, and that's subject to App Store review. It does help give a fair bit entropy. This also can change at any moment. But if you're wiping the device constantly, they might not be installing any apps. In advertising / web, you want to attribute across sites / installs on a short time basis. You have plugins and their unique version numbers, OS versions and all their attributes, browsers version, fonts installed, etc. Way more variation than iPhones. To defeat scammers erasing their phone constantly it's actually much harder, and likely needs something a bit more unique.
- lithos 10y agoIt's an APP that has been on your phone at one point. An APP by a company that is peak (maybe valley would be better) SV when it comes to ethical standards. Uber probably has a fingerprinting system that is on par to Google/Facebook and maybe even puts them to shame (maybe paints them in a better light). I imagine that they wouldn't really have much difficulty tracking you through ad tech, another APP, or some other Cult Of Free system that is willing to sell database access.
- deleted 10y ago[deleted]
- 1024core 10y agoAh, I get it now. The author took a shortcut. Basically, they created a unique 'fingerprint' of the iPhone. It was unique enough that even if you reinstalled the app, the fingerprint would still be the same. This was done, ostensibly, to prevent people from scamming them by reinstalling the app and coming over as new users? But they already have the phone number, so I don't understand the point.
- zzalpha 10y agoPhone numbers can be trivially changed. In the article this is in the context of fraudsters buying used phones to fake rides in China and take advantage of incentive programs to make money. So they want to track these devices as they change hands.
- lisper 10y agoPhones can change ownership too, so even if you can identify the phone it is dangerous to assume that you have identified a person.
- zzalpha 10y agoYup, no question. I'm not claiming Uber's approach is flawless, I'm just describing what I believe they were doing and why.
- cocktailpeanuts 10y agoIf you can buy a new phone for $5 and the referral bonus is $20, there's $15 arbitrage to be made just by buying up as many phones as you can. So I think their goal is not so much about identifying people, but identifying devices in order to prevent this loophole.
- FabHK 10y agoBut can you buy (even a stolen) iPhone for USD 5?
- deleted 10y ago[deleted]
- refulgentis 10y agoI think they're referring to Keychain items surviving an app deletion. That quietly stopped working in a recent iOS update.
- stevenwoo 10y agoWas the keychain item surviving app deletion a feature that was dropped or an undocumented feature?
- ams6110 10y agoIf it "quietly stopped working" I'd have to assume the latter.
- stevenwoo 10y agoThanks, I just remember that when I stored the items the documentation recommended that one put in the keychain list, then deleted the app off of an actual device for testing purposes and reinstalled the app on that same device, all those items would still be there so I (wrongly in hindsight ) assumed it was the desired behavior by Apple otherwise other developers would have complained.
- yeldarb 10y agoI believe that is the desired behavior with the Keychain. Pretty sure this is about persisting data after the entire device has been wiped. Not just the app removed and re-installed.
- hboon 10y agoIt was in one of the 10.3 betas but was removed. I don't think it can be deleted reliably without losing data if iCloud keychain is enabled, e.g. another device might still have the same app or share the app group.
- minimaxir 10y ago> "to be clear, a # of companies practice 'fingerprinting,' and it is fully breaking the App Store rules. But also very clever fraud detection." https://twitter.com/MikeIsaac/status/856180005977677825 https://twitter.com/MikeIsaac/status/856180005977677825
- jakelarkin 10y agowonder why Mike Issac gave that clarification immediately to his twitter-base but didn't put it in the relevant section? could it be because the article intentionally glosses over complex details in order to pump a specific narrative ... hmm. \s
- cocktailpeanuts 10y agoThat's a clever media hack. Using provocative headlines and misleading lead to get clicks and shares, but using a separate medium (Twitter) to get away with it. Clever, but it's disappointing that even NYT is turning into this madness.
- stingraycharles 10y agoThey've also updated the article text now: "To halt the activity, Uber engineers assigned a persistent identity to iPhones with a small piece of code, a practice called “fingerprinting.” Uber could then identify an iPhone and prevent itself from being fooled even after the device was erased of its contents." Note that this was at least 4 hours after the outrage on Twitter started. Seems like a very intentional, well-calculated strategy indeed.
- jgalt212 10y ago> Note that this was at least 4 hours after the outrage on Twitter started. Seems like a very intentional, well-calculated strategy indeed. That comment seems a bit disingenuous. i.e. it's entirely possible it takes a journo 20 seconds to post a correct to a twitter account he/she controls and 4 hours/days/weeks to get his/her editors to sign off on the same correct and the change pushed to the news website.
- hsod 10y agoThis really doesn't match up with how the conversation/outrage is playing out on Twitter right now. People seem to be interpreting this as "Uber continues to track your location after you have deleted the app," when what really happened seemed to be "If you delete Uber and then reinstall it on the same phone, Uber knows that it's the same phone." See for example this Tweet, with hundreds of retweets and lots of verified replies: https://twitter.com/dnvolz/status/856166875511894016 https://twitter.com/dnvolz/status/856166875511894016 "This is like a holy trinity of privacy disaster: 1) secret tracking that 2) persists after users delete app 3) in knowing violation of rules"
- pdog 10y ago"A lie will go round the world while truth is pulling its boots on." C.H. Spurgeon, Gems from Spurgeon (1859)
- parthdesai 10y agoWell Churchill, of all people would know it pretty well.
- tyingq 10y agoThat's true, but there's a bit of live by the sword, die by the sword here. Uber is no stranger to the power of propaganda with their campaigns on the sharing economy, unions, regulations, etc.
- smokeyj 10y agoBecause we all expect journalistic integrity from Uber. Uber provides a service people need. Journalism is blogspam garbage.
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- TeMPOraL 10y agoWhat goes around comes around. Reminds me of that time when Uber would issue throwaway credit cards and burner iPhones to people, so that they would order and cancel Lyft rides...
- bogomipz 10y ago>" Some Uber drivers there would then create dozens of fake email addresses to sign up for new Uber rider accounts attached to each phone, and request rides from those phones, which they would then accept. Since Uber was handing out incentives to drivers to take more rides, the drivers could earn more money this way." Could someone explain the logic behind how a driver requesting rides benefited them? Did the drivers fake the ride and pay for it themselves? Was there a cash incentive where they were reaping enough to offset paying for the fake rides themselves and profit hanseomely? Is that correct?
- hboon 10y agoYes, in the earlier days in each city, they (just pulling numbers from thin air) do something like pay a minimum $20 for each trip if you complete 5 trips within an hour without cancellation. Helps to kickstart the driver supply.
- bogomipz 10y agoThanks for the explanations. Interesting and somewhat ironic to think that Uber had to put countermeasures in place against drivers engaging in their own questionable version of "growth hacking."
- lovich 10y agoGive a reference code to your other phone. That phone now has a credit for their first uber ride or first 20 dollars, something like that. Then take the ride on your driver phone. You get paid from the second phones credit but dont spend any money yourself
- mandeepj 10y ago>request rides from those phones, which they would then accept. Rider and drivers are randomly assigned. I am not sure if you can choose your driver. Not sure if all these drivers in China made a huge group to benefit each other
- dsacco 10y agoHaving looked through Uber's iOS app pretty extensively - that fingerprint methodology is easy to bypass.