6 ms·

iOS 15 still keeps user data even after deleting apps

1 points by fernvenue 4y ago

Today I remembered a news that I saw in iOS 14. Link here: https://www.gsmarena.com/ios_14_found_to_keep_user_data_even_after_deleting_the_app-news-47676.php I've tried to find any updates or responses from Apple, but the answer is nothing. It is important to note that the Keychain here is not exactly the same as the iCloud Keychain, whether you enable iCloud Keychain or not, applications can still use it to track your installation behavior. In the era of iOS 15, where Apple places more emphasis on privacy, why are users helpless with such super cookies?

Someone 4y ago
So, the issue is that iOS keeps keychain items around when you delete an app, and the claim is that data cannot be deleted and can be used to track you. About the “cannot be deleted”: it’s not as convenient as it could be, but can’t you delete passwords via Settings? See https://support.apple.com/en-us/HT211146 https://support.apple.com/en-us/HT211146. As to the tracking, AFAIK the keychain items are only accessible to the app owner (in their app and, I think, if you let Safari use it on their site). If you don’t reinstall the app or visit the site, it’s junk data. If you do reinstall it, the app can use it to figure out that you’re the user who logged in earlier. I don’t see how they would need data in your keychain for that, though. The app could track logins server-side, too, so if iOS didn’t store that item, the app would prompt for user name and password and from that, conclude that you visited earlier. Am I missing something?
- fernvenue 4y ago
  Yes, but also no. Of course we can delete passwords here, but we can't delete app's data fingerprint. So the problem is, even if I uninstall an app and delete app's data, next time when I reinstall it, they can detect the data fingerprint from keychain and match the server side data, so that they can know who I am, even if I use a new IP address or sign up for a new user account. If I don't wanna be detected, or I just wanna be a new user, my only option is to completely reset my device.

1 points by fernvenue 4y ago

Someone 4y ago

So, the issue is that iOS keeps keychain items around when you delete an app, and the claim is that data cannot be deleted and can be used to track you. About the “cannot be deleted”: it’s not as convenient as it could be, but can’t you delete passwords via Settings? See https://support.apple.com/en-us/HT211146 https://support.apple.com/en-us/HT211146. As to the tracking, AFAIK the keychain items are only accessible to the app owner (in their app and, I think, if you let Safari use it on their site). If you don’t reinstall the app or visit the site, it’s junk data. If you do reinstall it, the app can use it to figure out that you’re the user who logged in earlier. I don’t see how they would need data in your keychain for that, though. The app could track logins server-side, too, so if iOS didn’t store that item, the app would prompt for user name and password and from that, conclude that you visited earlier. Am I missing something?

fernvenue 4y ago
Yes, but also no. Of course we can delete passwords here, but we can't delete app's data fingerprint. So the problem is, even if I uninstall an app and delete app's data, next time when I reinstall it, they can detect the data fingerprint from keychain and match the server side data, so that they can know who I am, even if I use a new IP address or sign up for a new user account. If I don't wanna be detected, or I just wanna be a new user, my only option is to completely reset my device.