8 ms·
Et Tu, Procter and Gamble?
- shoto_io 6y ago> Doing this is clearly against Apple’s rules. The questions are: Can Apple detect these techniques? And what is Apple going to do if they do identify apps in China using CAID in flagrant violation of the App Store rules, if those apps have the backing (implicit or explicit) of the Chinese government? As much as I love Apple’s move for more robust privacy policies, I doubt that they have a chance to prevent this from happening. From a tech perspective, because it requires a lot of effort to detect these. But also from a business perspective. It's one thing to ban a game, but banning WeChat?
- tracybrinkmann 6y agoI have to agree with you here...
- Sebb767 6y agoI don't get the connection to WeChat here. You need to log in anyways, so why should WeChat run any fingerprinting? The user ID is right there, given by the user.
- shubik22 6y agoI would guess what they want is the ability to link behavior outside of WeChat (e.g. looking at computer monitors on Amazon, and then reading tech news on the Verge) with your profile on WeChat. Apple’s changes are in part designed to limit the abilities for entities to track you via third party cookies as you go around the web; device fingerprinting would be a substitute for those third party cookies.
- vonwoodson 6y agoAttaching a username to a legal name is one high-level fusion. Attaching these names to a device ID is another. Attaching that to a different app and username are a couple more. This account information can be used in finding out when that user logs into another device. If any of those devices are sharing browsing history then that can be fused to online accounts. If any of those devices are active during daily commutes can fuse brick-and-mortar shopping destinations, place of employment, what daycare watches their kids, where Mom and Dad live. Maybe, some of that data is embarrassing. Maybe, some of that data could be used to tell a story about you. Maybe, that story if false... but, would be very difficult to refute if made public. Maybe, you should just work with us (this one time, I promise) rather than have your whole life turned upside down... No drop of water takes responsibility for the flood.
- oxylibrium 6y agoWeChat may have a convenient way to track users within the app, but a "device ID" equivalent is still useful for ad agencies to transparently target users on other apps based on the things they do on WeChat. (Otherwise, they'd need to add more user friction - for example, forcing users to link accounts.) For context, some have argued [0] that modern Chinese life, in many ways, revolves around WeChat - chat, payments, location sharing, games, and more - and I don't find any reason to doubt those claims. Sure, Apple could say no if WeChat decided to integrate fingerprint-driven tracking on iOS, but because of WeChat being a "super app" in China, Tencent could just say "sure, we'll stop supporting iOS" and that would cut iOS devices off from one of the most used apps in China, and make everyday life harder for everyone in China with an iPhone. With iOS being the minority player in China [1][2], Tencent can likely get away with it too - I don't foresee a competitor rising up out of nowhere especially when WeChat still has a deep network effect for the remaining 78-82% of the population that uses Android. [0]: obtained from Wikipedia: https://web.archive.org/web/20170103135948/https://www.fastcompany.com/3065255/china-wechat-tencent-red-envelopes-and-social-money https://web.archive.org/web/20170103135948/https://www.fastc... [1]: https://www.kantarworldpanel.com/global/smartphone-os-market-share/ https://www.kantarworldpanel.com/global/smartphone-os-market... [2]: https://gs.statcounter.com/os-market-share/mobile/china https://gs.statcounter.com/os-market-share/mobile/china
- yladiz 6y ago> With iOS being the minority player in China, Tencent can likely get away with it too I would somewhat disagree. Yes, iOS is a minority in China, but for wealthier people it's a higher percentage as it's a status symbol (as it is in many places). I don't know if this would change the calculus much but it might, and apparently the party is keen on cutting down on apps requiring more than essential data collection without consent[1] so it's possible that the government won't directly force Apple's hand in this case (as in, by forcing WeChat to remain in the App Store even using CAID). 1: https://www.reuters.com/article/us-china-cac-personaldata-idUSKBN2BE0P9 https://www.reuters.com/article/us-china-cac-personaldata-id...
- ducktective 6y agoShouldn't it be: Et Tu, Procter et Gamble?
- greenwich26 6y agoWell, the site wrote it with an ampersand (&), which is originally a creative combination of "e" and "t". My nitpick is: shouldn't it be "Et vos, Procter & Gamble?"
- bitlevel 6y agoPerhaps Et vous (pluralised you)?
- cafeoh 6y ago"vous" if pluralized you in French, not in Latin.
- deleted 6y ago[deleted]
- Xophmeister 6y agoIt’s Latin, rather than French.
- billyjobob 6y agoThat’s French, not Latin.
- Centrino 6y agoIt's Latin, not French. "Et tu" could be from both languages, but the origin of the saying is what Julius Caesar said to Brutus after being deadly stabbed.
- simias 6y agoThe words individually could indeed be French but we'd use the oblique case here, "et toi (aussi), Procter & Gamble?". Also, I'm not sure what the usage would be in classical Latin, but using the singular to talk about a company in French seems perfectly appropriate. IIRC it's the Brits who like to use the plural for companies and institutions.
- CyberRabbi 6y agoThe reality is that Apple has little ability to block apps that are tracking people by indirect data such as “device boottime.” Sure maybe in that specific case they can block that piece of information but there are likely at least 100 other seemingly innocuous pieces of information available to apps that can be used the same way. The idea of a “trustless” App Store is nice and roughly works in practice but is ultimately a fiction. Using a malicious app will always expose you to danger. New vulnerabilities are announced regularly. The situation is worse on the web: WebKit vulns are released nearly monthly and there is no app review there. Browsing the web with JavaScript enabled is a security nightmare. For example see the recent security notes for iOS 14.4.2 [1], every release you’ll likely see a fix for a new vulnerability. I’m hesitant to say there will ever be a scalable and permanent solution to this problem. The best advice is simple: do not run apps you do not trust, do not visit websites you do not trust. [1] https://support.apple.com/en-us/HT212256 https://support.apple.com/en-us/HT212256
- pornel 6y agoApps are heavily sandboxed. iOS controls all local information they can access, so Apple is in position to fight this. It doesn't need to be perfect. Only hard enough that apps have to resort to more desperate techniques, so that they're detectable and Apple can ban them for trying. Overall I don't like Apple's sandbox and total control over iOS, but it exists, and in this case at least they can use their power for something good.
- CyberRabbi 6y agoThe point of the article is exactly that it isn’t 100% perfect and this slight imperfection has allowed companies like P&G to take advantage of that for large-scale privacy violation. From the article: The whack-a-mole1 aspect of Apple’s new privacy rules is that while Apple can restrict access to the API that provides access to the IDFA identifier, clever developers can find (perhaps infinite) other ways to combine things they do have access to into a unique, or even just “close enough to unique to be useful for tracking”, identifier. IP addresses, to name just one example, are a big factor that Apple can’t block would-be-trackers from using.
- Daho0n 6y agoThis is in my opinion a symptom that cannot realistically be treated. The "disease" that need treatment is the power big markets have in the world and this is nothing new. The only New in this is that the US (state and businesses) aren't setting the agenda 100% of the time anymore. While this system of tracking is clearly A Bad Thing I'm not so sure the dilution of US control here is bad. So far I'm actually convinced this is an extremely good thing for the world on average. Maybe not for America but its time as top dog alone at the peak of power is almost at an end anyway. In other words this is just a new player that want what Apple (and others) have granted US tech industry for decades. If they want to shut the door now they will likely be shut out of China, which I fully understand from their perspective. What is needed is a way to secure users from tracking at a much lower level and I doubt Apple will ever trade money/income for user privacy. If they did I would buy my first iPhone.
- mcphage 6y ago> I doubt Apple will ever trade money/income for user privacy. They do this continuously. > If they did I would buy my first iPhone. That, I doubt.
- Daho0n 6y ago>They do this continuously. They do not. The privacy Apple do is for PR and to shut out competitors. Benefit for users is only a side effect. >That, I doubt. Understandably. It will likely never happen that Apple will do privacy.
- Sebb767 6y agoMaybe it's me being bad in reading diplomatic, but Apple directly states: > Apps that are found to disregard the user’s choice will be rejected So, if I'm reading this correctly, if the apps will be found violating the policy they will be pulled/rejected? This statement seems pretty clear to me, to be honest.
- Nextgrid 6y agoThat's what they claim, but apps have already found to be lying on their "privacy nutrition labels" with seemingly zero consequences.
- kleinsch 6y ago> Basically, IDFA was Apple’s attempt to work with companies to provide a way to offer a sanctioned identifier for advertising tracking that respected user privacy and user control over tracking. It didn’t work — these companies have no respect for user privacy or user control, even with IDFA. I'd disagree with this part - I think IDFA worked as designed, Apple has changed in terms of what they're marketing and how much power they have to enforce their vision. Apple created IDFA in 2012 to give users a way to control and reset their advertising ID. It worked as designed. Advertisers could track users, but users had control to reset their advertising ID to disassociate their data. Later Apple introduced the option to disable tracking but it was opt-in, not opt-out, so most users still allowed tracking and didn't realize it's happening. In iOS 14, they've created an opt-in system, (which everyone knows most users won't opt into) and a ban hammer for apps that violate the spirit of that opt-in. Ten years ago Apple wasn't running ads about privacy and they were working on building out the App Store. Hell, 2012 is also when they introduced signing into Facebook and Twitter built into the operating system. Smacking down ad networks and decreasing revenue for app developers would have been a lot harder. They're in a much better position now.
- nojito 6y ago>Ten years ago Apple wasn't running ads about privacy and they were working on building out the App Store. Steve did https://www.youtube.com/watch?v=39iKLwlUqBo https://www.youtube.com/watch?v=39iKLwlUqBo >Privacy means people know what they're signing up for, in plain English and repeatedly >I believe people are smart and some people want to share more data than other people do. Ask them. Ask them every time. Make them tell you to stop asking them if they get tired of your asking them. Let them know precisely what you're going to do with their data I think the issue was that Apple bungled IDFA by not making in opt-in initially and now are trying to correct their mistakes. Apple was vilified 10 years ago for this stance, but at the end of the day they were right with their opt-in view on tracking and how pervasive silicon valley was going to become with collecting data.
- gumby 6y ago> think IDFA worked as designed, Apple has changed in terms of what they're marketing and how much power they have to enforce their vision. Companies improve their products and sometimes it changes the ecosystem. This is way better than, say, the car industry who fought safety enhancements for decades. This is improving safety for their customers; the people who believe they will suffer for this are like the high-interest payday lenders of the internet. Apple has taken a pro-privacy position for longer than the iphone has existed. Execution has not always been great but I do believe their position is genuine. However I’ll let them defend themselves on this one: they have a communications group. I’m not trying to claim they are saints, merely that I believe that their pattern of actions Has shown a longstanding interest in their customers’ privacy. Perfect? No, but higher than any others, AFAICT. PS: if you want another car analogy: certain other actions by Apple remind me of the car companies’ proprietary extensions to the open OBD-II. So again, not saints.
- Despegar 6y ago>And what is Apple going to do if they do identify apps in China using CAID in flagrant violation of the App Store rules, if those apps have the backing (implicit or explicit) of the Chinese government? The CPC is on Apple's side when it comes to privacy. https://www.reuters.com/article/us-china-cac-personaldata-idUSKBN2BE0P9 https://www.reuters.com/article/us-china-cac-personaldata-id...
- mensetmanusman 6y agoWho here bets Apple would ever pull WeChat?
- tinus_hn 6y agoThey probably won’t pull WeChat but they could easily refuse updates while disabling tracking points. After all, there is no reason an app can’t be told an iPhone booted up on January 1st, 1970.
- philistine 6y agoApple has said it won't hold updates for policy reasons anymore. They seem to have forgotten they promised that, but they did.
- motohagiography 6y agoSlight issue with privacy is that any persistent source with sufficient entropy is going to be a unique identifier, and even low entropy sources when used together create an n^n^n... sized field of identifiers. Same goes for browser fingerprinting, it's the same set of techniques. > Through apps, CAID collects user device data, such as the device start-up time, model, time zone, country, language and IP address. Any business whose gross margin per unit is as low as P&G's is effectively an advertising company with a smelly water supplier in the back. We can probably expect the same surveillance techniques from the other CPG manufacturers as well. The browser itself has become parasitic, and the only viable way to mitigate this predatory advertiser and surveillance problem is to recognize and delineate the difference between what can only be described as the hegemonic internet (hegemonet?) and private channels like matrix/element, or previously irc and other ways of connecting.
- sixothree 6y agoMaybe VPN providers need to start providing hosted browsers.
- zzzeek 6y agoYou can win at "whack a mole" by hitting harder. Pass some real legislation and fine P&G a billion dollars. Works better than any amount of technology-level detection.
- Shivetya 6y agoLegislation, and what do you do about other countries whose laws and activities are opposite of your own? What China wants may be completely different than what we want and they have space at the table too
- brudgers 6y agoIronically -- and I don't use that phrase lightly but this is Apple apologist Gruber -- the context of et tu is weaker persons banding together to stop an out of control tyrant. Brutus was by at least a whisker on the right side of history at et tu time. And his self-interest was raw mortal threat. Proscription lists were a thing. As another halo company, P&G is an Apple rival and Apple doesn't cooperate with it in developing its policies. Apple develops its policies solely in its self interest. And changes them without input from stakeholders. Thusly I argue that "ironically" is justified here. YMMV.
- simonblack 6y agoProctor and Gamble have been on my 'don't buy from these bastards" list ever since they offered a refund of about $100 on purchase of a shaver, and then reneged on the promise. If you fuck up your customers, you don't deserve to have them.