6 ms·

Mozilla suggests resetting the IDFA once per month...but that seems pretty trivial to workaround? If an app you used previously starts up and sees that your IDF

by varenc 7y ago

Mozilla suggests resetting the IDFA once per month...but that seems pretty trivial to workaround? If an app you used previously starts up and sees that your IDFA changed, it's easy for that app to know that the old IDFA and the new IDFA refer to the same user! This tracking is all possible because iOS gives every app on the device the same IDFA (advertising identifier [1]). They can then correlate all your activity and target you for ads. I'd love if Apple just killed this feature, but barring that, why not change iOS so that it scopes these identifiers at the per-app level. Different apps on the same device see different IDFAs, but an app can still use an IDFA to target you for ads. Apple already has similar per-vendor scoping with identifierForVendor. [2] [1]: https://developer.apple.com/documentation/adsupport/asidentifiermanager/1614151-advertisingidentifier?language=objc https://developer.apple.com/documentation/adsupport/asidenti... [2]: https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor https://developer.apple.com/documentation/uikit/uidevice/162...

mojuba 7y ago
Unfortunately the majority of more or less useful or popular apps are also linked against various analytics/attribution platforms, often many of them at once. Mixpanel, Amplitude, AppsFlyer, Branch to name a few, plus Facebook and/or Google. In fact having any of the Google's or Facebook's SDKs means tracking, e.g. Maps, Login etc. Somehow these platforms have no problem with identifying users across their client apps even without the IDFA. Maybe it's not 100% precise, but as far as I can tell these companies keep so much information about us away from our eyes, that even the big guys (G, FB) would be jealous. Analytics is one big dark corner of the mobile business whose significance is not fully appreciated (yet).
- api 7y ago
  Mobile is all about surveillance as near as I can see. The whole purpose of it is to track users.
  - kevin_thibedeau 7y ago
    How else should a telescreen function?
  - BurningFrog 7y ago
    There were mobile phones decades before any of this existed.
    - krageon 7y ago
      And to the extent that this was practical, they have always been used for surveillance.
      - api 7y ago
        Yeah I guess people carrying around transmitters is too easy to exploit for surveillance and it's just irresistible.
      - BurningFrog 7y ago
        Maybe I'm splitting hairs, but that's definitely not their primary purpose, which is what I think OP was saying. Sure, once they exist, there are secondary effects who are important in themselves.
  - mrgreenfur 7y ago
    I think the push to apps was to get persistent tracking while offering the user the olive branch of new apis/better battery life/etc. The browser is a prophylactic against apps and their uncontrolled behaviors.
- peteretep 7y ago
  > Maybe it's not 100% precise, but as far as I can tell these companies keep so much information about us away from our eyes, that even the big guys (G, FB) would be jealous. Ooooh, think of the GDPR fines!
- snarf21 7y ago
  Right, how often does our external IP change on our home WiFi network or work WiFi network? There are so many other things that can be used to fingerprint. This is part of the reason encrypted DNS and other efforts have some merit. The cell providers have data and know exactly where you are via triangulation. Has anyone been using Cloudflare's Warp VPN? I wonder if this is the best approach. Paying a private company to act as a one hop TOR to minimize fingerprinting. If the cell networks just see all CF traffic, they may know where I am but not who I'm connecting too. I get that this means I must trust CF but I trust them more than ATT/Verizon anyway. I just want some open source from CF on the mobile side that shows that the private keys are kept in the device's SecureEnclave and not anywhere on disk.
mobjack 7y ago
You don't need an IDFA to track someone in the same app. You can generate your own UUID to use. The value of the IDFA comes from coordinating user behavior across apps. Targeting ads is one use case, but it is also used in conversion tracking, which is very valuable to advertisers. They can know if ads in one app resulted in people buying things in another app. Edit: fixed typo
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
- thenewnewguy 7y ago
  The point is that the app can just record the old IDFA, and when the IDFA changes whoever is doing the comparison between two apps knows that the old and new IDFA are one and the same.
  - tgsovlerkhgsel 7y ago
    A likely-good-enough fix would be for Apple to first make extremely clear that this is not allowed, then catch one ad framework/library provider violating the rule and ban every single app/publisher using it to ensure the rule is actually taken seriously.
    - scarface74 7y ago
      How do you “catch” them? The ID is sent from the app and not in plaintext.
      - afiori 7y ago
        I imagine with the usual review process
        7y ago
shermozle 7y ago
There is in fact just such an identifier, it's called IDFV. ID For Vendor. It's shared between all apps from the same vendor, so your Facebook and Instagram apps know they're on the same device. Apple used to be quite strict that you had to actually have advertising in the app to ask for the IDFA permission. That seems to have disappeared.
- dep_b 7y ago
  There used to be a global ID that was free to use, then they switched to the vendor ID. The IDFA never had anything to do with the vendor ID and has way more checks. To me the vendor ID isn't that big of a problem.
- varenc 7y ago
  That's the one I linked to right? =) https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor https://developer.apple.com/documentation/uikit/uidevice/162...

by varenc 7y ago

mojuba 7y ago

Unfortunately the majority of more or less useful or popular apps are also linked against various analytics/attribution platforms, often many of them at once. Mixpanel, Amplitude, AppsFlyer, Branch to name a few, plus Facebook and/or Google. In fact having any of the Google's or Facebook's SDKs means tracking, e.g. Maps, Login etc. Somehow these platforms have no problem with identifying users across their client apps even without the IDFA. Maybe it's not 100% precise, but as far as I can tell these companies keep so much information about us away from our eyes, that even the big guys (G, FB) would be jealous. Analytics is one big dark corner of the mobile business whose significance is not fully appreciated (yet).

api 7y ago
Mobile is all about surveillance as near as I can see. The whole purpose of it is to track users.
- kevin_thibedeau 7y ago
  How else should a telescreen function?
- BurningFrog 7y ago
  There were mobile phones decades before any of this existed.
  - krageon 7y ago
    And to the extent that this was practical, they have always been used for surveillance.
    - api 7y ago
      Yeah I guess people carrying around transmitters is too easy to exploit for surveillance and it's just irresistible.
    - BurningFrog 7y ago
      Maybe I'm splitting hairs, but that's definitely not their primary purpose, which is what I think OP was saying. Sure, once they exist, there are secondary effects who are important in themselves.
- mrgreenfur 7y ago
  I think the push to apps was to get persistent tracking while offering the user the olive branch of new apis/better battery life/etc. The browser is a prophylactic against apps and their uncontrolled behaviors.
peteretep 7y ago
> Maybe it's not 100% precise, but as far as I can tell these companies keep so much information about us away from our eyes, that even the big guys (G, FB) would be jealous. Ooooh, think of the GDPR fines!
snarf21 7y ago
Right, how often does our external IP change on our home WiFi network or work WiFi network? There are so many other things that can be used to fingerprint. This is part of the reason encrypted DNS and other efforts have some merit. The cell providers have data and know exactly where you are via triangulation. Has anyone been using Cloudflare's Warp VPN? I wonder if this is the best approach. Paying a private company to act as a one hop TOR to minimize fingerprinting. If the cell networks just see all CF traffic, they may know where I am but not who I'm connecting too. I get that this means I must trust CF but I trust them more than ATT/Verizon anyway. I just want some open source from CF on the mobile side that shows that the private keys are kept in the device's SecureEnclave and not anywhere on disk.

mobjack 7y ago

You don't need an IDFA to track someone in the same app. You can generate your own UUID to use. The value of the IDFA comes from coordinating user behavior across apps. Targeting ads is one use case, but it is also used in conversion tracking, which is very valuable to advertisers. They can know if ads in one app resulted in people buying things in another app. Edit: fixed typo

deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
thenewnewguy 7y ago
The point is that the app can just record the old IDFA, and when the IDFA changes whoever is doing the comparison between two apps knows that the old and new IDFA are one and the same.
- tgsovlerkhgsel 7y ago
  A likely-good-enough fix would be for Apple to first make extremely clear that this is not allowed, then catch one ad framework/library provider violating the rule and ban every single app/publisher using it to ensure the rule is actually taken seriously.
  - scarface74 7y ago
    How do you “catch” them? The ID is sent from the app and not in plaintext.
    - afiori 7y ago
      I imagine with the usual review process
      - 7y ago

shermozle 7y ago

There is in fact just such an identifier, it's called IDFV. ID For Vendor. It's shared between all apps from the same vendor, so your Facebook and Instagram apps know they're on the same device. Apple used to be quite strict that you had to actually have advertising in the app to ask for the IDFA permission. That seems to have disappeared.

dep_b 7y ago
There used to be a global ID that was free to use, then they switched to the vendor ID. The IDFA never had anything to do with the vendor ID and has way more checks. To me the vendor ID isn't that big of a problem.
varenc 7y ago
That's the one I linked to right? =) https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor https://developer.apple.com/documentation/uikit/uidevice/162...