5 ms·

> de-anonymize Where by "de-anonymize" they actually mean "detect what region the user's Apple ID is set to". The fingerprinting value of this is pretty weak,

> de-anonymize Where by "de-anonymize" they actually mean "detect what region the user's Apple ID is set to". The fingerprinting value of this is pretty weak, especially since, in most cases, it'll be the same as the country inferred from the user's IP. It's also trivial for Apple to mitigate if they consider it to be an issue -- they can make the banner appear regardless of whether the app is available to the user.

a_vanderbilt 4y ago
Definitely a click-bait title. I'd argue the IP alone gives you even more useful information.
tinus_hn 4y ago
I presume they also allow you to detect if you have the app installed or not.
- jaywalk 4y ago
  No, the banner shows up either way and the size of the banner doesn't change based on whether the app is installed or not. So there's no way to determine whether or not the app is installed using this method.
  - tinus_hn 4y ago
    I thought a web page could take a screenshot of itself which would include the banner, but apparently that’s a complete new rendering.
mikeortman 4y ago
Your Apple ID country has a lot of implications if changed (certain app access will be available/restricted, payment methods, etc). You aren't going to be able to identify a user specifically, but you could detect if a user is currently traveling internationally or may be a frequent VPN user.
- anamexis 4y ago
  This is the case anyways with the user’s IP.
  - Nextgrid 4y ago
    The problem is that combining the two would actually give you significantly more information than either individual datapoint. A mismatch between Apple ID region and IP region will very reliably identify a subset of users (either expats or travellers).
    - hinkley 4y ago
      Or VPN users, which is still relatively small.
dang 4y ago
Ok, we've changed the title to reflect that. Thanks! (and thanks also to the user who emailed this suggestion to hn@ycombinator.com)

a_vanderbilt 4y ago

Definitely a click-bait title. I'd argue the IP alone gives you even more useful information.

tinus_hn 4y ago

I presume they also allow you to detect if you have the app installed or not.

jaywalk 4y ago
No, the banner shows up either way and the size of the banner doesn't change based on whether the app is installed or not. So there's no way to determine whether or not the app is installed using this method.
- tinus_hn 4y ago
  I thought a web page could take a screenshot of itself which would include the banner, but apparently that’s a complete new rendering.

mikeortman 4y ago

Your Apple ID country has a lot of implications if changed (certain app access will be available/restricted, payment methods, etc). You aren't going to be able to identify a user specifically, but you could detect if a user is currently traveling internationally or may be a frequent VPN user.

anamexis 4y ago
This is the case anyways with the user’s IP.
- Nextgrid 4y ago
  The problem is that combining the two would actually give you significantly more information than either individual datapoint. A mismatch between Apple ID region and IP region will very reliably identify a subset of users (either expats or travellers).
  - hinkley 4y ago
    Or VPN users, which is still relatively small.

dang 4y ago

Ok, we've changed the title to reflect that. Thanks! (and thanks also to the user who emailed this suggestion to hn@ycombinator.com)