24 ms·

Apple sends DSID with iPhone analytics data, tests show

303 points by kelthuzad 4y ago

therealmarv 4y ago
Why the ... I need to buy a pixel and install a niche operating system like GrapheneOS or CalyxOS to be at least a little safe with my privacy :/ btw. GrapheneOS is great!
godelski 4y ago
I'm honestly surprised we aren't seeing these big tech companies have an arms race with respect to homomorphic encryption. Since you can perform computations on the encrypted data itself this appears to be the best of both worlds: anonymous and still able to pull big data. Probably won't be able to serve as personalized ads, but from what I'm aware, the big data is far more important than the direct targeting. I know Meta is betting big on the Metaverse, but it's also wild to me that they similarly don't bet big here and keep their ad infrastructure. https://en.wikipedia.org/wiki/Homomorphic_encryption https://en.wikipedia.org/wiki/Homomorphic_encryption https://news.ycombinator.com/item?id=32987155 https://news.ycombinator.com/item?id=32987155
- myaccount9786 4y ago
  Apart from the fact that they have no incentive to, there are technical downsides, even assuming you could get a useful homomorphic scheme to work in practice. For example, encrypted data can't be compressed. Columnar big data systems rely heavily on that to be performant.
  - godelski 4y ago
    > Apart from the fact that they have no incentive to They have huge incentives. Apple is positioning themselves as the privacy king. Meta has suffered huge losses because of their privacy abuses. Neither of these suggest no incentives. I'd argue that they suggest large incentives. The technical downsides are a fair critique though. But this also is where competition excels. Our machines are getting faster. Other algorithms have also gotten extremely faster and it would be naive to assume that homormorphic algorithms similarly don't. This is why I say an arms race.
    - wongarsu 4y ago
      Not to mention being able to keep processing data, while your competition gets squeezed by tightening regulations around the world.
      - godelski 4y ago
        The other thing is you could likely squeeze your competition out of the market. Countries are waking up to the implications of data harvesting and that it isn't only being used by themselves but their adversaries. So if a big company, like Apple, got it working, it would be much easier to lobby legislation that would harm (or kill) your competitors. (While I think we would all be better off if this happened, I do recognize that this same power can be abused and cause a significant disruption in the ecosystem. But I think it would also be extremely difficult to impossible to gain such an edge that others couldn't quickly adapt. Even if they drag their feet)
    - rocketbop 4y ago
      I wonder if there's new feature or improvement Apple could introduce that would actually increase their sales. It seems like at the moment people buy the new iPhone because 1/ they need/want a new phone, 2/ they want an iPhone, and 3/ they want the new iPhone. Apple know what they need to do to be successful, and that's continue to release updates to the iPhone that in a few small ways make it slightly better than the previous one.
    - YetAnotherNick 4y ago
      > They have huge incentives. Apple is positioning themselves as the privacy king I am willing to bet that it is a deal breaker only for very small minority of users. I would argue that search engine data is of much bigger privacy concern than OS, as compared to search history no OS action comes close in disclosing personal action, and google/bing almost has universal market presence even for Apple users. > Meta has suffered huge losses because of their privacy abuses. They had their revenue reduced, true. But it is not loss. They wouldn't be in any better position if they didn't used extra data when it was available.
    - AndriyKunitsyn 4y ago
- NBJack 4y ago
  Ads targeting is actually a huge motivation for ads platforms, IIRC; customers buying ads want to know if they work.
  - godelski 4y ago
    Ad targeting is much broader than that though. Even with encrypted data you can match keys to profiles. You just don't know who that profile belongs to and you don't even need to know the contents of that profile. The whole point here is that you can treat the system like a black box but still work with it in a useful way.
  - NayamAmarshe 4y ago
    Brave has proven that targeting is not always the best answer. They did an analysis on their own platform, their CTR is very very good and they do not compromise privacy in any way and still deliver ads (opt-in).
    - 8note 4y ago
      I assume brave shows mostly crypto adds? If so, the targeting is baked in
      - NayamAmarshe 4y ago
        Yes, mostly web3 projects but there are other advertisers as well. Like Twitch for example.
    - smoldesu 4y ago
      > They did an analysis on their own platform That's always how good studies start.
      - NayamAmarshe 4y ago
        Studies? This is CTR we're talking about. It doesn't have to be a research paper to show what's the average CTR, advertisers know it beforehand, they just made the info public. https://brave.com/brave-ads/casestudies/ https://brave.com/brave-ads/casestudies/
- eyakubovich 4y ago
  It's unclear when homomorphic encryption will be ready for prime time, especially at big tech scale. It's easier to give up the data under assurances of how exactly that data will be used. Secure enclaves (e.g. AWS nitro enclaves) can be used to offer cryptographic attestations as to what the code is doing with the user data. Practically speaking, an average user won't inspect the code, of course. But it does allow for other companies to audit and vouch for the usage.
- fragmede 4y ago
  as the a fan of homomorphic encryption I very much hear what you are saying (two examples I thought up https://news.ycombinator.com/item?id=32993163 https://news.ycombinator.com/item?id=32993163). But at the end of the day, there's no way to prove that Bob's Homomorphic Encryption SaaS company isn't "backing up" all your data into a regular database as well. And that's assuming Bob never gets hacked, too. At the end of the day, even with HE, we have to trust Bob to be trustworthy, and to have designed and implemented it totally correctly (or else data will leak in the clear). If it was Bob's small company then having a 3rd-party external auditor review the system would go a long way to gaining the public's trust, but unfortunately Meta has no such luxury. They could say they can't see your data until they were blue in the face, and they could even be telling the trust, but people don't currently believe they haven't sold your data (or the specific nuance there), so I'm not surprised they haven't made a large investment in HE. HE is also not quite there yet. It's ridiculously slow for anything but the most simple operations and Meta's data needs are far from simple.
  - godelski 4y ago
    Yeah you make a really good point (especially with those two examples, which the latter might not even require data collection at all). But I do think that an arms race in this direction would change the public view. You'd sure have a lot fewer nerds like us arguing about privacy. Though we'd probably be arguing more for open source to lessen the trust issue. I don't think we'll ever have fully trust-less systems. But I do think there's a big difference between saying "trust us, we don't look at the data" vs "we encrypted the data and use this method, trust us that we aren't decrypting it". The former method is worse because there's a lot of people that have clear access to the data. The latter is better because there are more speed bumps and the argument is more sound. A lot of trust is built from demonstrating good faith efforts.
- Terretta 4y ago
  If it the concept that counts, not just that particular tech, some do "race" to get big data without compromising privacy, even when they don't have to (because no competitors are racing on the privacy dimension). For a survey, check out what firms are doing on "differential privacy" not just "homomorphic encryption". As a for instance, Apple -- since the OP is about them -- spent significant extra effort to make Maps anonymized. Concept: https://www.apple.com/privacy/docs/Differential_Privacy_Overview.pdf https://www.apple.com/privacy/docs/Differential_Privacy_Over... In Apple Maps: https://www.idownloadblog.com/2019/03/13/apple-maps-navigation-privacy/ https://www.idownloadblog.com/2019/03/13/apple-maps-navigati...
  - smoldesu 4y ago
    Apple maps was based on OpenStreetMap originally, which actually tracked users less than the Apple Maps[0] app. Guess all that special work was for nothing. [0] https://www.apple.com/privacy/labels/ https://www.apple.com/privacy/labels/
kornhole 4y ago
- system2 4y ago
  There is no better alternative unfortunately.
  - fsflover 4y ago
    It depends on what is "better" for you. I'm happy with my Pinephone and waiting for my preordered Librem 5.
  - lern_too_spel 4y ago
    Even on Google-flavored Android devices, you don't have to use the Play Store if you don't want to. You don't have to use Google Maps if you don't want to. You don't have to send your location to Google if you don't want to. iOS is strictly worse than all the other alternatives I know of.
    - system2 4y ago
      I'd rather use Apple with their leaking than Google with their leaking, slowing down systems, and very high risk of malware infections.
      - lern_too_spel 4y ago
        The risk of malware is far higher on iOS than on a Google Android device, with Xcodeghost alone infecting more users than all others combined, and oft-exploited system apps like iMessage and Safari requiring a reboot to update. I don't know what you mean by leaks and slowing down (maybe https://www.npr.org/2020/11/18/936268845/apple-agrees-to-pay-113-million-to-settle-batterygate-case-over-iphone-slowdowns https://www.npr.org/2020/11/18/936268845/apple-agrees-to-pay...), but my point was exactly that this doesn't matter on most Android devices, including Google-flavored ones, because (unlike with iOS) you don't have to use Google's app store or maps or SMS app.
judge2020 4y ago
The actual claims via Twitter: https://twitter.com/mysk_co/status/1594515229915979776 https://twitter.com/mysk_co/status/1594515229915979776 I wonder what log they got this from; i'm scrubbing through both my latest `Analytics-X.ips.ca.synced` files and `AppStore-X.ips` file and can't find dsId. This is even with every 'Share Analytics' checkbox ticked in settings, besides Improve Health Records. Unfortunately the name of that log file is cropped out.
- askafriend 4y ago
  Isn't it odd that no one else has been able to replicate this researcher's findings? I'd imagine a bunch of others would run similar tests and come out in support of these findings. I highly suspect there's something off about this and I will wait for others to corroborate these findings (should be easy if there's actually substance here).
  - deleted 4y ago
    [deleted]
  - derefr 4y ago
    I've always been suspicious that there's extra, "latent" first-party instrumentation code in consumer OSes that, when activated, does some additional "innocuous-seeming" metrics-collection, along existing metrics-collection channels, but that is actually just barely enough to be identifiable (in a way that's only apparent if you're a security researcher and you think really hard about it); where this switch is either activated per-device during system updates or virus hot-scan pushes, or per user for cloud-connected user accounts by monitoring a policy flag on your cloud account; and where these mechanisms in turn are activated by state actors telling the OS manufacturer to do so, to then collect the resulting metrics and de-anonymize the device owner. I mean, it's what I'd do if I were Apple and/or Microsoft, and I knew that the US government was constantly compelling my employees through National Security Letters to do a bunch of extra off-the-books work to enable transparent one-off device-specific wiretaps. I'd productize that wiretap process, to get my employees' time back.
    - 4y ago
boplicity 4y ago
Apple is fundamentally transforming into an advertising company. The difference between them and ad companies such as Google is that, with Apple, advertising is baked into almost every single product. Every time you open the App store, you're opening a giant garden of advertisements. These ads are extremely lucrative to Apple. Every time you update the OS, it prompts you with ads to sign up with more services. Every time you open Apple News, the same thing happens: you're bombarded with ads to sign up for a premium subscription. When I still had an Apple laptop, it would constantly give me a popup asking me to signup for iCloud, even though I hadn't consciously ever used it. At nearly every turn, engaging with Apple software leads to profitable ads for Apple. (Usually in the form of direct subscriptions, or commission based advertising.) What do ad companies love? User data! This is as true for Apple as it is for Google. The difference: Apple has an iron grip on their advertisements like no other company in the world. This gives them the tools that let them pretend they're not an ad company. They are.
- quonn 4y ago
  So you think they need user data to display the ad for Apple Care+ and Apple TV? which they unconditionally display to anyone anyway? Those are the only two ads I have seen. Calling the app store an ad is really stretching the truth. It‘s a store, of course it displays the products that are for sale.
  - judge2020 4y ago
    The App Store itself has ads[0], but some changes might be in preparation for deeper ad integrations[1]. 0: https://searchads.apple.com/advanced https://searchads.apple.com/advanced 1: https://appleinsider.com/articles/22/11/14/apples-4b-ad-business-at-odds-with-internal-culture-and-values https://appleinsider.com/articles/22/11/14/apples-4b-ad-busi...
- askafriend 4y ago
  > Every time you open the App store, you're opening a giant garden of advertisements. Curation and Ads are very different. When you walk into a Target and see a curated set of products like bath towels, they're not Ads. In fact, customers pay more to shop at Target because of Target's ability to curate quality products consistently. Now the App Store does have Ads (mainly in search - one slot at the top). But it's far from a "giant garden every time you open it".
nayuki 4y ago
[2022-11-15] Louis Rossman - "Apple SUED for privacy violations; iOS collects invasive analytics even if you opt out." - https://www.youtube.com/watch?v=016QGxOsjQY https://www.youtube.com/watch?v=016QGxOsjQY [11 min]
Mattish 4y ago
I'm not one to jump infront of a bus for the big company, but the "testing" being reported on here is so incredibly lacking. - Single proof via a single device on a single OS version from a single API response. - Claim on the latest version it is doing the same, but can't prove it. Just that requests are being sent when you interact with the application(ok?) ...And that's it. I don't know the state of the jailbreaking scene, but a quick search seems to indicate that throughout 14.X and 15.X could have been checked, but they haven't. Would happily take this more seriously when reporting of issues is more sufficent. (or others proving more proof)
deleted 4y ago
[deleted]
_23sd 4y ago
This is about a request used to report a click in the app store, which is technically specified in the privacy policy [1] and you can get a CSV of it from Apple in data requests. This is the subject of a class action filed earlier this month [2]. While I think Apple's data collection within its apps is excessive, the only thing the researchers achieve by conflating it with device analytics is giving tech media an "Apple Lies!" headline cycle. People should be informed about how these analytics/surveillance systems work and how to effectively navigate and counter them, not be sold paranoia and the idea that the settings are always lying. They're misleading you with marketing, sure, but the truth in this case is written plainly in the prompt that pops up the first time you open the app store. [1] https://www.apple.com/legal/privacy/data/en/app-store/ https://www.apple.com/legal/privacy/data/en/app-store/, "We use information about your browsing, purchases, searches, and downloads. These records are stored with IP address, a random unique identifier (where that arises), and Apple ID" [2] https://news.bloomberglaw.com/litigation/apple-hit-with-class-action-over-tracking-of-mobile-app-activity https://news.bloomberglaw.com/litigation/apple-hit-with-clas...
- pbhjpbhj 4y ago
  >not be sold paranoia and the idea that the settings are always lying // Yeah, um, so if Apple et al. cared like you seem to, perhaps enough to stop lying, then that might be a first step towards people trusting them? You expect the weaker party to trust first before the stronger party even proves they're trustworthy!? >They're misleading you with marketing, sure [...] // They have no obligation to mislead. You want us to treat liars like they're angels.
  - _23sd 4y ago
    I don't think it's about trust. The easy availability of short-form privacy policies and data export requests are the result of legal requirements, ideally you should be able to rely on those disclosures even if you don't know enough about the company to trust or distrust it. In this case, the disclosures correctly showed that this kind of click data was being collected.
- shkkmo 4y ago
firefoxkekw 4y ago
It wasn't true even without the unique identifier, Apple can always correlated all the other data they sent to their servers to identified you. Most people thing of anonymity like a boolean when is most like a gradient, for example, Tor not only needs onion routing, it also need to to present each user to the net alike, that is why they configure their version of firefox in a specific way and even a simple thing like changing the resolution of the window make you less anonymous. Even in perfect conditions you still vulnerable to correlation attacks and if you are the US, you can probably just use network flow data to deanonymize an user, obviously to do it the resources and implications would be enormous. In the end is just a gradient of being anonymous to who? The ad conglomerate? A big state? It would be literally impossible with a standard iphone to be anonymous to Apple, is just PR by Apple.
jjtheblunt 4y ago
I wish i could filter {url} out of my HN rankings, for url in { Gizmodo, ... }.
- smoldesu 4y ago
  I agree, the Bloomberg article is much more thorough: https://news.bloomberglaw.com/litigation/apple-hit-with-class-action-over-tracking-of-mobile-app-activity https://news.bloomberglaw.com/litigation/apple-hit-with-clas...
oneplane 4y ago
I wouldn't be surprised if regardless of the methods users it can't truly be anonymous since that defeats the purpose. Even just compliance would result in resolvable data since you need to be able to request a copy of the data.
dang 4y ago
Related: Proposed class action alleges that Apple tracks users despite privacy assurances - https://news.ycombinator.com/item?id=33593455 https://news.ycombinator.com/item?id=33593455 - Nov 2022 (191 comments) App Store on iOS 14.6 sends every tap you make in the app to Apple - https://news.ycombinator.com/item?id=33520775 https://news.ycombinator.com/item?id=33520775 - Nov 2022 (190 comments)
- t0bia_s 4y ago
  Yet, there is not much comments in comparison of twitelon or meta. I guess there are a lot of Apple users among HN users?
  - deleted 4y ago
    [deleted]
shkkmo 4y ago
Why was the title changed away from the article headline? Few people know what a DSID is before reading the article so this seems designed to deliberately bury the lead.
tsuujin 4y ago
- deleted 4y ago
  [deleted]
- pvg 4y ago
  is anyone else sick to death Statistically everybody is which is why it's a topic boring enough to be avoided - from https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting.
natch 4y ago
Usually if there was actual guilty behavior, someone involved would shrink away quietly. Have any high-up Apple people, for instance, disabled their Twitter accounts since this was first revealed on Twitter? No.
IAmGraydon 4y ago
We need other researchers to duplicate this before it holds any weight. That said, I would also really like to know whether Mysk holds any AAPL short positions or put contracts.
privacyking 4y ago
This isn't news. It's been known for years and even published in the literature multiple times.

303 points by kelthuzad 4y ago

Why the ... I need to buy a pixel and install a niche operating system like GrapheneOS or CalyxOS to be at least a little safe with my privacy :/ btw. GrapheneOS is great!

godelski 4y ago

I'm honestly surprised we aren't seeing these big tech companies have an arms race with respect to homomorphic encryption. Since you can perform computations on the encrypted data itself this appears to be the best of both worlds: anonymous and still able to pull big data. Probably won't be able to serve as personalized ads, but from what I'm aware, the big data is far more important than the direct targeting. I know Meta is betting big on the Metaverse, but it's also wild to me that they similarly don't bet big here and keep their ad infrastructure. https://en.wikipedia.org/wiki/Homomorphic_encryption https://en.wikipedia.org/wiki/Homomorphic_encryption https://news.ycombinator.com/item?id=32987155 https://news.ycombinator.com/item?id=32987155

myaccount9786 4y ago
Apart from the fact that they have no incentive to, there are technical downsides, even assuming you could get a useful homomorphic scheme to work in practice. For example, encrypted data can't be compressed. Columnar big data systems rely heavily on that to be performant.
- godelski 4y ago
  > Apart from the fact that they have no incentive to They have huge incentives. Apple is positioning themselves as the privacy king. Meta has suffered huge losses because of their privacy abuses. Neither of these suggest no incentives. I'd argue that they suggest large incentives. The technical downsides are a fair critique though. But this also is where competition excels. Our machines are getting faster. Other algorithms have also gotten extremely faster and it would be naive to assume that homormorphic algorithms similarly don't. This is why I say an arms race.
  - wongarsu 4y ago
    Not to mention being able to keep processing data, while your competition gets squeezed by tightening regulations around the world.
    - godelski 4y ago
      The other thing is you could likely squeeze your competition out of the market. Countries are waking up to the implications of data harvesting and that it isn't only being used by themselves but their adversaries. So if a big company, like Apple, got it working, it would be much easier to lobby legislation that would harm (or kill) your competitors. (While I think we would all be better off if this happened, I do recognize that this same power can be abused and cause a significant disruption in the ecosystem. But I think it would also be extremely difficult to impossible to gain such an edge that others couldn't quickly adapt. Even if they drag their feet)
  - rocketbop 4y ago
    I wonder if there's new feature or improvement Apple could introduce that would actually increase their sales. It seems like at the moment people buy the new iPhone because 1/ they need/want a new phone, 2/ they want an iPhone, and 3/ they want the new iPhone. Apple know what they need to do to be successful, and that's continue to release updates to the iPhone that in a few small ways make it slightly better than the previous one.
  - YetAnotherNick 4y ago
    > They have huge incentives. Apple is positioning themselves as the privacy king I am willing to bet that it is a deal breaker only for very small minority of users. I would argue that search engine data is of much bigger privacy concern than OS, as compared to search history no OS action comes close in disclosing personal action, and google/bing almost has universal market presence even for Apple users. > Meta has suffered huge losses because of their privacy abuses. They had their revenue reduced, true. But it is not loss. They wouldn't be in any better position if they didn't used extra data when it was available.
  - AndriyKunitsyn 4y ago
NBJack 4y ago
Ads targeting is actually a huge motivation for ads platforms, IIRC; customers buying ads want to know if they work.
- godelski 4y ago
  Ad targeting is much broader than that though. Even with encrypted data you can match keys to profiles. You just don't know who that profile belongs to and you don't even need to know the contents of that profile. The whole point here is that you can treat the system like a black box but still work with it in a useful way.
- NayamAmarshe 4y ago
  Brave has proven that targeting is not always the best answer. They did an analysis on their own platform, their CTR is very very good and they do not compromise privacy in any way and still deliver ads (opt-in).
  - 8note 4y ago
    I assume brave shows mostly crypto adds? If so, the targeting is baked in
    - NayamAmarshe 4y ago
      Yes, mostly web3 projects but there are other advertisers as well. Like Twitch for example.
  - smoldesu 4y ago
    > They did an analysis on their own platform That's always how good studies start.
    - NayamAmarshe 4y ago
      Studies? This is CTR we're talking about. It doesn't have to be a research paper to show what's the average CTR, advertisers know it beforehand, they just made the info public. https://brave.com/brave-ads/casestudies/ https://brave.com/brave-ads/casestudies/
eyakubovich 4y ago
It's unclear when homomorphic encryption will be ready for prime time, especially at big tech scale. It's easier to give up the data under assurances of how exactly that data will be used. Secure enclaves (e.g. AWS nitro enclaves) can be used to offer cryptographic attestations as to what the code is doing with the user data. Practically speaking, an average user won't inspect the code, of course. But it does allow for other companies to audit and vouch for the usage.
fragmede 4y ago
as the a fan of homomorphic encryption I very much hear what you are saying (two examples I thought up https://news.ycombinator.com/item?id=32993163 https://news.ycombinator.com/item?id=32993163). But at the end of the day, there's no way to prove that Bob's Homomorphic Encryption SaaS company isn't "backing up" all your data into a regular database as well. And that's assuming Bob never gets hacked, too. At the end of the day, even with HE, we have to trust Bob to be trustworthy, and to have designed and implemented it totally correctly (or else data will leak in the clear). If it was Bob's small company then having a 3rd-party external auditor review the system would go a long way to gaining the public's trust, but unfortunately Meta has no such luxury. They could say they can't see your data until they were blue in the face, and they could even be telling the trust, but people don't currently believe they haven't sold your data (or the specific nuance there), so I'm not surprised they haven't made a large investment in HE. HE is also not quite there yet. It's ridiculously slow for anything but the most simple operations and Meta's data needs are far from simple.
- godelski 4y ago
  Yeah you make a really good point (especially with those two examples, which the latter might not even require data collection at all). But I do think that an arms race in this direction would change the public view. You'd sure have a lot fewer nerds like us arguing about privacy. Though we'd probably be arguing more for open source to lessen the trust issue. I don't think we'll ever have fully trust-less systems. But I do think there's a big difference between saying "trust us, we don't look at the data" vs "we encrypted the data and use this method, trust us that we aren't decrypting it". The former method is worse because there's a lot of people that have clear access to the data. The latter is better because there are more speed bumps and the argument is more sound. A lot of trust is built from demonstrating good faith efforts.
Terretta 4y ago
If it the concept that counts, not just that particular tech, some do "race" to get big data without compromising privacy, even when they don't have to (because no competitors are racing on the privacy dimension). For a survey, check out what firms are doing on "differential privacy" not just "homomorphic encryption". As a for instance, Apple -- since the OP is about them -- spent significant extra effort to make Maps anonymized. Concept: https://www.apple.com/privacy/docs/Differential_Privacy_Overview.pdf https://www.apple.com/privacy/docs/Differential_Privacy_Over... In Apple Maps: https://www.idownloadblog.com/2019/03/13/apple-maps-navigation-privacy/ https://www.idownloadblog.com/2019/03/13/apple-maps-navigati...
- smoldesu 4y ago
  Apple maps was based on OpenStreetMap originally, which actually tracked users less than the Apple Maps[0] app. Guess all that special work was for nothing. [0] https://www.apple.com/privacy/labels/ https://www.apple.com/privacy/labels/

kornhole 4y ago

system2 4y ago
There is no better alternative unfortunately.
- fsflover 4y ago
  It depends on what is "better" for you. I'm happy with my Pinephone and waiting for my preordered Librem 5.
- lern_too_spel 4y ago
  Even on Google-flavored Android devices, you don't have to use the Play Store if you don't want to. You don't have to use Google Maps if you don't want to. You don't have to send your location to Google if you don't want to. iOS is strictly worse than all the other alternatives I know of.
  - system2 4y ago
    I'd rather use Apple with their leaking than Google with their leaking, slowing down systems, and very high risk of malware infections.
    - lern_too_spel 4y ago
      The risk of malware is far higher on iOS than on a Google Android device, with Xcodeghost alone infecting more users than all others combined, and oft-exploited system apps like iMessage and Safari requiring a reboot to update. I don't know what you mean by leaks and slowing down (maybe https://www.npr.org/2020/11/18/936268845/apple-agrees-to-pay-113-million-to-settle-batterygate-case-over-iphone-slowdowns https://www.npr.org/2020/11/18/936268845/apple-agrees-to-pay...), but my point was exactly that this doesn't matter on most Android devices, including Google-flavored ones, because (unlike with iOS) you don't have to use Google's app store or maps or SMS app.

judge2020 4y ago

The actual claims via Twitter: https://twitter.com/mysk_co/status/1594515229915979776 https://twitter.com/mysk_co/status/1594515229915979776 I wonder what log they got this from; i'm scrubbing through both my latest `Analytics-X.ips.ca.synced` files and `AppStore-X.ips` file and can't find dsId. This is even with every 'Share Analytics' checkbox ticked in settings, besides Improve Health Records. Unfortunately the name of that log file is cropped out.

askafriend 4y ago
Isn't it odd that no one else has been able to replicate this researcher's findings? I'd imagine a bunch of others would run similar tests and come out in support of these findings. I highly suspect there's something off about this and I will wait for others to corroborate these findings (should be easy if there's actually substance here).
- deleted 4y ago
  [deleted]
- derefr 4y ago
  I've always been suspicious that there's extra, "latent" first-party instrumentation code in consumer OSes that, when activated, does some additional "innocuous-seeming" metrics-collection, along existing metrics-collection channels, but that is actually just barely enough to be identifiable (in a way that's only apparent if you're a security researcher and you think really hard about it); where this switch is either activated per-device during system updates or virus hot-scan pushes, or per user for cloud-connected user accounts by monitoring a policy flag on your cloud account; and where these mechanisms in turn are activated by state actors telling the OS manufacturer to do so, to then collect the resulting metrics and de-anonymize the device owner. I mean, it's what I'd do if I were Apple and/or Microsoft, and I knew that the US government was constantly compelling my employees through National Security Letters to do a bunch of extra off-the-books work to enable transparent one-off device-specific wiretaps. I'd productize that wiretap process, to get my employees' time back.
  - 4y ago

boplicity 4y ago

Apple is fundamentally transforming into an advertising company. The difference between them and ad companies such as Google is that, with Apple, advertising is baked into almost every single product. Every time you open the App store, you're opening a giant garden of advertisements. These ads are extremely lucrative to Apple. Every time you update the OS, it prompts you with ads to sign up with more services. Every time you open Apple News, the same thing happens: you're bombarded with ads to sign up for a premium subscription. When I still had an Apple laptop, it would constantly give me a popup asking me to signup for iCloud, even though I hadn't consciously ever used it. At nearly every turn, engaging with Apple software leads to profitable ads for Apple. (Usually in the form of direct subscriptions, or commission based advertising.) What do ad companies love? User data! This is as true for Apple as it is for Google. The difference: Apple has an iron grip on their advertisements like no other company in the world. This gives them the tools that let them pretend they're not an ad company. They are.

quonn 4y ago
So you think they need user data to display the ad for Apple Care+ and Apple TV? which they unconditionally display to anyone anyway? Those are the only two ads I have seen. Calling the app store an ad is really stretching the truth. It‘s a store, of course it displays the products that are for sale.
- judge2020 4y ago
  The App Store itself has ads[0], but some changes might be in preparation for deeper ad integrations[1]. 0: https://searchads.apple.com/advanced https://searchads.apple.com/advanced 1: https://appleinsider.com/articles/22/11/14/apples-4b-ad-business-at-odds-with-internal-culture-and-values https://appleinsider.com/articles/22/11/14/apples-4b-ad-busi...
askafriend 4y ago
> Every time you open the App store, you're opening a giant garden of advertisements. Curation and Ads are very different. When you walk into a Target and see a curated set of products like bath towels, they're not Ads. In fact, customers pay more to shop at Target because of Target's ability to curate quality products consistently. Now the App Store does have Ads (mainly in search - one slot at the top). But it's far from a "giant garden every time you open it".

nayuki 4y ago

[2022-11-15] Louis Rossman - "Apple SUED for privacy violations; iOS collects invasive analytics even if you opt out." - https://www.youtube.com/watch?v=016QGxOsjQY https://www.youtube.com/watch?v=016QGxOsjQY [11 min]

Mattish 4y ago

I'm not one to jump infront of a bus for the big company, but the "testing" being reported on here is so incredibly lacking. - Single proof via a single device on a single OS version from a single API response. - Claim on the latest version it is doing the same, but can't prove it. Just that requests are being sent when you interact with the application(ok?) ...And that's it. I don't know the state of the jailbreaking scene, but a quick search seems to indicate that throughout 14.X and 15.X could have been checked, but they haven't. Would happily take this more seriously when reporting of issues is more sufficent. (or others proving more proof)

deleted 4y ago

[deleted]

_23sd 4y ago

This is about a request used to report a click in the app store, which is technically specified in the privacy policy [1] and you can get a CSV of it from Apple in data requests. This is the subject of a class action filed earlier this month [2]. While I think Apple's data collection within its apps is excessive, the only thing the researchers achieve by conflating it with device analytics is giving tech media an "Apple Lies!" headline cycle. People should be informed about how these analytics/surveillance systems work and how to effectively navigate and counter them, not be sold paranoia and the idea that the settings are always lying. They're misleading you with marketing, sure, but the truth in this case is written plainly in the prompt that pops up the first time you open the app store. [1] https://www.apple.com/legal/privacy/data/en/app-store/ https://www.apple.com/legal/privacy/data/en/app-store/, "We use information about your browsing, purchases, searches, and downloads. These records are stored with IP address, a random unique identifier (where that arises), and Apple ID" [2] https://news.bloomberglaw.com/litigation/apple-hit-with-class-action-over-tracking-of-mobile-app-activity https://news.bloomberglaw.com/litigation/apple-hit-with-clas...

pbhjpbhj 4y ago
>not be sold paranoia and the idea that the settings are always lying // Yeah, um, so if Apple et al. cared like you seem to, perhaps enough to stop lying, then that might be a first step towards people trusting them? You expect the weaker party to trust first before the stronger party even proves they're trustworthy!? >They're misleading you with marketing, sure [...] // They have no obligation to mislead. You want us to treat liars like they're angels.
- _23sd 4y ago
  I don't think it's about trust. The easy availability of short-form privacy policies and data export requests are the result of legal requirements, ideally you should be able to rely on those disclosures even if you don't know enough about the company to trust or distrust it. In this case, the disclosures correctly showed that this kind of click data was being collected.
shkkmo 4y ago

firefoxkekw 4y ago

It wasn't true even without the unique identifier, Apple can always correlated all the other data they sent to their servers to identified you. Most people thing of anonymity like a boolean when is most like a gradient, for example, Tor not only needs onion routing, it also need to to present each user to the net alike, that is why they configure their version of firefox in a specific way and even a simple thing like changing the resolution of the window make you less anonymous. Even in perfect conditions you still vulnerable to correlation attacks and if you are the US, you can probably just use network flow data to deanonymize an user, obviously to do it the resources and implications would be enormous. In the end is just a gradient of being anonymous to who? The ad conglomerate? A big state? It would be literally impossible with a standard iphone to be anonymous to Apple, is just PR by Apple.

jjtheblunt 4y ago

I wish i could filter {url} out of my HN rankings, for url in { Gizmodo, ... }.

smoldesu 4y ago
I agree, the Bloomberg article is much more thorough: https://news.bloomberglaw.com/litigation/apple-hit-with-class-action-over-tracking-of-mobile-app-activity https://news.bloomberglaw.com/litigation/apple-hit-with-clas...

oneplane 4y ago

I wouldn't be surprised if regardless of the methods users it can't truly be anonymous since that defeats the purpose. Even just compliance would result in resolvable data since you need to be able to request a copy of the data.

dang 4y ago

Related: Proposed class action alleges that Apple tracks users despite privacy assurances - https://news.ycombinator.com/item?id=33593455 https://news.ycombinator.com/item?id=33593455 - Nov 2022 (191 comments) App Store on iOS 14.6 sends every tap you make in the app to Apple - https://news.ycombinator.com/item?id=33520775 https://news.ycombinator.com/item?id=33520775 - Nov 2022 (190 comments)

t0bia_s 4y ago
Yet, there is not much comments in comparison of twitelon or meta. I guess there are a lot of Apple users among HN users?
- deleted 4y ago
  [deleted]

shkkmo 4y ago

Why was the title changed away from the article headline? Few people know what a DSID is before reading the article so this seems designed to deliberately bury the lead.

tsuujin 4y ago

deleted 4y ago
[deleted]
pvg 4y ago
is anyone else sick to death Statistically everybody is which is why it's a topic boring enough to be avoided - from https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting.

natch 4y ago

Usually if there was actual guilty behavior, someone involved would shrink away quietly. Have any high-up Apple people, for instance, disabled their Twitter accounts since this was first revealed on Twitter? No.

IAmGraydon 4y ago

We need other researchers to duplicate this before it holds any weight. That said, I would also really like to know whether Mysk holds any AAPL short positions or put contracts.

privacyking 4y ago

This isn't news. It's been known for years and even published in the literature multiple times.