4 ms·

I have heard that it is quite possible. Supposedly if you measure enough characteristics of the phone, the combination of such characteristics is enough to uniq

by babesh 10y ago

I have heard that it is quite possible. Supposedly if you measure enough characteristics of the phone, the combination of such characteristics is enough to uniquely identify a phone. May be able to poll such information you measure with those measured by other apps.

azinman2 10y ago
There are quite a bit of SKUs, but not enough to make the phone unique itself. You'd ultimately need something more special to do so, such as the MAC address. It's not clear if such code would work today on the latest iOS version but maybe. They probably used a private API to do so, and that itself was obfuscated in the compiled binary such that apples automatic analysis would fail to catch it.
- jamiek88 10y ago
  No, they fingerprint the phone like browser fingerprinting. Unique settings, apps installed etc. Very hard to have a non-unique set up with enough data points.
  - azinman2 10y ago
    No? Did you work on this code and know for sure? Let's look at roughly what's available: iPhone model (2 orders of magnitude of possibilities) Device storage -- increases entropy with iPhone model but still not that much Device name -- easily changeable by scammer, so not enough iOS version -- changes over time, not great for a long term fingerprint but might help short term IP address -- short term attribution ok, but not against scammers. People in china have multiple sims very often so even relying on carrier isn't enough Cell phone carrier -- same as above Other apps installed -- as of iOS 9 you have to pre-declare what you want to be able to query, and that's subject to App Store review. It does help give a fair bit entropy. This also can change at any moment. But if you're wiping the device constantly, they might not be installing any apps. In advertising / web, you want to attribute across sites / installs on a short time basis. You have plugins and their unique version numbers, OS versions and all their attributes, browsers version, fonts installed, etc. Way more variation than iPhones. To defeat scammers erasing their phone constantly it's actually much harder, and likely needs something a bit more unique.
    - stale2002 10y ago
      Each variable you mentioned is not unique, but put them all together and now you are talking. And then apply a heavy dose of statistics and machine learning on top of THAT. Especially since the behavior/activity of the phone could be suspicious as well. You also don't need to be 100% accurate all the time. The point is to minimize the damages done to you by scammers, not reduce it to 0 which is impossible.
  - pasiaj 10y ago
    Doubt it. You can't use those methods to identify users if the phones are just being used to mine new accounts. I'd assume the miners just wipe a phone clean, reinstall Uber & create a new account. There are no special settings & variability in installed apps in that case.
- orbitur 10y ago
  > They probably used a private API to do so My understanding was that Apple made those APIs return garbage anyway, so more hacky methods were required.

by babesh 10y ago

azinman2 10y ago

There are quite a bit of SKUs, but not enough to make the phone unique itself. You'd ultimately need something more special to do so, such as the MAC address. It's not clear if such code would work today on the latest iOS version but maybe. They probably used a private API to do so, and that itself was obfuscated in the compiled binary such that apples automatic analysis would fail to catch it.

jamiek88 10y ago
No, they fingerprint the phone like browser fingerprinting. Unique settings, apps installed etc. Very hard to have a non-unique set up with enough data points.
- azinman2 10y ago
  No? Did you work on this code and know for sure? Let's look at roughly what's available: iPhone model (2 orders of magnitude of possibilities) Device storage -- increases entropy with iPhone model but still not that much Device name -- easily changeable by scammer, so not enough iOS version -- changes over time, not great for a long term fingerprint but might help short term IP address -- short term attribution ok, but not against scammers. People in china have multiple sims very often so even relying on carrier isn't enough Cell phone carrier -- same as above Other apps installed -- as of iOS 9 you have to pre-declare what you want to be able to query, and that's subject to App Store review. It does help give a fair bit entropy. This also can change at any moment. But if you're wiping the device constantly, they might not be installing any apps. In advertising / web, you want to attribute across sites / installs on a short time basis. You have plugins and their unique version numbers, OS versions and all their attributes, browsers version, fonts installed, etc. Way more variation than iPhones. To defeat scammers erasing their phone constantly it's actually much harder, and likely needs something a bit more unique.
  - stale2002 10y ago
    Each variable you mentioned is not unique, but put them all together and now you are talking. And then apply a heavy dose of statistics and machine learning on top of THAT. Especially since the behavior/activity of the phone could be suspicious as well. You also don't need to be 100% accurate all the time. The point is to minimize the damages done to you by scammers, not reduce it to 0 which is impossible.
- pasiaj 10y ago
  Doubt it. You can't use those methods to identify users if the phones are just being used to mine new accounts. I'd assume the miners just wipe a phone clean, reinstall Uber & create a new account. There are no special settings & variability in installed apps in that case.
orbitur 10y ago
> They probably used a private API to do so My understanding was that Apple made those APIs return garbage anyway, so more hacky methods were required.