35 ms·

Apple does right by users and advertisers are displeased

433 points by DiabloD3 9y ago

cm2187 9y ago
Would I be right to assume that safari on iOS defeats browser finger printing, given the absence of flash and the fact that you can't really customise the platform, adding new fonts, etc, so the entropy is close to zero?
- delta1 9y ago
  It doesn't seem so, visiting Panopticlick[0] on my unmodified Safari/iPhone7/iOS 10.3.3 gives "your browser has a nearly unique fingerprint" [0]https://panopticlick.eff.org/ https://panopticlick.eff.org/
  - cdubzzz 9y ago
    Ditto on iOS 11 with Safari. In Firefox I get just unique, in Safari it is “nearly unique”.
    - dantiberian 9y ago
      I don't know how well Panopticlick would do for scoring Safari 11, as it runs all its tests within a few seconds. Some of Safari's new behaviour around third and first party cookies only kick in after 24 hours, or 30 days.
  - mnw21cam 9y ago
    So, panopticlick marks down my browser because it doesn't unblock third parties that promise to honour "Do not track". In what way is this bad? (Yes, I have third party cookies blocked. No, I'm not unblocking them.)
    - cisanti 9y ago
      It's bad in a sense that you're possible to identify uniquely by the advertisers. Do not track is snake oil anyway...
    - qbrass 9y ago
      The more things you do that aren't like what everyone else does, the easier it is to single you out from the combination of those choices.
  - yoz-y 9y ago
    Being on an iPhone will however reduce most of those bits to 0. For example any iPhone 8 with iOS11 will share the same screen resolution, fonts, user agent and so on. They talk about this in their methodology, however do not give the actual bits in their results, only that you have 'more than 19'
  - tbrock 9y ago
    I’m golden on iOS 11.0.0
  - eridius 9y ago
    I got the same thing. When I look at the fingerprint details though, it's not clear why it should be "nearly unique". Of the things listed there, there's not much that's customizable, mostly just time zone, locale, DNT, and if cookies are enabled. That said, it also has "Hash of canvas fingerprint", which apparently has a lot of bits, but I have no idea what information that's actually extracting. Similarly "Hash of WebGL fingerprint". I did try this on iOS 11, which they probably don't have much data for yet and would explain some of the unique-ness, but you said iOS 10.3.3 which is much less new. Maybe iPhone users just don't try panopticlick very much?
- snakeanus 9y ago
  You can still do things like being able to get the battery status with JS or detect visited links.
  - tempay 9y ago
    > detect visited links Is this still possible? I was under the impression this is prevented in most browsers.
    - synthmeat 9y ago
      Also wrt battery status - that's only Chrome thing these days. http://caniuse.com/#feat=battery-status http://caniuse.com/#feat=battery-status
      - snakeanus 9y ago
        For firefox there is dom.battery.enabled and https://developer.mozilla.org/en-US/docs/Web/API/Battery_Status_API https://developer.mozilla.org/en-US/docs/Web/API/Battery_Sta... but it seems that since 42 it is enabled only for addons. It seems that I was wrong about that indeed.
    - Aissen 9y ago
      Well, browser vendors keep adding features, and in 2014, it was predicted by lcamtuf that the mix-blend-mode property would be useful to access browser history: https://lcamtuf.blogspot.fr/2016/08/css-mix-blend-mode-is-bad-for-keeping.html https://lcamtuf.blogspot.fr/2016/08/css-mix-blend-mode-is-ba... Two years later, it was implemented, and the demo seems to be working here in Firefox 56: http://lcamtuf.coredump.cx/whack/ http://lcamtuf.coredump.cx/whack/
  - withjive 9y ago
    Newer versions (since around 2013) of webkit and gecko limit a:visited style changes to just colour or background colour. So the getComputedStyle() trick doesn't work anymore. Is that what your referring to?
phasecode 9y ago
Hopefully FireFox and-or IE will be the next to step up. I don't see Chrome stepping up until every other browser has.
- KGIII 9y ago
  You may wish to visit this link: https://www.theverge.com/2017/6/1/15726778/chrome-ad-blocker-early-2018-announced-google https://www.theverge.com/2017/6/1/15726778/chrome-ad-blocker... By the way, a friendly reminder that EFF is happy to take donations and there are a variety of ways to do so.
  - votepaunchy 9y ago
    Blocking a few egregious ad types is not at all the same as the blocking of privacy-invading cookies as Apple is doing. > The Chrome ad blocker doesn’t just help publishers, it also helps Google maintain its dominance. And it advantages Google’s own ad units, which, it’s safe to say, will not be in violation of the bad ad rules. Don’t be evil, indeed.
    - KGIII 9y ago
      Right, but it's a start - meaning they might eventually get there. It means there is pressure and that they may be obligated to take notice. It's not the end, it is the beginning.
      - romanovcode 9y ago
        > Right, but it's a start - meaning they might eventually get there. Get where, exactly? 88% of Google money comes from Ads[0], if you think their plan is to remove them from web you are either crazy or stupid. [0] - http://www.businessinsider.de/how-google-apple-facebook-amazon-microsoft-make-money-chart-2017-5?r=US&IR=T http://www.businessinsider.de/how-google-apple-facebook-amaz...
        KGIII 9y ago
boyter 9y ago
Which is exactly why as of last month bought my first iPhone. The pro privacy stance that Apple is taking is wonderful to see. No idea if anyone pushing this at Apple will ever read this but you have a customer for life if you continue to do so and will champion your products to their entire sphere of influence.
- Sholmesy 9y ago
  Agreed. Apple has been mostly good wrt to privacy in the past, but since they've started to make it a selling/differentiation point, I expect them to solidify their stance. I think it's a genius move. People will begin to understand in the coming years just how much information these companies are tracking/extracting, and turn(or stay) to Apple. I think users would care about privacy, if they truly knew just how much information is being gathered.
  - ramblerman 9y ago
    Apple has shareholders and changing CEOs. This is really naive at best
    - Angostura 9y ago
      As long as the company can show the shareholders that differentiating on privacy provides good ROI, they will be happy.
      - pilsetnieks 9y ago
        There doesn't have to be a good ROI. Quoting Tim Cook: "When we work on making our devices accessible by the blind, I don't consider the bloody ROI. [..] If you want me to do things only for ROI reasons, you should get out of this stock." https://www.macobserver.com/tmo/article/tim-cook-soundly-rejects-politics-of-the-ncppr-suggests-group-sell-apples-s https://www.macobserver.com/tmo/article/tim-cook-soundly-rej...
    - pilsetnieks 9y ago
ak39 9y ago
This is a complete guess ... Apple "does right by users". That's ok. But I'd wager this is only because that type of positioning is now Apple's chosen market differentiating* strategy. Against Google. Apple seems to want to position itself as the device that guarantees privacy and security. Apple would like to maintain exclusive access to a market segment that values security and privacy above all. It worked for BlackBerry. Strong and almost cult-like loyalist following mostly guaranteed BB's reach in the executive circles. Even after BB became "Veblen", the device was in high demand. In such a market segment, the price per device doesn't really matter. My view is consistent with the apparent "horror" prices seen for the new iPhone. If my guess is right, it's a shame about Apple's chosen direction. I love their products.
- sacheendra 9y ago
  Why is it a shame about Apple's direction? Apple realised there is a market of privacy minded people who don't want to trade themselves to get a phone at a low price. Apple can be privacy minded for profit and "do right by the users" at the same time. They aren't diametrically opposed to each other. It is sad that we expect that a company trying to stay profitable is trying to screw users over in some way. I'm not saying its not true in many cases, just in this case.
  - ak39 9y ago
    > Why is it a shame about Apple's direction? Because it's too easy when you see a company that once dominated this space with Jobs' legacy. It's easy to be the good guy. It's morally reprehensible even to advertise yourself as such. Jobs' legacy of thinking differently has been recently misapplied with idiotic decisions like no headphone jacks, removal of fn keys, removal of magsafe power etc. It would seem that the "innovation department" Apple would rather settle for difference BY DEFAULT. That's the shame.
    - zimpenfish 9y ago
      > It's easy to be the good guy. Then why are Apple the only company even contemplating this?
dalbasal 9y ago
Browsers are really where privacy needs to come from. I know a lot of people have hopes for a legislative solutions, but I think the EU (also UK and others) "cookie law" really needs to make us consider how effective they can be. The motivation for the law was good. They put their finger in the right place. . We got nag screens and little improvment in privacy. Not every piece of privacy legislation does as little as this, but I still think we need to be wary. Browsers, OTOH, are in a great position to improve user privacy. Maybe instead of letters to parliamentarians, letters to browser makers?
- Yaggo 9y ago
  > We got nag screens and little improvment in privacy. We definitely got the nag screens¹, but improvement? [1] Which is totally inferior solution technically & ux-wise, because the user/client voluntarily accepts the cookie from the server, and there's already setting for that in the browser.
  - lloeki 9y ago
    The nags are only mandated for tracking, cookies are only a implementation detail. The EU directive explicitly mentions that, does not even focus on cookies, and states that cookies (or whatever) pertaining to site operation (such as login/cart/whatever) do not require nagging. Thus the proper browser setting is DNT, not accepting cookies. But everyone construed that cookies <=> nag, because nobody RTFM.
    - dalbasal 9y ago
      I don’t think it’s a RTFM thing. The lawyers RTFM, and this is what they came up with. The legislation called for informed consent. Two core issues were left open to definition, in practice. [1] What requires informed consent? [2] What counts as informed consent. For question 2, a standard answer (nag screen) emerged. Question 1 is trickier. The cheapest & easiest solution is to just nag, so that’s the default. If you want to drop the nag screen you can deal with question 1, but most don’t bother. Either they want the tracking, they want the easiest option or they want legal CYA. I think the legislative intentions were good, but this was a hard area to legislate. It didn’t work, IMO.
eps 9y ago
This is all lovely and all, but... cookies? If I were an ad network, I'd long ago switched to local storage and browser fingerprinting. Especially if it's my very survival as a business is at stake.
- scarlac 9y ago
  The localStorage is not readable across sites. Cookies are. The issue is mostly with 3rd party cookies which many in the industry rely on to do tracking.
  - eps 9y ago
    My main point was in browser fingerprinting. LocalStorage is just an icing on top to better cross-reference users in the scope of the same site.
- mirimir 9y ago
  Well, yeah. So just compartmentalize. If there's some set of online activity that you don't want linked to you, do it in a dedicated VM. With Internet connectivity via some mix of VPNs and Tor. Everything that Mirimir does online is linked, at least somewhat. But that's fine, because it's not linked to my meatspace identity.
  - eps 9y ago
    Well, sure. Point being that this "fight for the users" centered around 3rd party cookies is a privacy theatre. If 3rd party cookies were to be completely blocked on every single computer tomorrow, the ad industry will just switch to another option and nothing will change. But this does make Apple look like privacy champions.
dvt 9y ago
Was recently telling my dad about this. I might get an iPhone X just because of Apple's new stance on browsing privacy. I recently quit my ad-tech job and what FB/Google does with tracking is incredibly sketchy. Glad to see a large company with leverage fight back.
- blubb-fish 9y ago
  Why not an iPhone 6?
  - blubb-fish 9y ago
    "This question is an outrageous profanity!"
  - alien_at_work 9y ago
    Don't know why people are downvoting this, but the 5C just got "obsoleted" so that could mean the 6 is right on the brink of update oblivion. So that could be a reason.
    - blubb-fish 9y ago
      could be - but the question is so stupid - not worthy to actually reply. In the light of such pretentious behaviour I have no idea why apple users have a reputation of being pragmatic and down2earth. </irony>
      - alien_at_work 9y ago
        I'm an apple user, perhaps even a fan. I don't have a clue why your comment was downvoted. Is it a lot? Maybe it's a misclick.
        blubb-fish 9y ago
        just joking. nonetheless my question was serious. I wouldn't like to pay more than €500 on a smartphone. And ...,iP6 < €500 < iP7,... Actually I am a happy Android user. But I don't like too much of my data in one basket. Which is why I would consider iPhone for my next phone. But the praise of iOS regarding privacy is rather new. So my question aims at whether I could expect also the privacy for older iPhones or if this is only coming with newer versions. Of course data safety is in this case a result of an Apple policy - which would affect all products - but possibly older iPhones still send too much data to Apple. F.x. let's assume a Catalonian opposition politician who's investigated by the Spanish police and a judge decides his data should be searched. With this warrant they contact Apple. Would apple now send all their data about the guy to the police - how much do they have? That's another question I ponder besides ad tracking policies.
Theodores 9y ago
Does anyone have a guide as to how this affects things for ecommerce? If I have a third party reviews module - Feefo, BazaarVoice etc. - will that work? Is this the end for 'AddThis' and other tracker things marketing type insist on bulking the page load times with?
infinita740 9y ago
Meanwhile they allow locations services to continue even after the user "turns off" the wifi following android footsteps(1). So tracking in apps will be worse for users. As a customer really it seems they talk a lot about privacy yet implements "sneaky" changes like this, it seems a bit dishonest. 1. I know the feature is a different in IOS (it only disconnects connected devices) but for location services/tracking this is effectively the same as android. see: https://support.apple.com/en-us/HT208086 https://support.apple.com/en-us/HT208086
- Simon_says 9y ago
  Can you clarify? Turning off wi-fi does not and should not turn off location services. Turning off location services is a separate Settings page on all recent versions of iOS.
- joeblau 9y ago
  You seem to be confused about that post. That only refers to turning off WiFi from Control Center. If you go into settings and turn off WiFi, it will actually turn the radio off. Separately, in Location and Privacy, you can disable location for your whole phone or on an App by App basis. Control Center WiFi is not tied to this.
  - kevingrahl 9y ago
    It is a massive step backwards though in my opinion, changing the functionality of the toggle in control center from disabling WiFi to just disconnecting the device. A privacy conscious user now has to do 4 actions (Unlock, open Settings, WiFi, disabling it) instead of two (swipe up, disabling it) to disable the WiFi. I doubt many normal users would notice the difference, maybe thinking the toggle has the same functionality as before thus thinking they won’t constantly broadcast their known WiFi networks and thereby the pretty accurate location of their frequently visited places. Please correct me if I misunderstood something! Edit: I meant standard as in: If no other option than SMS 2FA is available.
    - urbanj 9y ago
libertine 9y ago
"Does right by users" is quite a claim, to deprive users of targeted advertising. Be aware of this - we all know advertising is abused, and has tired users - but it's tricky to find a vendor of hardware being the gate keeper of such stance. Next step is main media groups start to block safari browsers.
- AckSyn 9y ago
  That won't happen. The media groups wouldn't alienate potential customers because of their browser choice, not these days.
  - libertine 9y ago
    They wouldn't alienate, just force them to switch browsers. This is a direct threat to their business models, and we all know desperate times call for desperate measures - specially on industries that work with thin margins already, and are getting pressured for high quality inventory.
    - designcode 9y ago
      Switch to what browser ? On iOS there’s no switching
    - chongli 9y ago
      It's not going to happen. Users will switch websites before they switch browsers. Any media site that defects from the Safari boycott will stand to pick up a lot of users. Boycotts don't work.
      - libertine 9y ago
        It's all about costs. Probably the next step is stop targeting safari browsers through programmatic buying, and if the inventory of safari browser users is worthless, publishers will act I think.
        9y ago
dx034 9y ago
Does that mean the feature is also present in chrome on ios? Or is that controlled by the interface?
wruza 9y ago
I usually turn off 3rd party cookies in my browsers and it is fine with mostly all sites, but often I forget about that and can't log into few services, cause they implement logging in a somewhat wrong way. For a big example, Atlassian lost me (and my small dev department) because their auth is too complicated to fit in one domain, while all I wanted was a simple svn hosting backed by serious player, no matter the price. /mycookiestory
- tajen 9y ago
  I'll write a theorem that every company ends up with single sign on, no matter how poor it is (oh hi Youtube, hi Ted Cruz).
- AlfeG 9y ago
  Another one is MS and Sony PSN
beager 9y ago
Two things: 1. Methinks the advertisers doth complain too much. iOS devices have essentially no way to block advertising. Not in the browsers, not by configuring certain settings. Advertisers should count their lucky stars over this. 2. Don't assume altruism here. Apple is a gatekeeper of very valuable data for advertisers. Afaik they don't have an ad tech arm, but they're sitting on an inordinately large amount of strong signal. They could sell it, and sell advertisers into their own ecosystem. Edit: I'm told by several commenters that I'm wrong. And I'm happy to be. I'd like to move my goalposts and say that native apps do not have those capabilities :)
- toasterlovin 9y ago
  iOS has had ad blockers for several years. I’m using one right now.
- teknologist 9y ago
  Actually you can now download ad blocker extensions for Safari in the App Store.
- dljsjr 9y ago
  Except Content Blocker extensions have been around since iOS 9?
arca_vorago 9y ago
It cracks me up how much the hn userbase has changed. Apple has traditionally been very user hostile, but they make some grandstand PR move and so many people fall for it like Apple cares about user privacy/freedom, etc. As Richard Stallman said, Apple puts the user in a prison. Just because the warden is getting better at playing nice some of the time and making the prison more beautiful doesn't change the fact it is a prison. In a free system, the users could have done this themselves years ago instead of waiting for Apple.
- bbatha 9y ago
  Unless you're installing AOSP android on your phone, you're in the same boat with Google. You're increasingly limited to what Google will allow on the play store. You may have some more flexibility, but to continue your analogy: android is a like a low-security prison run by gangs you may have more freedom but at the end of the day you're still on the inside and now you run the risk of getting shanked.
  - mikegerwitz 9y ago
    !Apple !== AOSP/Google With that said, the FSF endorses Replicant (which actually just had a new release and added more device support[0]). I use Replicant. Given the free software philosophy, a free program is always superior to a non-free program, no matter how bad that free program is. But Replicant isn't bad; the most recent version is a fork of "the latest changes from LineageOS 13.0 ".[0] What this emphasizes is the need for a fully free/libre mobile device, which has been the topic of other HN discussions. [0]: https://blog.replicant.us/2017/09/a-new-replicant-6-0-release/ https://blog.replicant.us/2017/09/a-new-replicant-6-0-releas...
    - mac01021 9y ago
      > Given the free software philosophy, a free program is always superior to a non-free program, no matter how bad that free program is. I never understood this opinion. If I need to navigate to drive to my grandmother's house, and none of the free nav software knows how to get there, but I have access to some proprietary software that will do the job, then why not use it? I can stop using it at any time I want, no strings attached. I can also reason about its ability to perform actions that serve its creator's interests rather than mine (capture my data and send it to the mothership, mine bitcoins on their behalf, ...) and I can make rational decisions about whether the ability to find my way to grandma's house is worth the risk. Often, the math works out that I am better off occasionally using the proprietary software.
glasz 9y ago
you folks remember steve's letter on flash? https://www.apple.com/hotnews/thoughts-on-flash/ https://www.apple.com/hotnews/thoughts-on-flash/ i'd love to see such thing wrt the ad industry whinging like this. it would be so great.
gnicholas 9y ago
I wonder if Apple will make it easier to block tracking pixels in emails. I know they let you turn off remote image loading in total, but this is a pretty blunt instrument and makes many emails hard to read. I would love if they came up with a smart solution that blocked all pixels, but didn't by default block substantive images. This is increasingly important as new email apps come out that offer consumers the ability to easily send emails with tracking pixels [1]. 1: https://techcrunch.com/2017/08/18/rapportive-founders-new-startup-superhuman-is-what-gmail-would-be-if-built-today/ https://techcrunch.com/2017/08/18/rapportive-founders-new-st...
- joosters 9y ago
  You can load images on an as-needed basis in mail. Generally, any email that is solely images and has no text is not going to be worth looking at. I can't see how defining 'substantive' images could ever work. The other issue is that email clickable links are often unique and tracked, so images are unfortunately only part of the problem here.
  - gnicholas 9y ago
    > I can't see how defining 'substantive' images could ever work. See Superhuman. They're using tracking pixels with no related images or links.
  - xoa 9y ago
    >I can't see how defining 'substantive' images could ever work You can't? Seems pretty straight forward, so long as you remember first and foremost that 100% accuracy is completely unnecessary. The "load all images" option can still be there, so all that's needed is a solution that's good enough to suffice the majority of the time and shape norms and standard-case. That leaves lot of low hanging fruit. To start with are basic heuristics like that there is no need in email for 1x1 or 2x2 or 3x3 or whatever pixel images, or images where the pixels are entirely set to transparent. A lot of tracking stuff, particularly mass scale efforts tied to multiple parties beyond the sender, is pretty blatantly content free for even a totally dumb static rule set. Slightly more smarts could be used to discriminate based on simple sender trust heuristics, such as whether the email is cryptographically signed, they're in your contacts book, whether you've ever replied or clicked through, etc. Finally this could be another area where, just as they did here with cookies, Apple applied some basic ML to answer the "likely substantive" question. Again, remember that failing here doesn't necessarily matter because it can still be an improvement over the status quo.
simonh 9y ago
> Apple does right by users and advertisers are displeased Looking at all the anti-Apple bile and conspiracy theory crap on this thread, it looks like the anti-Apple crowd are completely unhinged by it as well.
specialist 9y ago
Yes, this benefits Apple customers. I'm pleased. But it also attacks the revenue of the other 3 horsemen (Google, Facebook, Amazon). Which also pleases me. If I was Apple, I'd mess with advertising, just because.
- caseysoftware 9y ago
  That was my first (very pleased!) read on it at first but this snippet towards the end: > "When you visit a site, any cookies that are set can be used in a third-party context for twenty-four hours. During the first twenty-four hours the third-party cookies can be used to track the user, but afterward can only be used to login and not to track. This means that sites that you visit regularly are not significantly affected. The companies this will hit hardest are ad companies unconnected with any major publisher." Since the average internet user (aka not us) visits Facebook constantly and Google regularly, will this really have an impact at all?
  - craftyguy 9y ago
    Right, no real effect for most users and ad publishers. Apple didn't really do much here.
  - Xixi 9y ago
    I would think the average user visits Facebook through the Facebook app, not through Safari, so that should very much affect them. Google is a different story...
    - apocalyptic0n3 9y ago
      Not on desktop, however. Safari for macOS is introducing the same functionality
      - dpkonofa 9y ago
        Right, but isn't that the point that now they can't track you across sessions based on logins and things of that nature. If I use the app on my phone, they can't check my browser history against that and, on the Mac, they can keep my login information but they can't track me across sites. Seems like a win-win for users on both ends.
Symbiote 9y ago
For the first time, I'm also tempted by an iPhone. But, it's still a proprietary system, and there are far fewer open source apps in the App Store compared to the Play store. Maybe I'm better continuing as I do now -- Android, but with Firefox + blocking plugins installed.
- criddell 9y ago
  I think you are looking at it the right way. If the software you want to run isn't available on some platform, that should rule out the platform. I've always had an Android phone and an iPad so I've tended to choose applications that are cross platform so switching is easy for me. I think my next phone is going to be an iPhone because I'm starting to feel like a sharecropper on the Google farm.
- 482794793792894 9y ago
  In case you're not aware, on Android there's also F-Droid, an app store with only open-source apps, maintained by a non-profit organization. At least when I'm looking for open-source apps on Android, that's where I start looking... https://f-droid.org/ https://f-droid.org/
twobyfour 9y ago
From a consumer privacy standpoint, Apple has the advantage over Google that they are not beholden to advertisers for any significant portion of their revenue.
freedomben 9y ago
If Apple really wants to do right by users, they need to open source their software. I don't like any giant company saying, "trust us, our code is completely closed and we put up tons of road blocks for you unless you use it the way we say you should, but we take your privacy seriously. Trust us <EvilSmile />" As long as Apple is a closed and secretive company, I won't consider them advocates for users.
- GabeRicard 9y ago
  If you have that view of Apple and don't trust them, then what would be different if the code was open source? You think they couldn't do a special "evil" build for devices where you can't access the binary and then provide the "non-evil" source for it?
justin1364 9y ago
why don't site and advertiser just set up a subdomain of the primary site, and point the DNS to an ad server?
- justin1364 9y ago
  (maybe this is just too much work?)
krausejj 9y ago
Beyond ads/retargeting, does this render analytics services useless? Will Google Analytics and Mixpanel show anyone who isn't a daily active user as "new"? Will Optimizely not be able to customize my site and have that be retained for that user going forward beyond a day?
alanh 9y ago
Related: Check if your browser is currently allowing third party cookies https://alanhogan.github.io/web-experiments/3rd/third-party-cookies.html https://alanhogan.github.io/web-experiments/3rd/third-party-...

433 points by DiabloD3 9y ago

Would I be right to assume that safari on iOS defeats browser finger printing, given the absence of flash and the fact that you can't really customise the platform, adding new fonts, etc, so the entropy is close to zero?

delta1 9y ago
It doesn't seem so, visiting Panopticlick[0] on my unmodified Safari/iPhone7/iOS 10.3.3 gives "your browser has a nearly unique fingerprint" [0]https://panopticlick.eff.org/ https://panopticlick.eff.org/
- cdubzzz 9y ago
  Ditto on iOS 11 with Safari. In Firefox I get just unique, in Safari it is “nearly unique”.
  - dantiberian 9y ago
    I don't know how well Panopticlick would do for scoring Safari 11, as it runs all its tests within a few seconds. Some of Safari's new behaviour around third and first party cookies only kick in after 24 hours, or 30 days.
- mnw21cam 9y ago
  So, panopticlick marks down my browser because it doesn't unblock third parties that promise to honour "Do not track". In what way is this bad? (Yes, I have third party cookies blocked. No, I'm not unblocking them.)
  - cisanti 9y ago
    It's bad in a sense that you're possible to identify uniquely by the advertisers. Do not track is snake oil anyway...
  - qbrass 9y ago
    The more things you do that aren't like what everyone else does, the easier it is to single you out from the combination of those choices.
- yoz-y 9y ago
  Being on an iPhone will however reduce most of those bits to 0. For example any iPhone 8 with iOS11 will share the same screen resolution, fonts, user agent and so on. They talk about this in their methodology, however do not give the actual bits in their results, only that you have 'more than 19'
- tbrock 9y ago
  I’m golden on iOS 11.0.0
- eridius 9y ago
  I got the same thing. When I look at the fingerprint details though, it's not clear why it should be "nearly unique". Of the things listed there, there's not much that's customizable, mostly just time zone, locale, DNT, and if cookies are enabled. That said, it also has "Hash of canvas fingerprint", which apparently has a lot of bits, but I have no idea what information that's actually extracting. Similarly "Hash of WebGL fingerprint". I did try this on iOS 11, which they probably don't have much data for yet and would explain some of the unique-ness, but you said iOS 10.3.3 which is much less new. Maybe iPhone users just don't try panopticlick very much?
snakeanus 9y ago
You can still do things like being able to get the battery status with JS or detect visited links.
- tempay 9y ago
  > detect visited links Is this still possible? I was under the impression this is prevented in most browsers.
  - synthmeat 9y ago
    Also wrt battery status - that's only Chrome thing these days. http://caniuse.com/#feat=battery-status http://caniuse.com/#feat=battery-status
    - snakeanus 9y ago
      For firefox there is dom.battery.enabled and https://developer.mozilla.org/en-US/docs/Web/API/Battery_Status_API https://developer.mozilla.org/en-US/docs/Web/API/Battery_Sta... but it seems that since 42 it is enabled only for addons. It seems that I was wrong about that indeed.
  - Aissen 9y ago
    Well, browser vendors keep adding features, and in 2014, it was predicted by lcamtuf that the mix-blend-mode property would be useful to access browser history: https://lcamtuf.blogspot.fr/2016/08/css-mix-blend-mode-is-bad-for-keeping.html https://lcamtuf.blogspot.fr/2016/08/css-mix-blend-mode-is-ba... Two years later, it was implemented, and the demo seems to be working here in Firefox 56: http://lcamtuf.coredump.cx/whack/ http://lcamtuf.coredump.cx/whack/
- withjive 9y ago
  Newer versions (since around 2013) of webkit and gecko limit a:visited style changes to just colour or background colour. So the getComputedStyle() trick doesn't work anymore. Is that what your referring to?

phasecode 9y ago

Hopefully FireFox and-or IE will be the next to step up. I don't see Chrome stepping up until every other browser has.

KGIII 9y ago
You may wish to visit this link: https://www.theverge.com/2017/6/1/15726778/chrome-ad-blocker-early-2018-announced-google https://www.theverge.com/2017/6/1/15726778/chrome-ad-blocker... By the way, a friendly reminder that EFF is happy to take donations and there are a variety of ways to do so.
- votepaunchy 9y ago
  Blocking a few egregious ad types is not at all the same as the blocking of privacy-invading cookies as Apple is doing. > The Chrome ad blocker doesn’t just help publishers, it also helps Google maintain its dominance. And it advantages Google’s own ad units, which, it’s safe to say, will not be in violation of the bad ad rules. Don’t be evil, indeed.
  - KGIII 9y ago
    Right, but it's a start - meaning they might eventually get there. It means there is pressure and that they may be obligated to take notice. It's not the end, it is the beginning.
    - romanovcode 9y ago
      > Right, but it's a start - meaning they might eventually get there. Get where, exactly? 88% of Google money comes from Ads[0], if you think their plan is to remove them from web you are either crazy or stupid. [0] - http://www.businessinsider.de/how-google-apple-facebook-amazon-microsoft-make-money-chart-2017-5?r=US&IR=T http://www.businessinsider.de/how-google-apple-facebook-amaz...
      - KGIII 9y ago

boyter 9y ago

Which is exactly why as of last month bought my first iPhone. The pro privacy stance that Apple is taking is wonderful to see. No idea if anyone pushing this at Apple will ever read this but you have a customer for life if you continue to do so and will champion your products to their entire sphere of influence.

Sholmesy 9y ago
Agreed. Apple has been mostly good wrt to privacy in the past, but since they've started to make it a selling/differentiation point, I expect them to solidify their stance. I think it's a genius move. People will begin to understand in the coming years just how much information these companies are tracking/extracting, and turn(or stay) to Apple. I think users would care about privacy, if they truly knew just how much information is being gathered.
- ramblerman 9y ago
  Apple has shareholders and changing CEOs. This is really naive at best
  - Angostura 9y ago
    As long as the company can show the shareholders that differentiating on privacy provides good ROI, they will be happy.
    - pilsetnieks 9y ago
      There doesn't have to be a good ROI. Quoting Tim Cook: "When we work on making our devices accessible by the blind, I don't consider the bloody ROI. [..] If you want me to do things only for ROI reasons, you should get out of this stock." https://www.macobserver.com/tmo/article/tim-cook-soundly-rejects-politics-of-the-ncppr-suggests-group-sell-apples-s https://www.macobserver.com/tmo/article/tim-cook-soundly-rej...
  - pilsetnieks 9y ago

ak39 9y ago

This is a complete guess ... Apple "does right by users". That's ok. But I'd wager this is only because that type of positioning is now Apple's chosen market differentiating* strategy. Against Google. Apple seems to want to position itself as the device that guarantees privacy and security. Apple would like to maintain exclusive access to a market segment that values security and privacy above all. It worked for BlackBerry. Strong and almost cult-like loyalist following mostly guaranteed BB's reach in the executive circles. Even after BB became "Veblen", the device was in high demand. In such a market segment, the price per device doesn't really matter. My view is consistent with the apparent "horror" prices seen for the new iPhone. If my guess is right, it's a shame about Apple's chosen direction. I love their products.

sacheendra 9y ago
Why is it a shame about Apple's direction? Apple realised there is a market of privacy minded people who don't want to trade themselves to get a phone at a low price. Apple can be privacy minded for profit and "do right by the users" at the same time. They aren't diametrically opposed to each other. It is sad that we expect that a company trying to stay profitable is trying to screw users over in some way. I'm not saying its not true in many cases, just in this case.
- ak39 9y ago
  > Why is it a shame about Apple's direction? Because it's too easy when you see a company that once dominated this space with Jobs' legacy. It's easy to be the good guy. It's morally reprehensible even to advertise yourself as such. Jobs' legacy of thinking differently has been recently misapplied with idiotic decisions like no headphone jacks, removal of fn keys, removal of magsafe power etc. It would seem that the "innovation department" Apple would rather settle for difference BY DEFAULT. That's the shame.
  - zimpenfish 9y ago
    > It's easy to be the good guy. Then why are Apple the only company even contemplating this?

dalbasal 9y ago

Browsers are really where privacy needs to come from. I know a lot of people have hopes for a legislative solutions, but I think the EU (also UK and others) "cookie law" really needs to make us consider how effective they can be. The motivation for the law was good. They put their finger in the right place. . We got nag screens and little improvment in privacy. Not every piece of privacy legislation does as little as this, but I still think we need to be wary. Browsers, OTOH, are in a great position to improve user privacy. Maybe instead of letters to parliamentarians, letters to browser makers?

Yaggo 9y ago
> We got nag screens and little improvment in privacy. We definitely got the nag screens¹, but improvement? [1] Which is totally inferior solution technically & ux-wise, because the user/client voluntarily accepts the cookie from the server, and there's already setting for that in the browser.
- lloeki 9y ago
  The nags are only mandated for tracking, cookies are only a implementation detail. The EU directive explicitly mentions that, does not even focus on cookies, and states that cookies (or whatever) pertaining to site operation (such as login/cart/whatever) do not require nagging. Thus the proper browser setting is DNT, not accepting cookies. But everyone construed that cookies <=> nag, because nobody RTFM.
  - dalbasal 9y ago
    I don’t think it’s a RTFM thing. The lawyers RTFM, and this is what they came up with. The legislation called for informed consent. Two core issues were left open to definition, in practice. [1] What requires informed consent? [2] What counts as informed consent. For question 2, a standard answer (nag screen) emerged. Question 1 is trickier. The cheapest & easiest solution is to just nag, so that’s the default. If you want to drop the nag screen you can deal with question 1, but most don’t bother. Either they want the tracking, they want the easiest option or they want legal CYA. I think the legislative intentions were good, but this was a hard area to legislate. It didn’t work, IMO.

eps 9y ago

This is all lovely and all, but... cookies? If I were an ad network, I'd long ago switched to local storage and browser fingerprinting. Especially if it's my very survival as a business is at stake.

scarlac 9y ago
The localStorage is not readable across sites. Cookies are. The issue is mostly with 3rd party cookies which many in the industry rely on to do tracking.
- eps 9y ago
  My main point was in browser fingerprinting. LocalStorage is just an icing on top to better cross-reference users in the scope of the same site.
mirimir 9y ago
Well, yeah. So just compartmentalize. If there's some set of online activity that you don't want linked to you, do it in a dedicated VM. With Internet connectivity via some mix of VPNs and Tor. Everything that Mirimir does online is linked, at least somewhat. But that's fine, because it's not linked to my meatspace identity.
- eps 9y ago
  Well, sure. Point being that this "fight for the users" centered around 3rd party cookies is a privacy theatre. If 3rd party cookies were to be completely blocked on every single computer tomorrow, the ad industry will just switch to another option and nothing will change. But this does make Apple look like privacy champions.

dvt 9y ago

Was recently telling my dad about this. I might get an iPhone X just because of Apple's new stance on browsing privacy. I recently quit my ad-tech job and what FB/Google does with tracking is incredibly sketchy. Glad to see a large company with leverage fight back.

blubb-fish 9y ago
Why not an iPhone 6?
- blubb-fish 9y ago
  "This question is an outrageous profanity!"
- alien_at_work 9y ago
  Don't know why people are downvoting this, but the 5C just got "obsoleted" so that could mean the 6 is right on the brink of update oblivion. So that could be a reason.
  - blubb-fish 9y ago
    could be - but the question is so stupid - not worthy to actually reply. In the light of such pretentious behaviour I have no idea why apple users have a reputation of being pragmatic and down2earth. </irony>
    - alien_at_work 9y ago
      I'm an apple user, perhaps even a fan. I don't have a clue why your comment was downvoted. Is it a lot? Maybe it's a misclick.
      - blubb-fish 9y ago
        just joking. nonetheless my question was serious. I wouldn't like to pay more than €500 on a smartphone. And ...,iP6 < €500 < iP7,... Actually I am a happy Android user. But I don't like too much of my data in one basket. Which is why I would consider iPhone for my next phone. But the praise of iOS regarding privacy is rather new. So my question aims at whether I could expect also the privacy for older iPhones or if this is only coming with newer versions. Of course data safety is in this case a result of an Apple policy - which would affect all products - but possibly older iPhones still send too much data to Apple. F.x. let's assume a Catalonian opposition politician who's investigated by the Spanish police and a judge decides his data should be searched. With this warrant they contact Apple. Would apple now send all their data about the guy to the police - how much do they have? That's another question I ponder besides ad tracking policies.

Theodores 9y ago

Does anyone have a guide as to how this affects things for ecommerce? If I have a third party reviews module - Feefo, BazaarVoice etc. - will that work? Is this the end for 'AddThis' and other tracker things marketing type insist on bulking the page load times with?

infinita740 9y ago

Meanwhile they allow locations services to continue even after the user "turns off" the wifi following android footsteps(1). So tracking in apps will be worse for users. As a customer really it seems they talk a lot about privacy yet implements "sneaky" changes like this, it seems a bit dishonest. 1. I know the feature is a different in IOS (it only disconnects connected devices) but for location services/tracking this is effectively the same as android. see: https://support.apple.com/en-us/HT208086 https://support.apple.com/en-us/HT208086

Simon_says 9y ago
Can you clarify? Turning off wi-fi does not and should not turn off location services. Turning off location services is a separate Settings page on all recent versions of iOS.
joeblau 9y ago
You seem to be confused about that post. That only refers to turning off WiFi from Control Center. If you go into settings and turn off WiFi, it will actually turn the radio off. Separately, in Location and Privacy, you can disable location for your whole phone or on an App by App basis. Control Center WiFi is not tied to this.
- kevingrahl 9y ago
  It is a massive step backwards though in my opinion, changing the functionality of the toggle in control center from disabling WiFi to just disconnecting the device. A privacy conscious user now has to do 4 actions (Unlock, open Settings, WiFi, disabling it) instead of two (swipe up, disabling it) to disable the WiFi. I doubt many normal users would notice the difference, maybe thinking the toggle has the same functionality as before thus thinking they won’t constantly broadcast their known WiFi networks and thereby the pretty accurate location of their frequently visited places. Please correct me if I misunderstood something! Edit: I meant standard as in: If no other option than SMS 2FA is available.
  - urbanj 9y ago

libertine 9y ago

"Does right by users" is quite a claim, to deprive users of targeted advertising. Be aware of this - we all know advertising is abused, and has tired users - but it's tricky to find a vendor of hardware being the gate keeper of such stance. Next step is main media groups start to block safari browsers.

AckSyn 9y ago
That won't happen. The media groups wouldn't alienate potential customers because of their browser choice, not these days.
- libertine 9y ago
  They wouldn't alienate, just force them to switch browsers. This is a direct threat to their business models, and we all know desperate times call for desperate measures - specially on industries that work with thin margins already, and are getting pressured for high quality inventory.
  - designcode 9y ago
    Switch to what browser ? On iOS there’s no switching
  - chongli 9y ago
    It's not going to happen. Users will switch websites before they switch browsers. Any media site that defects from the Safari boycott will stand to pick up a lot of users. Boycotts don't work.
    - libertine 9y ago
      It's all about costs. Probably the next step is stop targeting safari browsers through programmatic buying, and if the inventory of safari browser users is worthless, publishers will act I think.
      - 9y ago

dx034 9y ago

Does that mean the feature is also present in chrome on ios? Or is that controlled by the interface?

wruza 9y ago

I usually turn off 3rd party cookies in my browsers and it is fine with mostly all sites, but often I forget about that and can't log into few services, cause they implement logging in a somewhat wrong way. For a big example, Atlassian lost me (and my small dev department) because their auth is too complicated to fit in one domain, while all I wanted was a simple svn hosting backed by serious player, no matter the price. /mycookiestory

tajen 9y ago
I'll write a theorem that every company ends up with single sign on, no matter how poor it is (oh hi Youtube, hi Ted Cruz).
AlfeG 9y ago
Another one is MS and Sony PSN

beager 9y ago

Two things: 1. Methinks the advertisers doth complain too much. iOS devices have essentially no way to block advertising. Not in the browsers, not by configuring certain settings. Advertisers should count their lucky stars over this. 2. Don't assume altruism here. Apple is a gatekeeper of very valuable data for advertisers. Afaik they don't have an ad tech arm, but they're sitting on an inordinately large amount of strong signal. They could sell it, and sell advertisers into their own ecosystem. Edit: I'm told by several commenters that I'm wrong. And I'm happy to be. I'd like to move my goalposts and say that native apps do not have those capabilities :)

toasterlovin 9y ago
iOS has had ad blockers for several years. I’m using one right now.
teknologist 9y ago
Actually you can now download ad blocker extensions for Safari in the App Store.
dljsjr 9y ago
Except Content Blocker extensions have been around since iOS 9?

arca_vorago 9y ago

It cracks me up how much the hn userbase has changed. Apple has traditionally been very user hostile, but they make some grandstand PR move and so many people fall for it like Apple cares about user privacy/freedom, etc. As Richard Stallman said, Apple puts the user in a prison. Just because the warden is getting better at playing nice some of the time and making the prison more beautiful doesn't change the fact it is a prison. In a free system, the users could have done this themselves years ago instead of waiting for Apple.

bbatha 9y ago
Unless you're installing AOSP android on your phone, you're in the same boat with Google. You're increasingly limited to what Google will allow on the play store. You may have some more flexibility, but to continue your analogy: android is a like a low-security prison run by gangs you may have more freedom but at the end of the day you're still on the inside and now you run the risk of getting shanked.
- mikegerwitz 9y ago
  !Apple !== AOSP/Google With that said, the FSF endorses Replicant (which actually just had a new release and added more device support[0]). I use Replicant. Given the free software philosophy, a free program is always superior to a non-free program, no matter how bad that free program is. But Replicant isn't bad; the most recent version is a fork of "the latest changes from LineageOS 13.0 ".[0] What this emphasizes is the need for a fully free/libre mobile device, which has been the topic of other HN discussions. [0]: https://blog.replicant.us/2017/09/a-new-replicant-6-0-release/ https://blog.replicant.us/2017/09/a-new-replicant-6-0-releas...
  - mac01021 9y ago
    > Given the free software philosophy, a free program is always superior to a non-free program, no matter how bad that free program is. I never understood this opinion. If I need to navigate to drive to my grandmother's house, and none of the free nav software knows how to get there, but I have access to some proprietary software that will do the job, then why not use it? I can stop using it at any time I want, no strings attached. I can also reason about its ability to perform actions that serve its creator's interests rather than mine (capture my data and send it to the mothership, mine bitcoins on their behalf, ...) and I can make rational decisions about whether the ability to find my way to grandma's house is worth the risk. Often, the math works out that I am better off occasionally using the proprietary software.

glasz 9y ago

you folks remember steve's letter on flash? https://www.apple.com/hotnews/thoughts-on-flash/ https://www.apple.com/hotnews/thoughts-on-flash/ i'd love to see such thing wrt the ad industry whinging like this. it would be so great.

gnicholas 9y ago

I wonder if Apple will make it easier to block tracking pixels in emails. I know they let you turn off remote image loading in total, but this is a pretty blunt instrument and makes many emails hard to read. I would love if they came up with a smart solution that blocked all pixels, but didn't by default block substantive images. This is increasingly important as new email apps come out that offer consumers the ability to easily send emails with tracking pixels [1]. 1: https://techcrunch.com/2017/08/18/rapportive-founders-new-startup-superhuman-is-what-gmail-would-be-if-built-today/ https://techcrunch.com/2017/08/18/rapportive-founders-new-st...

joosters 9y ago
You can load images on an as-needed basis in mail. Generally, any email that is solely images and has no text is not going to be worth looking at. I can't see how defining 'substantive' images could ever work. The other issue is that email clickable links are often unique and tracked, so images are unfortunately only part of the problem here.
- gnicholas 9y ago
  > I can't see how defining 'substantive' images could ever work. See Superhuman. They're using tracking pixels with no related images or links.
- xoa 9y ago
  >I can't see how defining 'substantive' images could ever work You can't? Seems pretty straight forward, so long as you remember first and foremost that 100% accuracy is completely unnecessary. The "load all images" option can still be there, so all that's needed is a solution that's good enough to suffice the majority of the time and shape norms and standard-case. That leaves lot of low hanging fruit. To start with are basic heuristics like that there is no need in email for 1x1 or 2x2 or 3x3 or whatever pixel images, or images where the pixels are entirely set to transparent. A lot of tracking stuff, particularly mass scale efforts tied to multiple parties beyond the sender, is pretty blatantly content free for even a totally dumb static rule set. Slightly more smarts could be used to discriminate based on simple sender trust heuristics, such as whether the email is cryptographically signed, they're in your contacts book, whether you've ever replied or clicked through, etc. Finally this could be another area where, just as they did here with cookies, Apple applied some basic ML to answer the "likely substantive" question. Again, remember that failing here doesn't necessarily matter because it can still be an improvement over the status quo.

simonh 9y ago

> Apple does right by users and advertisers are displeased Looking at all the anti-Apple bile and conspiracy theory crap on this thread, it looks like the anti-Apple crowd are completely unhinged by it as well.

specialist 9y ago

Yes, this benefits Apple customers. I'm pleased. But it also attacks the revenue of the other 3 horsemen (Google, Facebook, Amazon). Which also pleases me. If I was Apple, I'd mess with advertising, just because.

caseysoftware 9y ago
That was my first (very pleased!) read on it at first but this snippet towards the end: > "When you visit a site, any cookies that are set can be used in a third-party context for twenty-four hours. During the first twenty-four hours the third-party cookies can be used to track the user, but afterward can only be used to login and not to track. This means that sites that you visit regularly are not significantly affected. The companies this will hit hardest are ad companies unconnected with any major publisher." Since the average internet user (aka not us) visits Facebook constantly and Google regularly, will this really have an impact at all?
- craftyguy 9y ago
  Right, no real effect for most users and ad publishers. Apple didn't really do much here.
- Xixi 9y ago
  I would think the average user visits Facebook through the Facebook app, not through Safari, so that should very much affect them. Google is a different story...
  - apocalyptic0n3 9y ago
    Not on desktop, however. Safari for macOS is introducing the same functionality
    - dpkonofa 9y ago
      Right, but isn't that the point that now they can't track you across sessions based on logins and things of that nature. If I use the app on my phone, they can't check my browser history against that and, on the Mac, they can keep my login information but they can't track me across sites. Seems like a win-win for users on both ends.

Symbiote 9y ago

For the first time, I'm also tempted by an iPhone. But, it's still a proprietary system, and there are far fewer open source apps in the App Store compared to the Play store. Maybe I'm better continuing as I do now -- Android, but with Firefox + blocking plugins installed.

criddell 9y ago
I think you are looking at it the right way. If the software you want to run isn't available on some platform, that should rule out the platform. I've always had an Android phone and an iPad so I've tended to choose applications that are cross platform so switching is easy for me. I think my next phone is going to be an iPhone because I'm starting to feel like a sharecropper on the Google farm.
482794793792894 9y ago
In case you're not aware, on Android there's also F-Droid, an app store with only open-source apps, maintained by a non-profit organization. At least when I'm looking for open-source apps on Android, that's where I start looking... https://f-droid.org/ https://f-droid.org/

twobyfour 9y ago

From a consumer privacy standpoint, Apple has the advantage over Google that they are not beholden to advertisers for any significant portion of their revenue.

freedomben 9y ago

If Apple really wants to do right by users, they need to open source their software. I don't like any giant company saying, "trust us, our code is completely closed and we put up tons of road blocks for you unless you use it the way we say you should, but we take your privacy seriously. Trust us <EvilSmile />" As long as Apple is a closed and secretive company, I won't consider them advocates for users.

GabeRicard 9y ago
If you have that view of Apple and don't trust them, then what would be different if the code was open source? You think they couldn't do a special "evil" build for devices where you can't access the binary and then provide the "non-evil" source for it?

justin1364 9y ago

why don't site and advertiser just set up a subdomain of the primary site, and point the DNS to an ad server?

justin1364 9y ago
(maybe this is just too much work?)

krausejj 9y ago

Beyond ads/retargeting, does this render analytics services useless? Will Google Analytics and Mixpanel show anyone who isn't a daily active user as "new"? Will Optimizely not be able to customize my site and have that be retained for that user going forward beyond a day?

alanh 9y ago

Related: Check if your browser is currently allowing third party cookies https://alanhogan.github.io/web-experiments/3rd/third-party-cookies.html https://alanhogan.github.io/web-experiments/3rd/third-party-...