2 ms·

Granted, Apple should probably expose an API for identifying unique hardware to avoid fraud. Perhaps a hardware secret hashed with the App name encrypted with t

by lend000 10y ago

Granted, Apple should probably expose an API for identifying unique hardware to avoid fraud. Perhaps a hardware secret hashed with the App name encrypted with the App provisioner's public key, such that the ID is only identifiable/useful to a specific App developer. There doesn't seem to be an easy workaround for jailbroken apps, though, unless you were doing the fingerprinting secretly, like Uber did. The plethora of $20 off promo codes certainly amplifies this problem, though. Lyft did it better by only allowing $5 off per ride, but with more rides.

BryantD 10y ago
That'd be the IDFV [1], no? The problem is that the customer is supposed to be able to reset that by deleting all of a vendor's apps from their device. If there's a fraud problem, I think it's reasonable to require the developer to handle it in their account system. Yes, this makes it somewhat harder to detect fraud because you lose one important piece of information, but privacy is worth it. [1] https://developer.apple.com/reference/uikit/uidevice/1620059-identifierforvendor https://developer.apple.com/reference/uikit/uidevice/1620059...
- lend000 10y ago
  Didn't know about that, thanks! Curious why they invented their own system (maybe jailbreaking was still a problem, because people knew about it). But yes, a strong account system is the best way to go. For a company this mature, it should be feasible to require phone number/email/payment authentication for new users prior to providing services.
  - BryantD 10y ago
    Apple removed access to the UDID because it was being used to target advertising and correlate users across different publishers -- basically privacy issues. For a while there was a slew of third party solutions which involved hashes of MAC addresses. Some time thereafter Apple created IDFV and the companion, IDFA (For Advertiser) and really cracked down on cross-vendor correlation.

by lend000 10y ago

BryantD 10y ago

That'd be the IDFV [1], no? The problem is that the customer is supposed to be able to reset that by deleting all of a vendor's apps from their device. If there's a fraud problem, I think it's reasonable to require the developer to handle it in their account system. Yes, this makes it somewhat harder to detect fraud because you lose one important piece of information, but privacy is worth it. [1] https://developer.apple.com/reference/uikit/uidevice/1620059-identifierforvendor https://developer.apple.com/reference/uikit/uidevice/1620059...

lend000 10y ago
Didn't know about that, thanks! Curious why they invented their own system (maybe jailbreaking was still a problem, because people knew about it). But yes, a strong account system is the best way to go. For a company this mature, it should be feasible to require phone number/email/payment authentication for new users prior to providing services.
- BryantD 10y ago
  Apple removed access to the UDID because it was being used to target advertising and correlate users across different publishers -- basically privacy issues. For a while there was a slew of third party solutions which involved hashes of MAC addresses. Some time thereafter Apple created IDFV and the companion, IDFA (For Advertiser) and really cracked down on cross-vendor correlation.