5 ms·

Why do applications have access to Bluetooth or WiFi ID's in the first place? Seems too low-level for an app to have access to. Aren't these details better left

Why do applications have access to Bluetooth or WiFi ID's in the first place? Seems too low-level for an app to have access to. Aren't these details better left handled by the operating system?

pflenker 7y ago
IIRC, some applications use Bluetooth to access beacons, and these beacons in turn can be used for precise location (for example, indoors).
lstamour 7y ago
It’s helpful so Spotify can start playing music when I connect my headphones, or so apps like Bose Connect can update my headphones. Most features with privacy implications are also features that can add a ton of value if used correctly. The problem is partially the lack of system messaging and partially lack of morals...
- ascagnel_ 7y ago
  Spotify shouldn’t need BT access to play audio —- there’s a “blessed” API for apps that need BT audio output that won’t require separate authorization. Your headphone update app more reasonably will need that permission, as its doing more than audio output.
  - lstamour 7y ago
    You misunderstand, it’s not for playing back audio as such, it’s for detecting when the headphones connect as well as (maybe?) enabling easy set up of speakers with Spotify Connect. Similarly Dropcam had a setup mode via Bluetooth, Google Home as well.
    - fluffything 7y ago
      Spotify doesn't care whether your headphones are BT or not. iOS should be doing audio device discovery and notifying the apps that request it when a new device is found. Whether you plug some headphones or use bluetooth or airplay or ... shouldn't matter here.
      - lstamour 7y ago
        Apple does do device discovery, but it then lets the app show the device names, in fact it’s a requirement to play audio over Bluetooth and a key usability feature of wireless headphones. If your music app doesn’t tell you which device is connected, you’d potentially be surprised every time you hit the Play button. So I’m 99% sure that Apple outright rejects apps that don’t say if you’re connected to Bluetooth, just as they reject apps that don’t say if you’re online. Bluetooth is also disabled for security purposes (if checked in settings) when the phone is locked, including previously paired devices, so it looks to me like they draw the line between security and privacy pretty well, short of forcing all apps to use the same UI conventions.
        ascagnel_ 7y ago
        That’s 100% on Spotify and how they’re implementing playback. I have Sonos speakers and Bluetooth headphones paired with my iPhone, and Overcast is able to display the selected output without any Bluetooth permission requests. Spotify Connect is likely why they need a permission request... but the question for me is why they need it on app startup and not a one-time request when starting the Connect pairing process. Good security procedures would have the app requesting as few permissions as possible, for the shortest amount of time.
        lstamour 7y ago
        Again, all I can point to are the instances where I was playing music via Spotify on my Alexa devices and thanks to Spotify connect when I connect my headphones, Spotify starts playing automatically on my headphones. The downside is that occasionally Overcast stops playing because Spotify wants so much to take over and start playing. But it’s hard to say if that’s an iOS beta thing. Similarly, the app still ships for iOS 12 right now, it’s possible the iOS 13 version of the app will have a clearer explanation for the use of Bluetooth.
srbby 7y ago
If by ID you mean BSSID, they don't have access to that.
rcruzeiro 7y ago
iOS dev here. Applications do not have access to this kind of info. The CoreBluetooth API generates UUIDs for the Bluetooth devices in an attempt to anonymise them. Many manufacturers workaround this by including the MAC Address on the manufacturer data structure when it's imperative that an application knows exactly which bluetooth device it's talking to.
mrtksn 7y ago
That's what I asked when iOS 13 asked me if I would like to give permisson to the official CNN app use Bluetooth. Yep, apparently CNN was doing something with my Bluetooth but I had no idea until iOS 13. But other than that Bluetooth access had legit use cases, like the app I use to control my Bluetooth bulb. There are plenty of devices and accessories that use Bluetooth to communicate with the iPhone, therefore Apple provides means to access Bluetooth.
oflannabhra 7y ago
Currently, the only way to access WiFi SSID is indeed from a low level API: CNCopySupportedInterfaces(), a C API for System Configuration. This is useful if an app needs to know whether the phone is currently using a local network or a cellular modem to connect to the Internet, or to connect to local devices. Unfortunately Apple does not provide a basic API that provides this information without the SSID. (Although in early iOS 13 betas, there was a WiFi framework that might have provided such information. It was removed from later betas, however). For Bluetooth, apps do not have access to BSSID nor peripheral MAC addresses from advertisements and connections. CoreBluetooth provisions a separate identifier (that is rotated) to prevent apps from gleaning much tracking info outside of the user's consent.

Why do applications have access to Bluetooth or WiFi ID's in the first place? Seems too low-level for an app to have access to. Aren't these details better left handled by the operating system?

pflenker 7y ago

IIRC, some applications use Bluetooth to access beacons, and these beacons in turn can be used for precise location (for example, indoors).

lstamour 7y ago

It’s helpful so Spotify can start playing music when I connect my headphones, or so apps like Bose Connect can update my headphones. Most features with privacy implications are also features that can add a ton of value if used correctly. The problem is partially the lack of system messaging and partially lack of morals...

ascagnel_ 7y ago
Spotify shouldn’t need BT access to play audio —- there’s a “blessed” API for apps that need BT audio output that won’t require separate authorization. Your headphone update app more reasonably will need that permission, as its doing more than audio output.
- lstamour 7y ago
  You misunderstand, it’s not for playing back audio as such, it’s for detecting when the headphones connect as well as (maybe?) enabling easy set up of speakers with Spotify Connect. Similarly Dropcam had a setup mode via Bluetooth, Google Home as well.
  - fluffything 7y ago
    Spotify doesn't care whether your headphones are BT or not. iOS should be doing audio device discovery and notifying the apps that request it when a new device is found. Whether you plug some headphones or use bluetooth or airplay or ... shouldn't matter here.
    - lstamour 7y ago
      Apple does do device discovery, but it then lets the app show the device names, in fact it’s a requirement to play audio over Bluetooth and a key usability feature of wireless headphones. If your music app doesn’t tell you which device is connected, you’d potentially be surprised every time you hit the Play button. So I’m 99% sure that Apple outright rejects apps that don’t say if you’re connected to Bluetooth, just as they reject apps that don’t say if you’re online. Bluetooth is also disabled for security purposes (if checked in settings) when the phone is locked, including previously paired devices, so it looks to me like they draw the line between security and privacy pretty well, short of forcing all apps to use the same UI conventions.
      - ascagnel_ 7y ago
        That’s 100% on Spotify and how they’re implementing playback. I have Sonos speakers and Bluetooth headphones paired with my iPhone, and Overcast is able to display the selected output without any Bluetooth permission requests. Spotify Connect is likely why they need a permission request... but the question for me is why they need it on app startup and not a one-time request when starting the Connect pairing process. Good security procedures would have the app requesting as few permissions as possible, for the shortest amount of time.
        lstamour 7y ago
        Again, all I can point to are the instances where I was playing music via Spotify on my Alexa devices and thanks to Spotify connect when I connect my headphones, Spotify starts playing automatically on my headphones. The downside is that occasionally Overcast stops playing because Spotify wants so much to take over and start playing. But it’s hard to say if that’s an iOS beta thing. Similarly, the app still ships for iOS 12 right now, it’s possible the iOS 13 version of the app will have a clearer explanation for the use of Bluetooth.

srbby 7y ago

If by ID you mean BSSID, they don't have access to that.

rcruzeiro 7y ago

iOS dev here. Applications do not have access to this kind of info. The CoreBluetooth API generates UUIDs for the Bluetooth devices in an attempt to anonymise them. Many manufacturers workaround this by including the MAC Address on the manufacturer data structure when it's imperative that an application knows exactly which bluetooth device it's talking to.

mrtksn 7y ago

That's what I asked when iOS 13 asked me if I would like to give permisson to the official CNN app use Bluetooth. Yep, apparently CNN was doing something with my Bluetooth but I had no idea until iOS 13. But other than that Bluetooth access had legit use cases, like the app I use to control my Bluetooth bulb. There are plenty of devices and accessories that use Bluetooth to communicate with the iPhone, therefore Apple provides means to access Bluetooth.

oflannabhra 7y ago

Currently, the only way to access WiFi SSID is indeed from a low level API: CNCopySupportedInterfaces(), a C API for System Configuration. This is useful if an app needs to know whether the phone is currently using a local network or a cellular modem to connect to the Internet, or to connect to local devices. Unfortunately Apple does not provide a basic API that provides this information without the SSID. (Although in early iOS 13 betas, there was a WiFi framework that might have provided such information. It was removed from later betas, however). For Bluetooth, apps do not have access to BSSID nor peripheral MAC addresses from advertisements and connections. CoreBluetooth provisions a separate identifier (that is rotated) to prevent apps from gleaning much tracking info outside of the user's consent.