10 ms·
We’re asking Apple to change the advertising ID for each iPhone every month
- olliej 8y agoThe Ad identifier isn't exposed to the web (thankfully) (Edit: Apparently I was wrong - I’d swear it was per device? Hence the single global “reset the id “ option. If it’s per app/app group/developer ID then rolling doesn’t help because they can always just generate and store their own ID)
- dymk 8y agoIDFA is not shared per app, only across developer accounts. Your Facebook and Snapchat apps don't see the same IDFA.
- olliej 8y agoOk I edited my answer but literally all my research indicates that it is per device - all apps irrespective of developer see the same ID. It was specifically created to replace the UDID that could never be changed at all. So I am irked I didn’t research before editing :-/
- arcticbull 8y agoIt's strange because I had the same impression. I remember the whole migration from UDID to application advertising identifiers... I swear each app got their own IDFA token, and that it didn't persist across app installs. I guess I was mistaken also, because it only resets on manual reset or device erasure. The APIs for this are very clear: var advertisingIdentifier: UUID { get } "Unlike the identifierForVendor property of the UIDevice, the same value is returned to all vendors. This identifier may change—for example, if the user erases the device—so you should not cache it."
- olliej 8y agoYeah, my original comment was correct unlike the very confident correction. The problem is periodic rolling of the ID doesn’t get you anything as any tracking service is simply going to track when the value changes in all the apps, and so all different IDFA tokens can always be tied to a single individual. Rolling, automatic or not, and irrespective of frequency gains you nothing. Tracking companies have repeatedly demonstrated a complete disregard for user privacy. The /only/ way to fix this is to remove device centric ids from the platform. Then tracking frameworks can’t tied one user to multiple different app installs. None of this “automatic rolling” nonsense - the API should not be there at all.
- cocochanel 8y agoWhat? IDFA is device universal and only reset manually by the user.
- lultimouomo 8y agoThey do see the same IDFA, that's how apps using the Facebook SDK can link analytics with a Facebook user profile even without asking you to login into Facebook, as long as you have the Facebook app installed and you're logged in there.
- product50 8y agoYou obviously don't know how things work. So please stop saying factually incorrect things as matter of fact statements.
- om2 8y agoIt is not in fact exposed to the web, you weren't wrong about that.
- dymk 8y agoI don't understand Mozilla's ask for changing the cycling of these tokens to monthly. If this was implemented, it wouldn't be very difficult to associate a cycled out profile with a new one. Only days of behavioral information. So if out of a 30 day month, 3 days are used to re-associate user profiles, they're only using a partial profile 10% of the time? I don't even get why Moz thinks IDFAs are particularly bad for privacy anyways. They're only shared across apps that come from the same developer; your Facebook and Snapchat apps see different tokens. They don't expose any personal information, they only identify a unique piece of hardware. It wouldn't be particularly difficult for apps themselves to generate and persist their own random token; how often do people reinstall apps anyways?
- throw03172019 8y agoYou may be thinking of IDFV (identifierForVendors). The IDFA usually stays the same until the user resets it.
- gruez 8y ago>If this was implemented, it wouldn't be very difficult to associate a cycled out profile with a new one. Only days of behavioral information. So if out of a 30 day month, 3 days are used to re-associate user profiles, they're only using a partial profile 10% of the time? It's even worse than that. The IDFA might reset every month, but there's nothing preventing apps from storing a persistent identifier in its data. As soon as there's a new IDFA, the ad network can immediately link that back to the old IDFA. As long as you have one app that belongs to the ad network, you can be linked back. You can even combine this with keychain data to persist across reinstalls (technically you're not supposed to use the keychain for this purpose, but storing the currently logged in user's credentials is fine, so you can use that instead).
- judge2020 8y ago> there's nothing preventing apps from storing a persistent identifier in its data. Can't link the PDF since it's behind a login wall, but the developer agreement already prohibits this (3.3.12): > If a user resets the Advertising Identifier, then You agree not to combine, correlate, link or otherwise associate, either directly or indirectly, the prior Advertising Identifier and any derived information with the reset Advertising Identifier.
- gervase 8y agoI wonder if these kinds of painful (from a business perspective) choices will act as a kind of forcing function on their whole privacy push, either by highlighting the hypocrisy if they continue mining customer data while preaching virtue, or alternatively, by really pushing them to put their money where their mouth is and creating a more truly private system. I think the biggest factor will be if they can convince the US population (their core demographic / market) that privacy matters. If it does, then it will be worth it to their bottom line - if not, they may have to capitulate to market forces and return to squeezing as much data as they can from their users. The next few years could be very interesting from a privacy standpoint.
- srwx 8y agoI'll believe they are honest about caring about users privacy when they release imessage for other platforms.
- dymk 8y agoWhy is that your threshold for believing that Apple cares about user privacy? The ecosystem they've built so far has had significant time and effort invested into it to make it privacy friendly.
- srwx 8y agoBecause it highlights their real motives. Why not give everyone the ability to securely communicate? profits > privacy.
- mmphosis 8y agoI wish I could "Sync" without connecting to Firefox, among other intrusive things: geo.enabled ,false,disable asking to share location extensions.pocket.enabled,false,disable pocket
- asimilator 8y ago> At Mozilla, we’re always fighting for technology that puts users’ privacy first I would love to run my own Pocket server ... 2 years and counting.
- kryptn 8y ago> I would love to run my own Pocket server ... Oh I'd love to run my own Pocket server. The service seems useful but I stopped using chrome and disabled most of the utilities I reasonably could to avoid centralizing my data again. A self-hosted Pocket could help some of that.
- twblalock 8y agoI'd love to never see a Pocket button in my browser ever again.
- unfoldedCravat 8y agoUnless I'm missing something, the user can set this to all zeroes. https://developer.apple.com/documentation/adsupport/asidentifiermanager/1614151-advertisingidentifier https://developer.apple.com/documentation/adsupport/asidenti... A sane default would be nice but there's a lot of other information that can be used to fingerprint a user from their device, device names and carrier names along with a bunch of other device settings are accessible without asking for permission. Unfortunately there's no current way to limit these.
- arielm 8y agoWhat is Mozilla’s incentive to push for this? I get that tracking is a big deal these days, but other than to get some press how is Mozilla related to all of this?
- fooker 8y agoPR
- cmelbye 8y agoMaking the world better?
- artursapek 8y agoMozilla is posturing as "even more privacy focused than Apple". It's annoying.
- exabrial 8y agoThey don't hammer Google hard enough imho in their marketing campaigns in my opinion.
- baroffoos 8y agoWhen has google ever pretended to care about privacy?
- whoopdedo 8y agoWouldn't that give us even more reason to ask for privacy features from them? If they don't show an initiative to consider it themselves then users should take the lead. Mozilla wants me to sign a petition asking Apple to rotate their advertising ID. Well where's the petition I can sign asking Google to do the same? If Mozilla speaks out against Apple while staying silent against Google it gives the appearance that they are at best not willing to bite the hand that feeds them. But at worst may raise concern that they are barking at the behest of their master.
- NicoJuicy 8y agoPerhaps because they are less privacy focused then you think. That would be one possibility
- reilly3000 8y agoThis would break a lot of standing marketing/long-term lead nurturing efforts. It sort of forces marketers to engage with users they have in their actual database or do everything in 30 days. Some sales cycles are a lot longer than 30 days. In publishing its pretty relevant to know if long term visitors stop coming back in the aggregate. There are lots of legitimate business purposes for anonymous longer term tracking. Counterpoint: if a data collector stores the ad id or derivative of it with anonymous activity then later links it to a user account with PII that could break a lot of basic assumptions the user may have about their privacy. That would be difficult to prevent from happening with a technical solution.
- hartator 8y agoI rather them focusing on hardening their own privacy instead of cherry picking issues at competitors.
- Someone1234 8y agoThey have been focusing on privacy for the last several years and rolled out multiple improvements specifically in that area on the last year alone (e.g. Anti-Tracking Protection, DNS over HTTPS, HTTP Referrer limits, Container Tabs, etc). Plus products like Firefox Focus (essentially an in-private browser). If we're gatekeeping who is allowed to criticize Apple, perhaps it would be enlightening to give some examples of people or entities who attain a high enough level of moral purity to do so. If an organization like Mozilla fails to reach it, I just want to get a sense of where the bar is set.
- flukus 8y ago> If an organization like Mozilla fails to reach it, I just want to get a sense of where the bar is set. Telemetry that's not on by default would certainly be one measure, I don't know about apple but mozilla certainly fails. If they don't understand the need to gain consent before collecting statistics on their users then they don't understand privacy.
- Someone1234 8y agoApple themselves does the same. Therefore the position is that doing something Apple does makes you unqualified to criticize Apple. That would by extension make Apple themselves unqualified to criticize Apple, which is a rather unusual bar. What I find curious about many comments in this thread is that few want to address the issue itself, but instead would rather either shoot the messenger or argue that even raising the issue is unacceptable. Why are people so opposed to discussing this and why is Mozilla's record or reputation even relevant here?
- flukus 8y ago"Let he who is without sin cast the first stone" and "people in glass houses shouldn't throw stones" we've got a pretty long history of having a higher expectation of the person/organisation doing the criticism and this is no exception. As for the actual criticism I'd agree with the blog, the fact that phones come with an advertiser ID at all is a sad sign of the state of our industry.
- WD-42 8y agoITT: Lots of people bashing Mozilla, probably as an excuse to feel better about still using Chrome.
- netwanderer3 8y agoI really wanted to believe Apple but they need to try harder. This is not on iPhone but on a MBP so it's still quite relevant to Apple. I had disabled the "apsd" process, which serves as Apple's push notifications service, completely blocked it off using Little Snitch, and yet the process still found its own way to reactivate itself and keeping a persistent connection back to Apple servers in the background. I personally don't use FaceTime or Notifications on MBP, why couldn't Apple just let me disable this, and instead the process even circumvented around my firewall protection to make sure it could communicate back to their data center? This practice is a little shady and does not promote trust or transparency. If I have blocked a process permanently then I expect it to remain always blocked. Their EmbeddedOS on the Touch Bar also keeps a couple always-on connections that utilize its own bridged network interface which users are completely blocked off and do not have access to. They were supposedly for TouchID, but I was viewing bandwidth usage the other day and these connections used up to almost 10MB of data. Why would something like TouchID need to send 10MB of data back to Apple? Again, this makes no sense and does not promote trust.
- kmlx 8y agoare you referring to: https://developer.apple.com/library/archive/documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/APNSOverview.html#//apple_ref/doc/uid/TP40008194-CH8-SW1 https://developer.apple.com/library/archive/documentation/Ne... Apple Push Notification service (APNs) is the centerpiece of the remote notifications feature. It is a robust, secure, and highly efficient service for app developers to propagate information to iOS (and, indirectly, watchOS), tvOS, and macOS devices. You may not be using FaceTime or Notifications, but someone you know will be using them.
- ChrisRR 8y agoMaybe that's not what they want though. Maybe they just want to use their computer without a constant connection to all of their other devices and servers
- notimetorelax 8y ago
- dillondoyle 8y agoHow would this make it at all harder to build a profile or change anything? Correct me if im wrong: Google, or whatever ad tech, gets data from an app which sends an email or oauth data to the IDFA. The email or oauth data stays the same even if the ad uuid changes month to month. Over many many apps. I personally would actually rather have Apple control this and start competing with FB as a mobile ad network. I think they could present a solution which fits with their privacy appeal while also cleaning up fraud and dictating better ads formats / rules I would like to think that space isn't totally won yet.
- madeofpalk 8y agoApple tried to play in this space before. They didn't win https://developer.apple.com/support/iad/ https://developer.apple.com/support/iad/
- andrekandre 8y agoresetting the idfa doesnt realy help anyways because apps usually a.) generate a uuid that is stored in the keychain upon first launch b.) send the users iphone name to thier tracking servers c.) other uniquing information such as screen size, device make, os version etc so you can bet that idfa doesnt matter one iota and is totally besides the point...