4 ms·

The point of the article is that there are enough data that are low information in isolation but when combined together can effectively identify ad targets. Thi

The point of the article is that there are enough data that are low information in isolation but when combined together can effectively identify ad targets. This is already being done, it isn’t a theory. That’s the point of the article: clever developers can find (perhaps infinite) other ways to combine things they do have access to into a unique, or even just “close enough to unique to be useful for tracking”, identifier

tinus_hn 6y ago
Nobody’s disputing that. But if Apple wasn’t anywhere near blocking these clever tricks, they wouldn’t be screaming bloody murder. Again, Apple knows these fingerprinting parts exist, has acknowledged they exist, has stated they are going to block them and has blocked them. And no, they aren’t done, they might never be done. But also they have stated no intention of stopping.
- CyberRabbi 6y ago
  They cannot block IP address, screen res, battery level, time zone, just to name a few.
  - tinus_hn 6y ago
    Apple can bin battery level so it doesn’t contribute to fingerprinting, IP addresses are dynamic and shared and screen resolution and time zone are shared by millions of others. Why would tracking companies be grasping for straws like boot up time if these other obvious things are so effective and impossible to block?
    - CyberRabbi 6y ago
      Those are just a few examples, the surface area is obviously massive (100s if not 1000s). We both know that. The reality is that iOS was not designed with this attack vector in mind. Here is yet another one I just randomly thought up “install date of app” https://stackoverflow.com/questions/39255403/get-date-of-when-app-was-installed-ios https://stackoverflow.com/questions/39255403/get-date-of-whe... now imagine what a dedicated developer could design.
      - tinus_hn 6y ago
        Sorry, it’s not difficult or forbidden to remember user identity in your own app. It’s about sharing that identity between apps. And by the way, there is absolutely nothing stopping Apple from reporting your app was installed on January 1st, 1970.
        CyberRabbi 6y ago
        > And by the way, there is absolutely nothing stopping Apple from reporting your app was installed on January 1st, 1970. I doubt Apple would do that but I think you are very much missing the point. These one-off patches are not effective at scale, there are literally 100s if not 1000s of information leaks of this type that indeed are observable across multiple apps. App install date was just one that I pulled from thin air that required no thought. A dedicated engineer could easily solve this problem.
buran77 6y ago
Hence why I said that the more data an app is trying to get access to, the more random variability should be introduced. Some apps might legitimately need access to some data points with "minimal" random noise. But if they start asking for enough to uniquely identify a user then the OS should just "blur" all the data. Battery level can randomly vary on any app that can't justify knowing the exact value. Imagine the app having a "budget" for getting exact data: it can spend it on 2 precise data points or 10 very blurry ones. Unless Apple decides to implement some form of VPN to obscure the IP there's not much to do about that, the phone can hide it only from the app, not the server. On a mobile network this seems less of a concern, and even in the home it wouldn't allow unique identification. So assuming the IP was the only thing that leaks and every other data point is "poisoned" by the OS, I'm sure it would make those companies tracking you deeply unhappy and unsatisfied. Maybe some loopholes can't be closed, others may provide precise data but it's shared with millions of users making it as generic as it gets. Just raising the bar for successfully tracking the user to a very hard to reach level, and lowering the overall accuracy to the point it's no longer a practical concern could be good enough for all intents and purposes.

tinus_hn 6y ago

Nobody’s disputing that. But if Apple wasn’t anywhere near blocking these clever tricks, they wouldn’t be screaming bloody murder. Again, Apple knows these fingerprinting parts exist, has acknowledged they exist, has stated they are going to block them and has blocked them. And no, they aren’t done, they might never be done. But also they have stated no intention of stopping.

CyberRabbi 6y ago
They cannot block IP address, screen res, battery level, time zone, just to name a few.
- tinus_hn 6y ago
  Apple can bin battery level so it doesn’t contribute to fingerprinting, IP addresses are dynamic and shared and screen resolution and time zone are shared by millions of others. Why would tracking companies be grasping for straws like boot up time if these other obvious things are so effective and impossible to block?
  - CyberRabbi 6y ago
    Those are just a few examples, the surface area is obviously massive (100s if not 1000s). We both know that. The reality is that iOS was not designed with this attack vector in mind. Here is yet another one I just randomly thought up “install date of app” https://stackoverflow.com/questions/39255403/get-date-of-when-app-was-installed-ios https://stackoverflow.com/questions/39255403/get-date-of-whe... now imagine what a dedicated developer could design.
    - tinus_hn 6y ago
      Sorry, it’s not difficult or forbidden to remember user identity in your own app. It’s about sharing that identity between apps. And by the way, there is absolutely nothing stopping Apple from reporting your app was installed on January 1st, 1970.
      - CyberRabbi 6y ago
        > And by the way, there is absolutely nothing stopping Apple from reporting your app was installed on January 1st, 1970. I doubt Apple would do that but I think you are very much missing the point. These one-off patches are not effective at scale, there are literally 100s if not 1000s of information leaks of this type that indeed are observable across multiple apps. App install date was just one that I pulled from thin air that required no thought. A dedicated engineer could easily solve this problem.

buran77 6y ago

Hence why I said that the more data an app is trying to get access to, the more random variability should be introduced. Some apps might legitimately need access to some data points with "minimal" random noise. But if they start asking for enough to uniquely identify a user then the OS should just "blur" all the data. Battery level can randomly vary on any app that can't justify knowing the exact value. Imagine the app having a "budget" for getting exact data: it can spend it on 2 precise data points or 10 very blurry ones. Unless Apple decides to implement some form of VPN to obscure the IP there's not much to do about that, the phone can hide it only from the app, not the server. On a mobile network this seems less of a concern, and even in the home it wouldn't allow unique identification. So assuming the IP was the only thing that leaks and every other data point is "poisoned" by the OS, I'm sure it would make those companies tracking you deeply unhappy and unsatisfied. Maybe some loopholes can't be closed, others may provide precise data but it's shared with millions of users making it as generic as it gets. Just raising the bar for successfully tracking the user to a very hard to reach level, and lowering the overall accuracy to the point it's no longer a practical concern could be good enough for all intents and purposes.