16 ms·
Apple's privacy labels show WhatsApp and Facebook Messenger hunger for user data
- GlobalInsurance 6y agoWe have to do something as a collective unit.
- ericmay 6y agoIf only Apple didn't have a monopoly on the App Store on the iPhone. Then we wouldn't have to know this information because we could get it from a different App Store where Facebook doesn't have to share this info!
- IntelMiner 6y agoThat's a pretty intentionally obtuse take on a completely unrelated problem
- evgen 6y agoIt is actually too obtuse, to be honest. It would be better to be explicit: if it were not for the Apple 800 lb gorilla holding the Facebook 800 lb gorilla's feet to the fire here due to its self-appointed role as gatekeeper of the iOS App Store then this information would remain hidden from general consumers.
- Daho0n 6y agoAnd while they force this to be disclosed about Facebook Apple hide its own data harvesting since they can collect via sources Facebook cannot. This is pure PR and abuse of market share to better Apple's own ad service.
- AlexandrB 6y agoI've seen multiple people allude to Apple secretly collecting data before. I would really like a source because it's very plausible but I haven't seen any independent research showing that this is actually happening or what's being collected. Google searches turn up stuff like this: https://www.zdnet.com/article/apple-data-collection-stored-request/ https://www.zdnet.com/article/apple-data-collection-stored-r...
- evgen 6y agoYou have repeatedly made this claim and have yet to provide even the thinnest shred of evidence. Please supply some or stop making these unfounded assertions.
- k4rli 6y agoIf only Apple had a monopoly on all phones and computers so everyone would know it, right?
- vincnetas 6y agoApp distribution can be totally different from API access to my device. No matter where i get the app from, when accessing certain APIs i would get notified about that, or would have to explicitly enable that functionality in OS settings.
- Razengan 6y agoFor Apple to know about API access the app would still have to submitted to them in some manner.
- nicky0 6y agoThe idea was that the phone OS could detect the usage of those APIs and prompt the user wthout Apple having to be directly involved in the process.
- nautical 6y ago"that the phone OS could detect the usage of those APIs" This must be handled correctly as it can this also lead to privacy violation.
- darkwater 6y agoJust like on device image recognition which Apple is already doing.
- nicky0 6y agoThere is no reason it can't all be done on-device. That is indeed how the current "Enable camera access?" etc. system works.
- nautical 6y agoThis is not a question at all that this can be done or not ( There is no reason it can't all be done on-device. ) Question is will this be ethical .. I will not be comfortable using a device that logs every API an app on it is calling.
- absolutelyrad 6y agoI'd argue that if apple didn't have a monopoly, we'd have stores that catered to privacy conscious people far earlier. If apple didn't restrict the OS so much, you'd have people making their own Facebook clients, wouldn't have mattered if Facebook liked it or not. The monopolization of Facebook's control on personal connections is partially because of closed OS's. And Apple's iOS is one of the most responsible OS's that gave rise to Facebook's data monopoly. Had it been like Windows, there wouldn't be a way that Facebook could've maintained their monopoly.
- fsflover 6y agoF-Droid proves your point.
- qwytw 6y agoAre there any "unofficial" Messenger apps on F-Droid?
- papaf 6y agoF-Droid has a search box you could use to answer such questions for yourself: https://search.f-droid.org/?q=facebook&lang=en https://search.f-droid.org/?q=facebook&lang=en
- qwytw 6y agoThat was a rhetorical question. AFAIK the closest thing you can get is wrapper around messenger web app which (which by default doesn't work on mobile browser because FB wants to force everyone to use their native apps).
- davidy123 6y agoWhile it wraps their web app, I use Frost for Facebook, which is an open source app that lets me access Facebook messages on mobile without using any of Facebook's apps.
- dwighttk 6y agoYeah Epic sure showed Google Play, didn’t they?
- teekert 6y agoWe do one thing right! So we don't need competition because you can safely assume all other things are right and the way they should be!
- tmpUserA 6y agoIs there a single time in tech history where a monopoly was not totally abused ? You are asking Apple to take over the world because you buy their privacy propaganda but ICloud is not even end2end encrypted, employee are listening to Siri conversation, Apple knows all apps you run and when instead of just providing a blacklist you compare against locally... There's a scandal every month about Apple privacy. How long before they ban ProtonMail because "You know what, we think our emails are "better for you". How long before they ban Signal because "You know what, IMessage has a better security than signal so it's "better for you". Monopoly / tech dictatorship are the easy and tempting solution but nothing good ever came out of giving some dude total power over you. And even if you like those dude because you buy their propaganda, many other people might not share your view.
- Shivetya 6y agoLike many other unpleasant facts it is one thing to know something is happening and another to have it proven to your face in an indisputable format. However I have to ask, will this become another surgeon generals warning or calorie labeling of restaurant menu experience? By that I simply mean, people will not only click through it but also accept it as they don't see any real cost. Eventually as with everything presented under dire warnings you drown your audience to the point they tune it all out and go right back their blissfully attitude of just accepting it under the guise of its not going to matter
- protoman3000 6y agoIf it’s impossible/forbidden/very costly for the vendor to put poison in the food, then they won’t do it. Nobody will come and say „I would like to have this extra fatty extreme glucose meal, please“. This is why we need opt-in instead of opt-out as default.
- parthdesai 6y agoYMMV, but I actually do look at the calories before ordering at a restaurant. There are times when I have ordered something else because of the number of calories was too high in what I wanted.
- perryizgr8 6y agoKind of stupid to compare against Imessage. It says Imessage can link to your device id. And once apple knows the device id, they basically know everything about you since they own the device (remember: you don't own your Iphone). It is admirable that signal is not using any identifiable data, though.
- tanzann 6y agoPhone number can tell more than enough (as phone is used as a user id in Signal).
- 8fingerlouie 6y ago> It is admirable that signal is not using any identifiable data They don't need to. You identify yourself within the app with your login. > It says Imessage can link to your device id While iMessage is vulnerable to (certain) MiTM attacks, and storing your message archive in iCloud is (was ?) unencrypted, iMessage is surprisingly resilient to attacks (on the protocol itself). Every iOS/Mac device generates it's own key and uploads the public certificate to Apple's keyserver, this is why they need your device id. When you send messages with iMessage, your device then contacts Apple's keyservers, gets ALL public certificates for the recipient, and encrypts the message once for every key, and sends an encrypted message per device. Attachments are handled a bit different. Insted of encrypting the attachment n times, a new key is generated, which is then used to encrypt the attachement, the encrypted attachment is uploaded to Apple, and the key is sent using normal iMessage messages (encrypted) Your private keys NEVER leave your device, so iMessage is end to end encrypted as long as you don't enable iMessage in iCloud. I said that iMessage was vulnerable to MiTM attacks, which it is. There's nothing stopping Apple from adding a "shadow" device to your list of devices with it's own set of keys, which would then receive a copy of every message sent to you, and that's probably how iMessage in iCloud works, but they have no way of retrieving your message history from before the shadow device was added. There's a somewhat recent (2016) paper on it here : http://www.cs.tufts.edu/comp/116/archive/fall2016/xshi.pdf http://www.cs.tufts.edu/comp/116/archive/fall2016/xshi.pdf
- galad87 6y ago
- dingaling 6y agoWell it's not entirely a fair comparison since iMessage doesn't support in-app services and purchasing like Facebook Marketplace, as WhatsApp does. For which naturally it has to gather additonal data. Also until iMessage is available on other platforms, what it slurps or doesn't slurp is academic for most users of WhatsApp.
- dwighttk 6y agoFacebook is persona non grata when it comes to trusting them to use information that they’d obviously need for a service only in the way they’d obviously need to use it while not adding it their advertising database.
- croes 6y agoMaybe FB should have let WhatsApp be a messenger then and made the Marketplace its own app. But this way, the tracking functions can be pushed to everyone under the guise of the Marketplace functions, even if they only use the Messenger.
- deleted 6y ago[deleted]
- oauea 6y agoWhy would I want in-app services and purchasing like Facebook Marketlplace in my chat messaging app? It should facilitate chat and messaging, and no more. This is how it used to be, until Facebook acquired and ruined WhatsApp.
- darkwater 6y agoBecause other chat systems in other countries (like WeChat) did, it was a great success and FB copied it.
- oauea 6y agoI don't know about that, I have literally never used it or heard of it. It was today I learned that WhatsApp has a bunch of these useless features. Besides, China should not be your model if you care about privacy.
- surround 6y agoThe article references a 9to5Mac article, which in turn references this article by Forbes, which I think should be the submission url instead. https://www.forbes.com/sites/zakdoffman/2021/01/03/whatsapp-beaten-by-apples-new-imessage-update-for-iphone-users/ https://www.forbes.com/sites/zakdoffman/2021/01/03/whatsapp-...
- xoa 6y agoAlready an active submission on it (https://news.ycombinator.com/item?id=25683727 https://news.ycombinator.com/item?id=25683727), maybe the threads could just get merged?
- matsemann 6y agoThe Forbes article goes on and on and never really gets to the point. And it had to load for ~3 minutes for the cookie banner to set my preferences.
- timwis 6y agoI read through WhatsApp’s new terms and I don’t understand what the big deal is. Isn’t it mostly about messages with businesses?
- ub 6y agohttps://twitter.com/NiamhSweeneyNYC/status/1347185463057117190 https://twitter.com/NiamhSweeneyNYC/status/13471854630571171...
- intellirogue 6y agoThe changes differ based on your location. In the EU (and UK), it's some fairly minor changes to do with business messaging. Outside of the EU, it is much more significant, merging your WhatsApp data with your Facebook data (including the phantom profiles FB create for users who don't have accounts). They can't do this in the EU (yet) due to privacy laws.
- eznzt 6y agoWell of course they hunger for user data. THey are free services. Would you rather have to pay for whatsapp? Or have banner ads? Because I rather not And the comparison to imessage is a bloody joke. You already paid a shitton of money for your iphone, they don't need your data for anything
- S4mb 6y agoI remember when you had to pay a buck a year or so for Whatsapp. I really liked the feeling of this straight forward business model and paid.
- acmecorps 6y agoHow sustainable is that $1/yr tho I wonder
- YetAnotherNick 6y agoGood luck justifying the 19 billion dollar they sold their business for using $1/user/year.
- cwhiz 6y agoWould I rather have to pay? Fucking yes! This should be the default. The default should be pay, with a free option that requires you to dump truck all your data. Tech giants have completely ruined the internet economy. You can’t even pay for these things now. It’s just hand over all your data and secrets, or fuck off. And the worst is that new businesses can’t compete unless they do the same. You can’t compete with free.
- 4ggr0 6y agoimo, that's a very, very dangerous proposal. I agreed with you for a couple of seconds, but this sounds like yet another way to fuck poor people. It should just be default to not collect unnecessary data, whatever that may be, while being free. Maybe make paid plans with premium features. Everything else will just mean that Big Tech can spy and manipulate poor people, because they can't afford to pay for every service they (have) to use. We should stop tying privilege to money. Maybe I'm being too dramatical, but that's what came to my mind after reading your suggestion.
- mrweasel 6y agoIt's really hard to tell with Facebook if they understand that their massive data collection is at least morally questionable, and they business plan is simply a calculated risk. Given that most people seem to care more about free services, than they do about privacy, Facebook may see privacy labelling is a pointless exercise that won't change anything anyway. Or perhaps we are back at Upton Sinclair: "It is difficult to get a man to understand something, when his salary depends on his not understanding it." and Facebook as an organisation is simply unable to acknowledge the problem, because doing so would ruin them.
- DSingularity 6y agoIf Facebook charged 2$ a month for their services, would they not make more than their operational costs? They choose to exploit and straddle areas that are morally and legally dubious because they want more money.
- skocznymroczny 6y agoThey'd lose many users. $2 a month might not be a lot, but any non-zero amount of money is a barrier for users. On one side some users might not have an easy way to pay, others will still have to reconsider whether Facebook itself offers enough to be worth the $2 a month (even if it totally does). Also, a more likely outcome would be Facebook charging $2 a month on top of their usual data collection practices.
- mrweasel 6y agoThat's really the scary part, most people wouldn't pay $2 per month for Facebook. Most wouldn't pay the $1 for WhatsApp. That shows you how little value these services actually provide to most people. The remaining users wouldn't pay for year two, because to many others would have left the platform.
- CallMeMarc 6y agoDidn't WhatsApp actually cost like 1 EUR/year before FB bought it?
- izacus 6y agoiMessage seems to be a bit dishonest, because Apple, the owner, has way more information about you through iCloud and Apple ID - contacts, location, payment data, phone number, etc. Forcing Facebook to clearly list all of this for the facebook account is great, but then failing to disclose this for their own account seems like double standard. Just like having their own separate Ad Tracking switch which is on by default. (And even hidden under "System Services" on macOS!)
- pram 6y agoIt has its own section in the Privacy tab, which is exactly where I'd expect to find it. Hidden in plain sight maybe
- izacus 6y agoIt seems to be hidden enough that it's not added to this comparison.
- katbyte 6y agoThat may be true but I disabled that a long time ago and it’s _stayed_ turned off across multiple ios upgrades. Unlike others os/phones where such things are turned on at every opportunity
- izacus 6y agoHmm, I'm being badgered to reenable iCloud on every single minor iOS update and rather commonly on macOS as well. Are you sure you were never asked about it?
- manyxcxi 6y agoI have iCloud turned on but it’s set to only sync Notes or something trivial like that that I don’t even use- I can’t recall ever having been badgered for more. Maybe I got to that state because I was being badgered? It’s been long enough though I can’t recall. Might be worth a shot if the risk is acceptable enough to you vs the badger.
- Daho0n 6y agoAnd at the same time Apple pretends not to do this themselves since they can harvest the data in other ways so iMessage doesn't have to show as many warnings. Very disingenuous and pure PR (that clearly is working as intended even on HN). With cloud, iMessage and a unique advertising id Apple knows way more about its users than Facebook does. Great that Facebook gets exposed, but naïve that people believe Apple collect less.
- themark 6y agoWhat search history is linked to iMessage? Is it the searches you do on your phone?
- KaiserPro 6y agoI am not a fan of FB. Lord knows they are arseholes. I _do_ like these labels, I think they are good. but It is dishonest to say the least that imessenger only has access to just those details. To use imessenger, you need an icloud account. Tie that to the location services and any payment information, Apple knows everything about you, even more than FB. The issue is about trust. rightly people don't trust FB with their data. However I don't think we should be letting apple off so lightly, especially when they are pointing the blame at other people.
- nathanyz 6y agoI think the difference is that you are paying Apple to not abuse your privacy. With Facebook, you know you are trading some amount of privacy, but these new labels make it clear just what that true cost is.
- gen220 6y agoI agree with this take, and it's the same take I share with friends and colleagues. It's certainly better than FB. However, are we sure that Apple, in 30 years, will be the same proponent of privacy that they are today? Even if there's a 10% risk that they won't, they'll have your same data then that they have now. Strong encryption with user-owned keys is the only way you can mitigate against this scenario. I'm optimistic that we'll get there eventually, but we aren't there yet.
- freewilly1040 6y agoThe data they collect today will be worthless for advertising purposes in 30 days, much less 30 years.
- gen220 6y agoYeah, but the data can be used for many purposes other than advertising.
- meowster 6y ago
- altitudinous 6y agoI see this diagram posted everywhere on the internet, and whilst of course Facebook collects a lot of data, in this situation I believe they just selected every option available to them for display on their app listing. If they declare every single option that Apple presents then Apple cannot complain, and it is not going to deter end users one iota from downloading the Facebook app and the other Facebook owned properties.
- hugi 6y agoI'd love to be able to see a table/grid listing my installed applications along with the permissions they've been granted.
- Aachen 6y agoTry Exodus, available from f-droid and scans for trackers as well as displaying permissions. https://exodus-privacy.eu.org/ https://exodus-privacy.eu.org/ https://f-droid.org/packages/org.eu.exodus_privacy.exodusprivacy https://f-droid.org/packages/org.eu.exodus_privacy.exoduspri...
- refracture 6y agoThis is cute and all but so long as Android (and to a lesser extent Windows/Linux PCs) cannot run iMessage... what does any of this matter? Yeah iMessage is great between me and anyone I talk to with an iPhone, but it's still largely an Android world and in the best case scenario I can convince an Android user to install Signal, but usually not.
- stevehawk 6y agoWell, that's the point from Apple's standpoint, right? It's marketing for them to convince you to convince your friends to buy iPhones. And in the mean time they'll keep blocking out apps like Signal from integrating in iOS the way they can in Android.
- refracture 6y agoTo be clear I wasn't trying to defend Apple here, it's more in the spirit of meaning they should just shut up about how great they think iMessage is so long as it's only available on Apple devices.
- jwr 6y agoIronic — the article shows up obscured by a full-page overlay and a banner with my favorite phrase "We value your privacy" (I read this as "your data has value to us"), that goes on to say: "We and our store and/or access information [...] and process personal data, such as unique identifiers and standard information sent by a device for personalised ads and content, ad and content measurement, and audience insights [...] With your permission we and our partners may use precise geolocation data and identification through device scanning. You may click to consent to our and our partners’ processing as described above. Alternatively you may access more detailed information and change your preferences before consenting or to refuse consenting. Please note that some processing of your personal data may not require your consent, but you have a right to object to such processing." I can then click "MORE OPTIONS" to enter the deceptive dialog, where you think everything is off, but really everything is hidden under "LEGITIMATE INTEREST" (another one of my favorite sneaky phrases). I don't know how you can really turn the tracking off.
- 0goel0 6y agoBeat the dead horse - news sites need money and show ads.
- mrybczyn 6y agoShowing ads is one thing, but more savage beasts lurk in the javascript jungle...
- fouric 6y ago...and to continue to beat the dead horse, news sites can either (1) straight-up paywall their content or (2) show ads without invading your privacy. Tracking in every form but the anonymous, opt-in, and truly optional (no restrictions (other than the obvious) if you decline) in not acceptable.
- jwr 6y agoAds are fine. Have you tried clicking through those deceptive dialogs and have you seen the list of "trusted partners" that will receive and gather tracking data about you? Do you at least know roughly what the number of those "trusted partners" is? Take a look, it could be an eye-opener.
- tobyhinloopen 6y agoFunny how this article bombarded me with cookie popups
- m3kw9 6y agoProblem is that most people already have WhatsApp installed and won’t be looking at that label anytime soon. Even if they had to reinstall it, they would likely never look past the download button
- nottorp 6y agoIn other news, google apps still don't have a privacy label: https://www.macrumors.com/2021/01/05/google-hasnt-updated-ios-apps-since-privacy-labels/ https://www.macrumors.com/2021/01/05/google-hasnt-updated-io... I really wonder why :) And apparently iMessage has a privacy statement now, and it's much shorter than whatsapp's: https://www.forbes.com/sites/zakdoffman/2021/01/03/whatsapp-beaten-by-apples-new-imessage-update-for-iphone-users/ https://www.forbes.com/sites/zakdoffman/2021/01/03/whatsapp-... (This is posted on HN too).
- deleted 6y ago[deleted]
- ogre_codes 6y ago> I really wonder why :) No big mystery there. > iMessage has a privacy statement now, and it's much shorter than whatsapp's Or there. I wonder how effective these things really will be. Most people aren't going to scroll through these so the average person is going to ignore the everything below the fold. It's like the required disclaimers on medicines which people ignore. Once you get past the first few, nobody pays attention.
- simpss 6y agoIt doesn't have to have an effect to everyone, it's about taking responsibility and actually defining what they're doing. Once we have everyone actually publishing what they're doing it's a lot simpler to file complaints to DPA's and to verify they're actually compliant with legislation.
- radley 6y agoiMessage is shorter because Apple already uses the OS for data collection and can easily match your id: https://support.apple.com/en-us/HT205223 https://support.apple.com/en-us/HT205223
- deleted 6y ago[deleted]
- whatever1 6y agoThat is wildly inaccurate. Apple should report for each of their apps the iOS data they are collecting on top of the application specific data. Apple has my location, my friend's location, my contact list, and stores all of my iMessages with the encryption key in iCloud.
- yokoprime 6y agoAs far as we know (and evidence seems to support it, apple does does not hand out users data to authorities) apple cannot decrypt your data at will.
- whatever1 6y agoAt the phone. At icloud is a different story. "Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. When you turn off iCloud Backup, a new key is generated on your device to protect future messages and isn't stored by Apple" https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- ascagnel_ 6y agoI think this is the best way to do it. - If you want to hold the keys to your backups and set up the system to be private, you have the option to do so, and are presented with that option at the time the device is set up (and you are also presented with the option to use a local backup to restore or set up a device). The implications of the choice to use a cloud backup should be made more clear, though. - For the vast, vast majority of users who don't have good backup hygiene, having someone else manage backups and hold decryption keys is a good trade-off, considering that the alternative is total data loss.
- whatever1 6y agoe2e encryption for all icloud data + a dialog prompt on whether you authorize to store the decryption key on the server would suffice.
- lalos 6y agoActual 9to5mac article referenced: https://9to5mac.com/2021/01/04/app-privacy-labels-messaging-apps/ https://9to5mac.com/2021/01/04/app-privacy-labels-messaging-...
- halukakin 6y agoWe should understand Facabook was the best platform to advertise mobile game apps and etc, for almost 10 years. Apple took 30% of all that revenue without any objection. Now Apple has its own ad infrastructure, and this is a perfect strategic move by Apple.
- Guereric 6y agoI am flabbergasted that this author attributed to 9to5 mac the privacy labels of different apps in the screenshot, when tracing the sources shows it was Zak Doffman at Forbes who created it. Poor journalism.
- tempfs 6y agoExpect more of this pushing competitors out as Apple transitions further into the 'services' business model by monetizing their vast trove of user data. MSFT and GOOG have been doing this too for years ofcourse. While GOOG has had to be content only with what they can read from emails/calendars, texts, web searches, calls/voicemail, maps/location data and anything else that they can scrape from an Android device. MSFT has had all of that a much, much more since they own the whole OS for workstation/server class devices where actual work gets done. MSFT will claim that all that data is for quality control and now security services but ofcourse they are going to squeeze every last drop of money they can from it. To expect otherwise would be like asking an alcoholic to guard a brewery and never sample the product, completely ridiculous. The US has no serious legal repercussions for doing so. Probably because the US intelligence community depends on that data since IT is forbidden from collecting it from Americans on its own. Gee, I wonder why...
- dancemethis 6y agoGee, talk about a massive "pot to kettle" story.