4 ms·

> Thr fact that Apple which could do this without significant adverse monetary impact but has chosen not to They restrict access to most of the things listed a

> Thr fact that Apple which could do this without significant adverse monetary impact but has chosen not to They restrict access to most of the things listed above, giving randomised fakes where necessary. The advertising ID they do let apps access is unique to a publisher so they can't be tied together with behaviour from apps by other publishers, and it's trivially disabled/resettable by the end user (Settings > Privacy > Advertising > Limit Ad Tracking / Reset Advertising Identifier…). They improve things every year, e.g. Safari's intelligent tracking prevention. I'm not really sure how you can arrive at the conclusion that Apple are holding back; they seem clearly committed to improving privacy as demonstrated by their continuous work in the area.

samt 8y ago
Where do you get that IDFA is unique to the publisher?
- JimDabell 8y ago
  Apologies, I'm conflating two slightly different things there. There's the identifierForVendor [0] which is unique to the publisher. This is pretty safe to use however you see fit (within reason). Then there's the advertisingIdentifier [1], which is not unique, but can easily be permanently zeroed out by the user. Apple also have some fairly stringent rules about how it can be used [2], not to mention further rules about not identifying people surreptitiously [3]: > 5.1.2 Data Use and Sharing > (iii) Apps should not attempt to surreptitiously build a user profile based on collected data and may not attempt, facilitate, or encourage others to identify anonymous users or reconstruct user profiles based on data collected from Apple-provided APIs or any data that you say has been collected in an “anonymized,” “aggregated,” or otherwise non-identifiable way. They ask you to explicitly confirm that you're following the advertising identifier rules in particular every single time you submit to the App Store. [0] https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor https://developer.apple.com/documentation/uikit/uidevice/162... [1] https://developer.apple.com/documentation/adsupport/asidentifiermanager https://developer.apple.com/documentation/adsupport/asidenti... [2] https://support.appsflyer.com/hc/en-us/articles/207032086-Apple-IDFA-Guidelines-How-To-Submit-Your-iOS-App-With-IDFA https://support.appsflyer.com/hc/en-us/articles/207032086-Ap... [3] https://developer.apple.com/app-store/review/guidelines/#data-use-and-sharing https://developer.apple.com/app-store/review/guidelines/#dat...
  - codedokode 8y ago
    Cannot these restrictions be lifted if you write that the user agrees to sharing all of their data for any purposes somewhere between the lines of a 20-page Privacy Policy?
    - mcny 8y ago
      I imagine Apple has the final word on how to define the word surreptitiously. I would like to think Apple could interpret somewhere in 20 page privacy policy is surreptitious.
robertAngst 8y ago
>I'm not really sure how you can arrive at the conclusion that Apple are holding back; they seem clearly committed to improving privacy as demonstrated by their continuous work in the area. Given the Apple phone was successfully hacked in the FBI case, I'm not sure why HN seems to think they are the bastion of privacy. Given the other anti-consumer and anti-developer practices at Apple, I wouldn't trust them to protect privacy(today, and in the future when their stock price takes a hit).
- JimDabell 8y ago
  I was responding to somebody who is under the impression that Apple are purposefully choosing not to protect user privacy. The most powerful government in the world hacking an Apple product in their possession without Apple's consent isn't relevant to that. If anything, the fact that Apple went to court to avoid being compelled to aid them in the endeavour supports what I am saying. I'm not saying that Apple products are 100% impenetrable against nation states; I'm pointing out that Apple are clearly putting serious effort into protecting user privacy. I'm not sure why this is such a foreign concept to so many people. This is something Apple can do that their competitors cannot due to their business models. It's becoming more and more of a concern to customers and the law in many places. Even if you assume Apple are 100% self-serving, this is obviously a valuable differentiator for them to capitalise on.
  - jilop 8y ago
    That is illogical. Declining to hand over unwarranted data to LEO is independent of using user data for commercial purposes. Google also has tight security and privacy from government intrusion It's contradictory in fact, because data monetizing companies prefer to control data not leak it, to keep the data's price high.
    - FiveSquared 8y ago
      But you can still buy it and penetrate the severs and ISPs
- 8y ago
soziawa 8y ago
> The advertising ID they do let apps access is unique to a publisher so they can't be tied together with behaviour from apps by other publishers, and it's trivially disabled/resettable by the end user (Settings > Privacy > Advertising > Limit Ad Tracking / Reset Advertising Identifier…). They still let apps give you a unique identifier through shared containers, those will only be deleted if you delete all apps that can access it. There is also some other container (I forgot the name) which will never be deleted unless you get a new device and don't restore any backups. You can see this kind of behaviour when you delete Instagram and they automatically fill out your username the next time you install it. With Facebook owning WhatsApp, they are already able to give each iOS device a unique identifier. What is Apple going to do about it? Remove WhatsApp from the App Store?
- JimDabell 8y ago
  Shared containers are also restricted by publisher – you can't share data with another publisher using them. I believe the other container you're talking about is the keychain. You can store small amounts of data in there (typically secure auth info) and it will persist even after app deletion. This is hardware encrypted by the Secure Enclave and can't be shared between publishers. Apple have shown that they are willing to remove big social media apps from the App Store just a few weeks ago, with Tumblr. Also, collecting information for use in WhatsApp and using it for a different purpose in Facebook is a DPA and GDPR violation: https://www.theguardian.com/technology/2018/mar/14/whatsapp-sharing-user-data-facebook-illegal-ico-gdpr https://www.theguardian.com/technology/2018/mar/14/whatsapp-...

samt 8y ago

Where do you get that IDFA is unique to the publisher?

JimDabell 8y ago
Apologies, I'm conflating two slightly different things there. There's the identifierForVendor [0] which is unique to the publisher. This is pretty safe to use however you see fit (within reason). Then there's the advertisingIdentifier [1], which is not unique, but can easily be permanently zeroed out by the user. Apple also have some fairly stringent rules about how it can be used [2], not to mention further rules about not identifying people surreptitiously [3]: > 5.1.2 Data Use and Sharing > (iii) Apps should not attempt to surreptitiously build a user profile based on collected data and may not attempt, facilitate, or encourage others to identify anonymous users or reconstruct user profiles based on data collected from Apple-provided APIs or any data that you say has been collected in an “anonymized,” “aggregated,” or otherwise non-identifiable way. They ask you to explicitly confirm that you're following the advertising identifier rules in particular every single time you submit to the App Store. [0] https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor https://developer.apple.com/documentation/uikit/uidevice/162... [1] https://developer.apple.com/documentation/adsupport/asidentifiermanager https://developer.apple.com/documentation/adsupport/asidenti... [2] https://support.appsflyer.com/hc/en-us/articles/207032086-Apple-IDFA-Guidelines-How-To-Submit-Your-iOS-App-With-IDFA https://support.appsflyer.com/hc/en-us/articles/207032086-Ap... [3] https://developer.apple.com/app-store/review/guidelines/#data-use-and-sharing https://developer.apple.com/app-store/review/guidelines/#dat...
- codedokode 8y ago
  Cannot these restrictions be lifted if you write that the user agrees to sharing all of their data for any purposes somewhere between the lines of a 20-page Privacy Policy?
  - mcny 8y ago
    I imagine Apple has the final word on how to define the word surreptitiously. I would like to think Apple could interpret somewhere in 20 page privacy policy is surreptitious.

robertAngst 8y ago

>I'm not really sure how you can arrive at the conclusion that Apple are holding back; they seem clearly committed to improving privacy as demonstrated by their continuous work in the area. Given the Apple phone was successfully hacked in the FBI case, I'm not sure why HN seems to think they are the bastion of privacy. Given the other anti-consumer and anti-developer practices at Apple, I wouldn't trust them to protect privacy(today, and in the future when their stock price takes a hit).

JimDabell 8y ago
I was responding to somebody who is under the impression that Apple are purposefully choosing not to protect user privacy. The most powerful government in the world hacking an Apple product in their possession without Apple's consent isn't relevant to that. If anything, the fact that Apple went to court to avoid being compelled to aid them in the endeavour supports what I am saying. I'm not saying that Apple products are 100% impenetrable against nation states; I'm pointing out that Apple are clearly putting serious effort into protecting user privacy. I'm not sure why this is such a foreign concept to so many people. This is something Apple can do that their competitors cannot due to their business models. It's becoming more and more of a concern to customers and the law in many places. Even if you assume Apple are 100% self-serving, this is obviously a valuable differentiator for them to capitalise on.
- jilop 8y ago
  That is illogical. Declining to hand over unwarranted data to LEO is independent of using user data for commercial purposes. Google also has tight security and privacy from government intrusion It's contradictory in fact, because data monetizing companies prefer to control data not leak it, to keep the data's price high.
  - FiveSquared 8y ago
    But you can still buy it and penetrate the severs and ISPs
8y ago

soziawa 8y ago

> The advertising ID they do let apps access is unique to a publisher so they can't be tied together with behaviour from apps by other publishers, and it's trivially disabled/resettable by the end user (Settings > Privacy > Advertising > Limit Ad Tracking / Reset Advertising Identifier…). They still let apps give you a unique identifier through shared containers, those will only be deleted if you delete all apps that can access it. There is also some other container (I forgot the name) which will never be deleted unless you get a new device and don't restore any backups. You can see this kind of behaviour when you delete Instagram and they automatically fill out your username the next time you install it. With Facebook owning WhatsApp, they are already able to give each iOS device a unique identifier. What is Apple going to do about it? Remove WhatsApp from the App Store?

JimDabell 8y ago
Shared containers are also restricted by publisher – you can't share data with another publisher using them. I believe the other container you're talking about is the keychain. You can store small amounts of data in there (typically secure auth info) and it will persist even after app deletion. This is hardware encrypted by the Secure Enclave and can't be shared between publishers. Apple have shown that they are willing to remove big social media apps from the App Store just a few weeks ago, with Tumblr. Also, collecting information for use in WhatsApp and using it for a different purpose in Facebook is a DPA and GDPR violation: https://www.theguardian.com/technology/2018/mar/14/whatsapp-sharing-user-data-facebook-illegal-ico-gdpr https://www.theguardian.com/technology/2018/mar/14/whatsapp-...