6 ms·

Technically, what's going on here? "CAID" isn't a public iOS technology, and the article doesn't say what it means. Some googling returns: https://mmachina.cn

Technically, what's going on here? "CAID" isn't a public iOS technology, and the article doesn't say what it means. Some googling returns: https://mmachina.cn/wp-content/uploads/2021/02/MMA%E4%B8%AD%E5%9B%BD%E8%90%A5%E9%94%80%E5%88%9B%E6%96%B0%E8%81%94%E7%9B%9F%E7%A7%BB%E5%8A%A8%E4%BA%92%E8%81%94%E7%BD%91App%E5%BA%94%E7%94%A8%E5%B5%8C%E5%85%A5%E5%B9%BF%E5%91%8AAPI%E7%9B%91%E6%B5%8B%E6%A0%87%E5%87%86-V.2.1.pdf https://mmachina.cn/wp-content/uploads/2021/02/MMA%E4%B8%AD%... Apparently it means "CAA Advertising Id", where "CAA" appears to be the "Creative Artists Agency", some sort of Chinese advertising group. (edit: wrong organization, it's actually "Chinese Anonymization ID", not a group. the group behind it is https://trackingio.com/ https://trackingio.com/) Searching "CAA Advertising Id" yields more Chinese PDFs. From what I can tell here, "CAID" is a partnership between Chinese industry and Chinese government to track users across apps for better tracking. The issue here does not seem to be that they've bypassed a technical restriction, but that the developers of major apps are using a shared identifier that Apple doesn't like. In the US, the analogy would be if apps had tracking SDKs in them, that fingerprinted users across apps, in order to better target them for advertisements, and then the US government can pick up that data and do whatever they'd like with it. The strange part to me, is that this actually is the situation today in the US. I don't want to shill for China, but why is this a story? This has been a US industry since at least Doubleclick was invented. edit: It's a story because they're using the iOS keychain API to persist and share the tracking identifier. As far as I know, this is a new technique in the wild, but has been theoretically possible since iOS launched. It's only now being seen as necessary because of the iOS14 privacy changes. It's curious that American ad companies seem to understand Apple's intent and are opting not to risk their business by expanding their SDKs to use keychain sharing techniques, even though they're surely aware you can do this. Chinese ad companies seem ok with risking their clients apps being banned on the app store. Apple can mitigate this by giving users control of the data and sharing related to keychain services.

freebuju 6y ago
From what I understand, this CAID will be an effective replacement of Apple's IDFA. It will allow partner advertising groups to tag iPhone users directly without relying on any of Apple's identifiers.
pityJuke 6y ago
> Creative Artists Agency This is wrong. Creative Artists Agency is a talent agency, based in the US, with the same abbreviation.
- deleted 6y ago
  [deleted]
some1else 6y ago
This reminds me of how Linkedin and many others used to upload entire phonebooks to unecrypted endpoints, making it simple for US agencies to analyze social networks of foreigners with impunity.
- GrayShade 6y ago
  Did they really stop doing that?
  - some1else 6y ago
    Ha, good question. Generally, everyone switched to HTTPS. But that doesn't protect against situations like with Yahoo, where the agencies were tapped-in after the SSL termination. I guess it's not a stretch to assume it's still going on.
Jonanin 6y ago
The story is that major Chinese companies and the state are working together to develop an alternative to Apple’s IDFA. While aggressively pushing back against companies in the U.S. tracking users, Apple seemingly doesn’t mind having a double standard for China.
- CountSessine 6y ago
  It's a bigger choice than that for them, or for anyone. If the government requires pervasive tracking, it's either allow it or stop selling phones in China, the world's biggest market for cell phones. And given that economies of scale matter (for things like swallowing flat rate development costs for those nice SOCs they design), it's hard to say goodbye to half your market. Samsung certainly won't take a principled stand on this and stop allowing app tracking. And in a competitive market, deciding to not sell cell phones in China means less development capital for designing the next generation of hardware. They'll start circling the drain and wind up like Motorola or HTC. I'm not saying that they shouldn't be consistent - just that choosing to not sell in China will mean losing everything outside of China eventually.
- rootusrootus 6y ago
  > Apple seemingly doesn’t mind having a double standard for China. That seems to be the case with many businesses. Nobody wants to lose that entire market just to stand on principle.
  - Larrikin 6y ago
    Google did and didn't stop existing as a company
    - rootusrootus 6y ago
      Google opted out of the Chinese market because it violated their principles? They didn't try to make a censored Chinese version of Google?
      - 6y ago
reaperducer 6y ago
In the US, the analogy would be if apps had tracking SDKs in them, that fingerprinted users across apps, in order to better target them for advertisements, and then the US government can pick up that data and do whatever they'd like with it. I've never really thought about it before, but it would be pretty easy for a three-letter agency to set up an online advertising company for this purpose. They start their own airlines (Air America, JANET, etc.), so starting an adtech company should be a walk in the park.
- CountSessine 6y ago
  But they don't even need to do that - they just approach an existing adtech company with a FISA warrant and get their data. If they started their own adtech company, eventually they would be out-ed and exposed. But with a FISA warrant, it's mostly business-as-usual for everyone.
  - freeflight 6y ago
    > But they don't even need to do that - they just approach an existing adtech company with a FISA warrant and get their data. Depending on who they approach, they won't even need a FISA warrant because in the US information voluntarily given to third parties has "no reasonable expectation of privacy" [0] [0] https://en.wikipedia.org/wiki/Third-party_doctrine https://en.wikipedia.org/wiki/Third-party_doctrine
- RandomSpanish 6y ago
  There are some precedents, such as: https://www.vice.com/en/article/epdkze/muslim-apps-location-data-military-xmode https://www.vice.com/en/article/epdkze/muslim-apps-location-...
- sangnoir 6y ago
  > I've never really thought about it before, but it would be pretty easy for a three-letter agency to set up an online advertising company for this purpose. There's no need to set one up when you can break into many/all the existing advertising companies; remember "SSL added and removed here :^)" written on an NSA slide, referring to Google's clear-text internal data-center traffic? Also, the NSA spent a fuck-ton of money on compute to factor enough primes to trivially break 20-40%[1] of SSL traffic of the day...in real time. 1. This was about 6 years ago, I can't remember exact percentage, but it was definitely at least 20%, IIRC, the attack was on the key-exchange step
DLay 6y ago
Here is the CAID spec: https://web.archive.org/web/20210316035745/docs.trackingio.com/CAID%E6%8E%A5%E5%85%A5%E8%AF%B4%E6%98%8E.html https://web.archive.org/web/20210316035745/docs.trackingio.c...
- anon9001 6y ago
  That's very helpful and adds a lot of clarity. You can tell from the code that the "exploit" here is abusing keychain sharing. iOS has a feature where you can pack a surprising amount of generic data into keychain storage, intended for passwords or auth credentials. iOS also lets app developers opt-in to shared credential storage, so that if you have multiple apps, the user only needs to login once. Here's a blog post on how to do it: https://evgenii.com/blog/sharing-keychain-in-ios/ https://evgenii.com/blog/sharing-keychain-in-ios/ A little-known quirk of the iOS keychain is that it persists across app installs. This is useful because if multiple apps share credentials in the keychain, you don't want uninstalling one app to log you out of other apps. If an American company tried this (looking at you Branch.io), would it be banned by Apple? Maybe? That seems to be the controversy here. Perhaps Apple needs to rethink its keychain sharing API and make the user opt-in to credential sharing. Also a keychain management tool would be nice, so users can see what data apps are permanently storing on their devices (even if the app is uninstalled).
  - tinus_hn 6y ago
    Credential sharing only works between apps registered to the same developer. So no, this does not allow an tracking ID usable by all apps. And remember, any trick abused to create tracking IDs stands the risk of being detected and blocked by Apple in the next iOS update. It has been announced, it has happened, it will keep happening.
    - anon9001 6y ago
      > Credential sharing only works between apps registered to the same developer. That's right, but it does allow persisting an id through reinstalls of the same app, and sharing that id between apps of the same developer. > So no, this does not allow an tracking ID usable by all apps. It effectively does though. For example, imagine a mobile game company with 10 games. With this technique, you can track that user across app re-installs in each of those games. Now imagine another game company doing the same trick. If both companies send up their independent tracking IDs to a central server along with any other info they can get about the user (email, screen name, IP, whatever), then you can strongly correlate users across multiple tracking IDs. The user has no way to reset these IDs even if they delete and reinstall the apps using them.

freebuju 6y ago

From what I understand, this CAID will be an effective replacement of Apple's IDFA. It will allow partner advertising groups to tag iPhone users directly without relying on any of Apple's identifiers.

pityJuke 6y ago

> Creative Artists Agency This is wrong. Creative Artists Agency is a talent agency, based in the US, with the same abbreviation.

deleted 6y ago
[deleted]

some1else 6y ago

This reminds me of how Linkedin and many others used to upload entire phonebooks to unecrypted endpoints, making it simple for US agencies to analyze social networks of foreigners with impunity.

GrayShade 6y ago
Did they really stop doing that?
- some1else 6y ago
  Ha, good question. Generally, everyone switched to HTTPS. But that doesn't protect against situations like with Yahoo, where the agencies were tapped-in after the SSL termination. I guess it's not a stretch to assume it's still going on.

Jonanin 6y ago

The story is that major Chinese companies and the state are working together to develop an alternative to Apple’s IDFA. While aggressively pushing back against companies in the U.S. tracking users, Apple seemingly doesn’t mind having a double standard for China.

CountSessine 6y ago
It's a bigger choice than that for them, or for anyone. If the government requires pervasive tracking, it's either allow it or stop selling phones in China, the world's biggest market for cell phones. And given that economies of scale matter (for things like swallowing flat rate development costs for those nice SOCs they design), it's hard to say goodbye to half your market. Samsung certainly won't take a principled stand on this and stop allowing app tracking. And in a competitive market, deciding to not sell cell phones in China means less development capital for designing the next generation of hardware. They'll start circling the drain and wind up like Motorola or HTC. I'm not saying that they shouldn't be consistent - just that choosing to not sell in China will mean losing everything outside of China eventually.
rootusrootus 6y ago
> Apple seemingly doesn’t mind having a double standard for China. That seems to be the case with many businesses. Nobody wants to lose that entire market just to stand on principle.
- Larrikin 6y ago
  Google did and didn't stop existing as a company
  - rootusrootus 6y ago
    Google opted out of the Chinese market because it violated their principles? They didn't try to make a censored Chinese version of Google?
    - 6y ago

reaperducer 6y ago

In the US, the analogy would be if apps had tracking SDKs in them, that fingerprinted users across apps, in order to better target them for advertisements, and then the US government can pick up that data and do whatever they'd like with it. I've never really thought about it before, but it would be pretty easy for a three-letter agency to set up an online advertising company for this purpose. They start their own airlines (Air America, JANET, etc.), so starting an adtech company should be a walk in the park.

CountSessine 6y ago
But they don't even need to do that - they just approach an existing adtech company with a FISA warrant and get their data. If they started their own adtech company, eventually they would be out-ed and exposed. But with a FISA warrant, it's mostly business-as-usual for everyone.
- freeflight 6y ago
  > But they don't even need to do that - they just approach an existing adtech company with a FISA warrant and get their data. Depending on who they approach, they won't even need a FISA warrant because in the US information voluntarily given to third parties has "no reasonable expectation of privacy" [0] [0] https://en.wikipedia.org/wiki/Third-party_doctrine https://en.wikipedia.org/wiki/Third-party_doctrine
RandomSpanish 6y ago
There are some precedents, such as: https://www.vice.com/en/article/epdkze/muslim-apps-location-data-military-xmode https://www.vice.com/en/article/epdkze/muslim-apps-location-...
sangnoir 6y ago
> I've never really thought about it before, but it would be pretty easy for a three-letter agency to set up an online advertising company for this purpose. There's no need to set one up when you can break into many/all the existing advertising companies; remember "SSL added and removed here :^)" written on an NSA slide, referring to Google's clear-text internal data-center traffic? Also, the NSA spent a fuck-ton of money on compute to factor enough primes to trivially break 20-40%[1] of SSL traffic of the day...in real time. 1. This was about 6 years ago, I can't remember exact percentage, but it was definitely at least 20%, IIRC, the attack was on the key-exchange step

DLay 6y ago

Here is the CAID spec: https://web.archive.org/web/20210316035745/docs.trackingio.com/CAID%E6%8E%A5%E5%85%A5%E8%AF%B4%E6%98%8E.html https://web.archive.org/web/20210316035745/docs.trackingio.c...

anon9001 6y ago
That's very helpful and adds a lot of clarity. You can tell from the code that the "exploit" here is abusing keychain sharing. iOS has a feature where you can pack a surprising amount of generic data into keychain storage, intended for passwords or auth credentials. iOS also lets app developers opt-in to shared credential storage, so that if you have multiple apps, the user only needs to login once. Here's a blog post on how to do it: https://evgenii.com/blog/sharing-keychain-in-ios/ https://evgenii.com/blog/sharing-keychain-in-ios/ A little-known quirk of the iOS keychain is that it persists across app installs. This is useful because if multiple apps share credentials in the keychain, you don't want uninstalling one app to log you out of other apps. If an American company tried this (looking at you Branch.io), would it be banned by Apple? Maybe? That seems to be the controversy here. Perhaps Apple needs to rethink its keychain sharing API and make the user opt-in to credential sharing. Also a keychain management tool would be nice, so users can see what data apps are permanently storing on their devices (even if the app is uninstalled).
- tinus_hn 6y ago
  Credential sharing only works between apps registered to the same developer. So no, this does not allow an tracking ID usable by all apps. And remember, any trick abused to create tracking IDs stands the risk of being detected and blocked by Apple in the next iOS update. It has been announced, it has happened, it will keep happening.
  - anon9001 6y ago
    > Credential sharing only works between apps registered to the same developer. That's right, but it does allow persisting an id through reinstalls of the same app, and sharing that id between apps of the same developer. > So no, this does not allow an tracking ID usable by all apps. It effectively does though. For example, imagine a mobile game company with 10 games. With this technique, you can track that user across app re-installs in each of those games. Now imagine another game company doing the same trick. If both companies send up their independent tracking IDs to a central server along with any other info they can get about the user (email, screen name, IP, whatever), then you can strongly correlate users across multiple tracking IDs. The user has no way to reset these IDs even if they delete and reinstall the apps using them.