15 ms·
Are iPhones Better for Privacy? Comparative Study of iOS and Android Apps
- randomperson_24 5y agoI hope fanboys don't start defending Apple / Google for their privacy measures etc. (esp. Apple) Both platforms are notorious (Apple more so due to its closed nature imo) and defending any is just weird.
- travoc 5y agoAre we allowed to have an opinion about which company is better for our privacy?
- croes 5y agoIf both are bad, does it matter which is less bad?
- ceejayoz 5y agoYes. https://en.wikipedia.org/wiki/Overton_window https://en.wikipedia.org/wiki/Overton_window
- joconde 5y agoYes definitely. There are a lot of nuances in privacy. As an example, take the approach to ML and assistants, where Google collects most of everything to train models on their servers, while Apple tries to anonymize things a bit (e.g. their “differential privacy” techniques).
- ikurei 5y agoWell, yes, of course it does. I'm willing to limit what apps I use and carefully consider what I install. I'm not yet willing to abandon my smartphone. Choosing the lesser of N evils is a pretty common and often rational choice, in life and in engineering. May be not in this case, and it's good to be unsatisfied, but disregarding the debate just because neither option is great makes no sense.
- croes 5y agoChoosing the lesser of N evils only makes sense if one is acceptable. If neither is, a choice is useless. Both sides have an unacceptable amount of tracking and your choice doesn't really have any consequences.
- derefr 5y agoNaively, because it only takes two suppliers in a market, for consumers to start playing them against each-other by switching to whichever one plays more to consumer preferences at any given moment, incentivizing the suppliers to compete to satisfy that consumer preference. Like a classical "race to the bottom" that lowers prices, but with some other factor that consumers care about instead of cost. (Of course, this assumes people bother to switch. In reality, this isn't even true in oligopolist party politics, let alone in oligopolist markets. In practice, there need to be a lot more, smaller options before switching costs are forced down enough to encourage people to switch. In phone markets, this looks like how people switch somewhat easily between different Android device manufacturers for their next phone. If we could get phone Operating Systems working like that, we'd really have something!)
- smoldesu 5y agoYou're welcome to say whatever you want, but if you genuinely believe that the NSA gives preferential treatment to anyone from FAANG you're living a fever dream.
- shawnz 5y agoOn the other hand, who else besides FAANG has the resources to resist the NSA, at least in small ways?
- ForHackernews 5y agoThe Chinese and the Russians. Who wants to buy a Yandex phone?
- YarickR2 5y agoWhat's wrong with Yandex phone ?
- Mikeb85 5y agoIt's not about resources, it's about reach and jurisdiction. If anything, FAANGs have the most incentive to cooperate with the NSA because they're located in the US and have the most to lose. The companies that can best resist the NSA are located outside of the US and EU.
- imwillofficial 5y agoApple has had high profile fights with USgov on their privacy stances. Google has not.
- Mikeb85 5y agoAnd yet they're cooperating with the government all the same. Literally just marketing... With Google, you at least know what to expect. How many promises has Apple broken now?
- bogwog 5y agoSaying that iPhones are secure and private is wishful thinking that benefits nobody but Apple shareholders. There are no doubt some dead journalists and activists that would still be alive today if iPhones truly were secure and/or private.
- amelius 5y agoExtraordinary assertions require extraordinary proof.
- Razengan 5y agoHow about this one objective example of Apple > Google in terms of privacy: iCloud Mail aliases versus Gmail aliases: Google exposes your main address at all times: HeyGuysLookWhoItIs+TotallyNotMe@gmail.com iCloud lets you have completely different aliases all forwarded to the same main account which no one else ever has to see. AND you can see which apps have been given which aliases from one convenient list. But of course facts like this will get buried to maintain the tired “everything sucks the same” narrative here.
- imwillofficial 5y agoName one
- smoldesu 5y agoJamal Kashoggi
- imwillofficial 5y agoHe would not be alive today no matter what phone he used.
- smoldesu 5y agoHard to say, his phone was the one that ratted him out.
- ActorNightly 5y agoThe difference is, with a good number of Android phones, you can just flash a custom rom without any tracking built in.
- kaba0 5y agoLet’s leave it at “there are android phones”. Unfortunately it is not at all supported for the majority of phones, and for the ones where it is possible, it will result in eg. the purging of camera firmware.
- emsy 5y agoWhy not if one is better than they other? There is fanboyism, which is unproductive and then there’s sober comparison of objective measures of privacy. And I want to know which is better. So as long as someone presents facts that help me make a decision I don’t want to censor them.
- mfer 5y agoYou have to look at what versions of the operating systems they’re looking at and compare that to today. Things change.
- deleted 5y ago[deleted]
- Razengan 5y ago“Everything sucks the same, why bother” is the cry of those incapable of nuance, or more commonly, on the losing side. There are objective reasons where Apple is better at privacy. For example, one of the things that benefits me the most personally: iCloud Mail aliases versus Gmail aliases: Google exposes your main address at all times: HeyGuysLookWhoItIs+TotallyNotMe@gmail.com What even is the fucking point? iCloud lets you have completely different aliases all forwarded to the same main account which no one else ever has to see.
- AnonHP 5y agoAndroid that’s seen as Android in the mass market is also closed. The AOSP layer may be open source, but all the Google layers that make Android usable (for most people), such as Play Services, the Play Store, and Google apps, are all closed. Not any different from Apple in that respect.
- rasengan 5y agoI don’t think a smart phone in your pocket all day with a GPS and microphone that you use as a central hub for all your communications, notes, research and appointments and so forth, can really be considered for its privacy - and it appears thru researching apps on these smartphones the authors have the same conclusion.
- kadoban 5y agoOf course they can, the paper just did. Security (which privacy is one subset of) is not binary. Just because it can never be perfect does not mean that it's all equal.
- rasengan 5y agoPrivacy is absolutely binary and taking a hardline approach is absolutely the proper way to protect your privacy. You either actively choose to share information (1) or you don’t (0). The article compares who is sharing what to who — sharing info is sharing, period. A smartphone with all the bells and whistles in 2021 is not private. I stand by my statement, hardline.
- nom 5y agoI respect your hardline approach but for most people it's a rather soft thing. I want to be able to choose WHO i share my information with and under what conditions. You can argue that once information is shared it's up for grabs by anyone but i argue that this is simply not true, it just feels like that it is. We could do so much better and we should never forget that.
- rasengan 5y agoBecause security is non-binary - once you share your information, it is up for grabs.
- throwawayboise 5y ago> You can argue that once information is shared it's up for grabs by anyone but i argue that this is simply not true I think it is true. The old saying is that once you tell someone a secret, it's no longer a secret. The ecosystem around mobile devices is just such that real privacy is impossible. That's not unlike many other things; pretty much any form of communication has this feature to one degree or another. There are just so many third parties and intermediaries involved in mobile platforms that's it's particularly bad.
- croes 5y agoBetter is useless, I need good.
- dartharva 5y ago>In this paper, we present a study of 24k Android and iOS apps from 2020 along several dimensions relating to user privacy. >We find that third-party tracking and the sharing of unique user identifiers was widespread in apps from both ecosystems, even in apps aimed at children. In the children's category, iOS apps used much fewer advertising-related tracking than their Android counterparts, but could more often access children's location (by a factor of 7). >Overall, we find that neither platform is clearly better than the other for privacy across the dimensions we studied. Well, here's a novel idea: don't get children their own smartphones, uninstall/disable all apps bar the essentials, and keep your own usage to the bare minimum.
- acdha 5y agoThis is like saying the solution to widespread obesity is to tell people to eat better. Kids use phones / tablets for many reasons and most of them are real (e.g. keep in touch with parents, travel using services like Uber, communications and other school apps, etc.) — the platform needs to protect people because it’s unrealistic to expect individual choices to hold up against massive industry.
- jasonmp85 5y agoWhen did you get a cell phone? How many children have you raised?
- simonh 5y agoI don't think it's reasonable to expect people to adopt a bunker mentality on this. iPhones, Pixels, Samsung flagships, etc are fantastic devices that offer incredibly useful and powerful features. For most people giving that up for improved privacy in't a worthwhile tradeoff. That does not in any way mean any of this tracking is ok or acceptable. It means we need to keep up the public pressure and technical vigilance to publicise this issue, and try and get the industry and legislators/regulators moving in the right direction.
- tyingq 5y agoIt seems like privacy isn't popular enough to enable a third player in the market. I wonder if "cheap" would be popular enough to make a dent. Like someone churning out de-googled AOSP phones cheap enough to attract market share.
- judge2020 5y agoI can imagine almost everyone targeted by your marketing are also interested in benefiting from the immensely valuable, free* services provided by Google. *: obviously paid with privacy, but that does mean less money leaves the user's bank account
- kristofferR 5y agoThe "cheaper" customers you get, the less they demand. That includes privacy, unfortunately.
- tyingq 5y agoYes, the idea is to give them privacy even though they aren't asking for privacy, just "cheap".
- kmonsen 5y agoBut you have to make up the costs somehow. It's like websites, all the cheapest one are full of scammy ads and tracking software. Most cheaper phones will just get revenue from selling users info instead.
- simonh 5y agoHow do you undercut competitors that are doing what you do, but also have a revenue stream from compromising customer privacy, and are skimping on investment in securing their products?
- smoldesu 5y agoYou'd likely attract the ire of some 3-letter-agencies long before you found your market. Even low-volume devices like the Pinephone and Librem have come under fire for potentially including hardware backdoors in newer models. It's a game of cat-and-mouse, where the cat has unlimited resources.
- jolux 5y agoNote that this study and the other one from earlier this year predate iOS 14.5, which introduced the “ask not to track” prompt that disables the operating system-provided unique identifier.
- rmadriz 5y agothere has been a couple of studies demonstrating that basically is a useless feature, even worse, some apps track more when you "ask to not track". https://blog.lockdownprivacy.com/2021/09/22/study-effectiveness-of-apples-app-tracking-transparency.html https://blog.lockdownprivacy.com/2021/09/22/study-effectiven...
- sinuhe69 5y agoWhat they want to do and what they actually can do are two different things. Facebook is one of the biggest trackers in the world. But when even FB was dealt a huge blow after iOS 14.5, I don’t think other apps could fare much better. https://www.bloomberg.com/news/articles/2021-07-14/facebook-fb-advertisers-impacted-by-apple-aapl-privacy-ios-14-changes https://www.bloomberg.com/news/articles/2021-07-14/facebook-...
- spansoa 5y agoOne thing you have to consider when debating i0S versus Android in the context of privacy is: you can have the best of both worlds and own an Android phone and an i0S device (if you can afford that, and I'm aware many citizens in third world countries don't have the luxury of owning two phones). It's like the old Chrome versus Firefox debates that happen every other month now on Hackernews & Reddit. I own a Chromebook where I leverage the Google ecosystem and do Googley stuff all day, then a Thinkpad with Qubes+Whonix when I want privacy & security & sometimes anonymity. You don't have to be faithful to a single company/OS/provider/whatever. You can leverage all the things and compartmentalize.
- mcguire 5y agoHow would that not give you the worst of both worlds? You would be tracked by the weakest aspect of both devices.
- smoldesu 5y agoIt's actually more in-line with how real world threat models work. You always operate under the assumption that all of your hardware is compromised, then build layers of trust around that to determine which device should be used when. Not super practical for an end-user, but it's definitely better than having a single device that you always second-guess.
- jjj123 5y agoI don’t do this and it seems like a hassle but it is an interesting question: would this be more or less private than a single device? One thing I can think of is most tracking algorithms probably assume each user has a single cell phone (either explicitly or the ML data is biased in that direction). So splitting your time across two devices probably messes with whatever user-behavior buckets they place you in. They might think you’re two people in the same household, for example.
- alecco 5y agoMaybe with different VPN endpoints on each device it could work. But it would require a strict discipline. Google is very good at finding the same person in 2 very different devices.
- zsmi 5y agoI think this study is quite good but it does come with one important caveat: From page 5, "This is before the introduction of Apple's new opt-in mechanism for tracking in 2021. Our dataset therefore reflects privacy in the app ecosystem shortly before this policy change." Personally, I would prefer to see the difference between apps monetized by customers paying directly and apps monetized by advertising. I take for granted advertiser will track, and I assume paid apps track less but I wonder if that's actually true in practice. It very well might not be.
- molsio 5y agohttps://www.imore.com/apples-anti-tracking-iphone-feature-functionally-useless-claims-study https://www.imore.com/apples-anti-tracking-iphone-feature-fu...
- zsmi 5y agoThanks for pointing me to that. It's hard not to agree with the Transparency Matters conclusion but the 13% drop in Tracking Attempts is worth calling out so I'm glad the Oxford researchers did it. This is not my field but one thing that I don't get when looking over the Transparency Matters report [1] is why do some apps have 9 trackers and others have 300 requests? Are they really so different? And are they able to get information that Starbucks didn't with only 3 trackers and 21 requests? I guess in the end the magnitudes aren't so important but I found the large differences pretty amazing. If nothing else I would think they might want to reduce the amount of data they need to retain, reducing their costs. It seems like there has to be diminishing returns there. It also shows how much data Google has as they show up on 8 of the 10 apps tracker lists and one can only assume they keep a copy of all that as well. So perhaps the iOS/Andriod comparison is meaningless anyway as Google knows all about you either way. [1] https://blog.lockdownprivacy.com/2021/09/22/study-effectiveness-of-apples-app-tracking-transparency.html https://blog.lockdownprivacy.com/2021/09/22/study-effectiven...
- KoftaBob 5y agoThis article shows a fundamental misunderstanding of the functionality of "App Tracking Transparency", and I will admit the text "ask app not to track" is confusing. ATT, when a user selects "no", blocks the app from accessing your device ID. This makes it so that even though the app can still track what you do in their app, they can't connect that to the data collected from other apps through your device ID, and therefore build a profile of you as a person.
- Jeaye 5y agoIt's tough to diff the privacy between Android and iOS, as an OS. However, as an app ecosystem, it's not tough at all. For example, there is not a single open source email app on iOS which supports GPG email. In the iOS app ecosystem, privacy and FLOSS is an afterthought, since iOS users are more likely to pay for proprietary software. On Android, there are a lot more options, including things like F-Droid which are full of FLOSS apps which are graded based on their patterns and anti-patterns.
- legulere 5y agoThe included email client already supports S/MIME though
- aomobile 5y agoFeels safer though to pay than to get something for free.
- teddyh 5y agoI prefer free friends to those that charge me money to be my friend.
- chmsky00 5y agoAndroid phones are free like speech, not free like beer.
- teddyh 5y agoWe were not discussing the actual phones, nor even Android itself, but the application software running on phones.
- jiminymcmoogley 5y agomore accurately AOSP phones, since Google Location Services is far from free as in freedom
- 5y ago
- collsni 5y agoCaylxos is the best alternative to both that I've found. Anyone know of something better?
- dtonon 5y agoI didn't test CalyxOS yet but I suggest you to try GrapheneOS, if you have a Pixel. I think it is really well done, the documentation is detailed and the team's attention about security, and so privacy, is rock solid.
- escherize 5y agoI use lineage os for microG [0] myself, but can't find a good foss android keyboard. Is there such a thing? [0] - https://lineage.microg.org/ https://lineage.microg.org/
- bubblethink 5y agoFlorisboard
- collsni 5y agothanks!
- imchillyb 5y agoLook how we selectively choose information and how that is bad for consumers! iOS 14 released anti-tracking features in April of 2021. This article is released at the end of september, almost october, of 2021. Yet, the authors choose to specifically use a version of iOS that was prior to these changes. This is proof enough for me that the authors purposely skewed the data. This skewed data does not reflect reality, and so the data from this study is not data. I hope the rest of this community is savvy enough to realize this article is attempting to dupe the readers into a false conclusion.
- simion314 5y agoOr maybe the date of the publication does not imply that the data and the work was done exactly in the week before, sometimes a study might take more work then a blog post.
- prepend 5y agoThere’s enough time between April and publication of this preprint that they should have addressed it. Also, this is a preprint, so maybe they do expand on the final pub.
- viktorcode 5y agoit is somewhat irrelevant. Privacy conscious users could disable that tracking in iPhone settings for years.
- smoldesu 5y agoYeah, the data is totally skewed! They didn't even include Android 12 which just hit AOSP beta last week!
- wintermutestwin 5y agoAny conversation about privacy needs to be centered around the threat model: Worried about state actors? More power to you, but good luck with that. Most people don't have the time, energy or paranoia (justified or not) to figure that out and keep on top of it. Worried about stalker capitalism? Google is eagerly selling your data to the highest bidder = I have zero faith that their OS isn't snarfing up everything it can to sell to anyone who will pay. Apple has a different business model = I have some faith that they aren't selling my data.
- ccouzens 5y agoGoogle doesn't sell your data. What they do do is use your data to decide what adverts to show you. If they sold your data, they'd risk a rival company buying it and making a better ad network.
- concinds 5y agoI'm not going to debate the conclusion of this paper, but keep in mind if you pick Android, it's still very important to pick the brand correctly. When you open the Clock app on Xiaomi phones, the first thing you see is a privacy policy you need to accept (!). Samsung might be better on this. I saw quite a few people on other websites (not HN) who said they switched to Android after Apple's CSAM thing, but put little thought into brand choice beyond price and features, just assuming all Androids are the same. You might say that people who really care about privacy would just get GrapheneOS, but the mainstream info available to help make these decisions is really poor as of now. Just seems like a Wild West.
- tomComb 5y agoThis. On privacy and even moreso on security, Android can be very good or it can be terrible and the first, and perhaps most important, determinant of this is your choice of brand.
- lrvick 5y agoPrivacy is terrible on all stock Android phones, even first party from Google. All ship with piles of binary blobs mandated by Google, SoC vendors, and carriers that have god access to your device, as well as any entities they sell that access to, and this sort of power abuse has been caught publicly many times. Apple has been caught doing similar in the past but it is much harder to regularly audit closed platforms. Unless you run something best effort like CalyxOS or GrapheneOS you should not have any reasonable expectation of privacy on a handset.
- acdha 5y agoDo you have citations for any of those sweeping claims?
- chayleaf 5y agoFlash Lineage OS without GApps, use microG if necessary. That will be miles better than either stock Android or iOS. Sure, that isn't really general user-accessible, but I'd expect it to be pretty easy for the general HN reader. Or use Pinephone if you want "actual" privacy. Librem 5 is an alternative as well, albeit an overpriced one.
- colordrops 5y agoOf course neither platform is gonna be much better than the other because this is a survey of apps, and not the platforms themselves.
- kalleboo 5y agoThere can be differences though. Where I live, Coca-cola has computerized all their vending machines, and you can connect to them with an app and pay for a drink and collect points to redeem for free drinks. They also have a feature where if you walk a certain number of steps in a month, you can get a free drink. On iOS, the app asks for permission to read the step count data from the iOS system step counter. On Android, the app requires background location and the Coca Cola company can now know where you are at any time.
- hetspookjee 5y agoI’m pretty sure the dark patterns of Android make sure that most regular users share more data than iOS users. For example the Google maps app pretends the location service is broken when it’s simply not having the maximal efficieny with WiFi enabled. Another aspect is the phone itself having their own way. Most Android devices come pre installed with a plethora of tracking apps enabled. So given privacy with Apple I know that I share it exclusively with Apple, while on Android I’m certain it is both the manufacturer and Google.
- EastOfTruth 5y agoI'd say that Apple is more deceptive about the iPhone privacy then Google is of Android devices.
- AnonHP 5y agoAnd your claim would be dubious and questionable because it’s not backed by details worth knowing or arguing about.
- EastOfTruth 5y agoI'll point you to this comment as a start: https://news.ycombinator.com/item?id=28840842 https://news.ycombinator.com/item?id=28840842
- ajvs 5y agoIt's a poor proxy measure of mobile OS privacy comparing thousands of apps of the default app stores. It totally ignores the effect of Android device brand on privacy, and choice of ROM and non-default app stores being used. If this was more conservatively titled "who has the worst default app store" that'd be far more accurate.