5 ms·

What about the IP address used to communicate with the app’s server? Can that be obscured? What about the screen resolution? What about time zone? Battery level

What about the IP address used to communicate with the app’s server? Can that be obscured? What about the screen resolution? What about time zone? Battery level?

notriddle 6y ago
Screen resolution? You can predict that perfectly based on the model number, and many models have the same screen resolution. https://developer.apple.com/library/archive/documentation/DeviceInformation/Reference/iOSDeviceCompatibility/Displays/Displays.html https://developer.apple.com/library/archive/documentation/De...
tinus_hn 6y ago
Nobody’s blocking IP addresses but apparently these are not enough or these companies wouldn’t be clutching their other tracking pearls. IP addresses and battery levels are dynamic and screen resolution and time zones are shared by millions. The real fingerprinting is in things like sensor calibration and these can be stopped by binning or randomizing values. Apple has announced they will be blocking these prints one by one and they are. Developers wouldn’t be screaming if they weren’t in trouble.
- CyberRabbi 6y ago
  The point of the article is that there are enough data that are low information in isolation but when combined together can effectively identify ad targets. This is already being done, it isn’t a theory. That’s the point of the article: clever developers can find (perhaps infinite) other ways to combine things they do have access to into a unique, or even just “close enough to unique to be useful for tracking”, identifier
  - tinus_hn 6y ago
    Nobody’s disputing that. But if Apple wasn’t anywhere near blocking these clever tricks, they wouldn’t be screaming bloody murder. Again, Apple knows these fingerprinting parts exist, has acknowledged they exist, has stated they are going to block them and has blocked them. And no, they aren’t done, they might never be done. But also they have stated no intention of stopping.
    - CyberRabbi 6y ago
      They cannot block IP address, screen res, battery level, time zone, just to name a few.
      - tinus_hn 6y ago
        Apple can bin battery level so it doesn’t contribute to fingerprinting, IP addresses are dynamic and shared and screen resolution and time zone are shared by millions of others. Why would tracking companies be grasping for straws like boot up time if these other obvious things are so effective and impossible to block?
        CyberRabbi 6y ago
        Those are just a few examples, the surface area is obviously massive (100s if not 1000s). We both know that. The reality is that iOS was not designed with this attack vector in mind. Here is yet another one I just randomly thought up “install date of app” https://stackoverflow.com/questions/39255403/get-date-of-when-app-was-installed-ios https://stackoverflow.com/questions/39255403/get-date-of-whe... now imagine what a dedicated developer could design.
        tinus_hn 6y ago
        Sorry, it’s not difficult or forbidden to remember user identity in your own app. It’s about sharing that identity between apps. And by the way, there is absolutely nothing stopping Apple from reporting your app was installed on January 1st, 1970.
        CyberRabbi 6y ago
        > And by the way, there is absolutely nothing stopping Apple from reporting your app was installed on January 1st, 1970. I doubt Apple would do that but I think you are very much missing the point. These one-off patches are not effective at scale, there are literally 100s if not 1000s of information leaks of this type that indeed are observable across multiple apps. App install date was just one that I pulled from thin air that required no thought. A dedicated engineer could easily solve this problem.
  - buran77 6y ago
    Hence why I said that the more data an app is trying to get access to, the more random variability should be introduced. Some apps might legitimately need access to some data points with "minimal" random noise. But if they start asking for enough to uniquely identify a user then the OS should just "blur" all the data. Battery level can randomly vary on any app that can't justify knowing the exact value. Imagine the app having a "budget" for getting exact data: it can spend it on 2 precise data points or 10 very blurry ones. Unless Apple decides to implement some form of VPN to obscure the IP there's not much to do about that, the phone can hide it only from the app, not the server. On a mobile network this seems less of a concern, and even in the home it wouldn't allow unique identification. So assuming the IP was the only thing that leaks and every other data point is "poisoned" by the OS, I'm sure it would make those companies tracking you deeply unhappy and unsatisfied. Maybe some loopholes can't be closed, others may provide precise data but it's shared with millions of users making it as generic as it gets. Just raising the bar for successfully tracking the user to a very hard to reach level, and lowering the overall accuracy to the point it's no longer a practical concern could be good enough for all intents and purposes.
dylan604 6y ago
Why does an app need to know the device's IP address? Why can't the OS just provide a method to communicate with the network. The OS handles all of the network communication with the app just providing the message and recipient?
- saagarjha 6y ago
  Because you can hit a server which can see your IP.
  - dylan604 6y ago
    What does a server seeing the address have to do with the app seeing the address directly from the OS? The app knows the address it needs to talk to, so it preps the message and then calls an OS provided method to make that call. The OS method then returns the response. The app never needs to know the IP address of the device on which it is running.
    - saagarjha 6y ago
      It does not, but it will try to grab it anyways for the purposes of tracking. Given that this is trivial to get there is no reason to hide it from apps.
120391583 6y ago
> What about the IP address used to communicate with the app’s server? Yes. I've been wanting Apple to launch a VPN service for a long time. A commercial VPN service can aid privacy by aggregating thousands of users behind a single IP address. The problem is that you have to trust the VPN provider. Commercial VPN providers are inherently shady -- after all, their entire business model is aiding and abetting copyright infringement or perhaps even worse activities. (No logging, wink wink!) I see no reason to trust them. By contrast, Apple has a valuable brand (i.e., a reputation) and has made privacy a core part of their sales pitch. Unlike the inherently fly-by-night commercial VPN industry, Apple would have billions of reasons not to betray their customers by selling VPN usage data. I think there's a market for an existing, known, reputable business to come in and offer a VPN service that explicitly does keep traffic flow logs for a short time, in the same way that ISPs retain dynamic IP assignment logs for a short time. By retaining logs, you avoid the shady elements that are otherwise attracted to no-logging VPN services. If not Apple, I think one of the few remaining reputable independent ISPs would be a great fit. Sonic.net comes to mind. Sonic makes [clear, explicit claims](https://www.sonic.com/privacy-policy https://www.sonic.com/privacy-policy) that they do not sell usage data, but they do retain IP assignment logs for up to 14 days and will provide that data to law enforcement with an appropriate court order. That's exactly what I want: my adversary is P&G and their ilk, not law enforcement with a court order.

What about the IP address used to communicate with the app’s server? Can that be obscured? What about the screen resolution? What about time zone? Battery level?

notriddle 6y ago

Screen resolution? You can predict that perfectly based on the model number, and many models have the same screen resolution. https://developer.apple.com/library/archive/documentation/DeviceInformation/Reference/iOSDeviceCompatibility/Displays/Displays.html https://developer.apple.com/library/archive/documentation/De...

tinus_hn 6y ago

Nobody’s blocking IP addresses but apparently these are not enough or these companies wouldn’t be clutching their other tracking pearls. IP addresses and battery levels are dynamic and screen resolution and time zones are shared by millions. The real fingerprinting is in things like sensor calibration and these can be stopped by binning or randomizing values. Apple has announced they will be blocking these prints one by one and they are. Developers wouldn’t be screaming if they weren’t in trouble.

CyberRabbi 6y ago
The point of the article is that there are enough data that are low information in isolation but when combined together can effectively identify ad targets. This is already being done, it isn’t a theory. That’s the point of the article: clever developers can find (perhaps infinite) other ways to combine things they do have access to into a unique, or even just “close enough to unique to be useful for tracking”, identifier
- tinus_hn 6y ago
  Nobody’s disputing that. But if Apple wasn’t anywhere near blocking these clever tricks, they wouldn’t be screaming bloody murder. Again, Apple knows these fingerprinting parts exist, has acknowledged they exist, has stated they are going to block them and has blocked them. And no, they aren’t done, they might never be done. But also they have stated no intention of stopping.
  - CyberRabbi 6y ago
    They cannot block IP address, screen res, battery level, time zone, just to name a few.
    - tinus_hn 6y ago
      Apple can bin battery level so it doesn’t contribute to fingerprinting, IP addresses are dynamic and shared and screen resolution and time zone are shared by millions of others. Why would tracking companies be grasping for straws like boot up time if these other obvious things are so effective and impossible to block?
      - CyberRabbi 6y ago
        Those are just a few examples, the surface area is obviously massive (100s if not 1000s). We both know that. The reality is that iOS was not designed with this attack vector in mind. Here is yet another one I just randomly thought up “install date of app” https://stackoverflow.com/questions/39255403/get-date-of-when-app-was-installed-ios https://stackoverflow.com/questions/39255403/get-date-of-whe... now imagine what a dedicated developer could design.
        tinus_hn 6y ago
        Sorry, it’s not difficult or forbidden to remember user identity in your own app. It’s about sharing that identity between apps. And by the way, there is absolutely nothing stopping Apple from reporting your app was installed on January 1st, 1970.
        CyberRabbi 6y ago
        > And by the way, there is absolutely nothing stopping Apple from reporting your app was installed on January 1st, 1970. I doubt Apple would do that but I think you are very much missing the point. These one-off patches are not effective at scale, there are literally 100s if not 1000s of information leaks of this type that indeed are observable across multiple apps. App install date was just one that I pulled from thin air that required no thought. A dedicated engineer could easily solve this problem.
- buran77 6y ago
  Hence why I said that the more data an app is trying to get access to, the more random variability should be introduced. Some apps might legitimately need access to some data points with "minimal" random noise. But if they start asking for enough to uniquely identify a user then the OS should just "blur" all the data. Battery level can randomly vary on any app that can't justify knowing the exact value. Imagine the app having a "budget" for getting exact data: it can spend it on 2 precise data points or 10 very blurry ones. Unless Apple decides to implement some form of VPN to obscure the IP there's not much to do about that, the phone can hide it only from the app, not the server. On a mobile network this seems less of a concern, and even in the home it wouldn't allow unique identification. So assuming the IP was the only thing that leaks and every other data point is "poisoned" by the OS, I'm sure it would make those companies tracking you deeply unhappy and unsatisfied. Maybe some loopholes can't be closed, others may provide precise data but it's shared with millions of users making it as generic as it gets. Just raising the bar for successfully tracking the user to a very hard to reach level, and lowering the overall accuracy to the point it's no longer a practical concern could be good enough for all intents and purposes.

dylan604 6y ago

Why does an app need to know the device's IP address? Why can't the OS just provide a method to communicate with the network. The OS handles all of the network communication with the app just providing the message and recipient?

saagarjha 6y ago
Because you can hit a server which can see your IP.
- dylan604 6y ago
  What does a server seeing the address have to do with the app seeing the address directly from the OS? The app knows the address it needs to talk to, so it preps the message and then calls an OS provided method to make that call. The OS method then returns the response. The app never needs to know the IP address of the device on which it is running.
  - saagarjha 6y ago
    It does not, but it will try to grab it anyways for the purposes of tracking. Given that this is trivial to get there is no reason to hide it from apps.

120391583 6y ago

> What about the IP address used to communicate with the app’s server? Yes. I've been wanting Apple to launch a VPN service for a long time. A commercial VPN service can aid privacy by aggregating thousands of users behind a single IP address. The problem is that you have to trust the VPN provider. Commercial VPN providers are inherently shady -- after all, their entire business model is aiding and abetting copyright infringement or perhaps even worse activities. (No logging, wink wink!) I see no reason to trust them. By contrast, Apple has a valuable brand (i.e., a reputation) and has made privacy a core part of their sales pitch. Unlike the inherently fly-by-night commercial VPN industry, Apple would have billions of reasons not to betray their customers by selling VPN usage data. I think there's a market for an existing, known, reputable business to come in and offer a VPN service that explicitly does keep traffic flow logs for a short time, in the same way that ISPs retain dynamic IP assignment logs for a short time. By retaining logs, you avoid the shady elements that are otherwise attracted to no-logging VPN services. If not Apple, I think one of the few remaining reputable independent ISPs would be a great fit. Sonic.net comes to mind. Sonic makes [clear, explicit claims](https://www.sonic.com/privacy-policy https://www.sonic.com/privacy-policy) that they do not sell usage data, but they do retain IP assignment logs for up to 14 days and will provide that data to law enforcement with an appropriate court order. That's exactly what I want: my adversary is P&G and their ilk, not law enforcement with a court order.