13 ms·
Apple Has Started Rejecting Apps That Access UDIDs Amid Privacy Concerns
- epistasis 15y agoThis is a very good thing. The tech industry has taken privacy far too lightly, and it has the potential to be a really big deal. If a random person off the street knew what Facebook and ad networks knew about them in terms of income, product usage, et al, they'd most likely be extremely creeped out. This needs to be nipped in the bud before it has the potential to affect the entire industry.
- jballanc 15y agoI'm sorry, but this solution is very much cart before the horse. I think many people have woken up in a world where most of the "free" stuff they enjoy on a daily basis necessarily requires the ability to identify them on an individual basis. I fear people will either have to learn to live with tracking and profiling as a part of everyday life, or they will have to get comfortable with the idea of paying for more of the stuff they use. Rejecting apps for accessing UDIDs does nothing to solve the underlying problem...
- palish 15y agoOk. I choose "pay more for the stuff I use".
- dhbanes 15y agoGood. Now the goal is to get people (in the aggregate) to do so.
- fauigerzigerk 15y agoFirst of all, service providers have to give me a choice. Even if they offer a paid subscription it doesn't automatically mean they don't store personal information about me. These things would have to be part of the contract and I haven't seen many such contracts. Right now, I don't feel I have any other choice but to block the trackers as aggressively as possible. I hope there will be better solutions in the future, because I really want to pay for services I like.
- gyardley 15y agoOh? Can I demand subscription services offer me an ad-supported version because I don't want to pay the monthly fee? After all, these service providers 'have to give me a choice'. No one has to give you anything. Where does your sense of entitlement come from? If you don't like the way a service is offered, your other choice is not to use it.
- fauigerzigerk 15y agoYou seem to have missed the parent posts. I'm not saying unconditionally that service providers have to give me a particular choice. Of course they don't have to. What I'm saying is that IF I am to choose option X that option has to be available to me, otherwise I cannot possibly choose it. And most of the time it is not available.
- gyardley 15y agoYep, you're right - glossed over too much of the grey in the thread. Sorry for the early-morning invective.
- wtn 15y agoThey want you to use iCloud to identify people. Makes more sense anyhow, since UDID's are hardware-dependent.
- throwaway64 15y agoplease stop spreading this false dichotomy, advertising existed before every move you made was tracked, and it was quite profitable. There is zero reason that such invasive bullshit is a requirement, period.
- jballanc 15y agoAdvertising has always been targeted, but lately consumers have been making it more and more difficult for advertisers to do so. Compare the number of magazines, television shows, radio stations, or highway routes to the number of websites or apps available today. When most of your target demographic reads the same 5 magazines or watches the same couple dozen television shows, targeting is easy. Now that everyone has the ability to, essentially, plot their own course through consumable media and entertainment, targeting must follow suit.
- superuser2 15y agoBefore every move you made was tracked, there were only a handful of companies that could deliver ads to people: a few TV stations, a few radio stations, and one local paper. The Yellow Pages. Maybe some billboards. More competition and greater accountability (you can't really measure conversion rates for TV ads) means advertising services have to be more effective. Showing people ads for things they actually want is the best way to go about that. Facebook et al do not owe you ANYTHING. The anti-tracking crowd seems to feel it's entitled to services while providing nothing of value in exchange. That's not how the market works. Your attention alone isn't worth much if a website can't show you ads you're likely to act on. I don't like it either, which is why I run AdBlock and pay for things that are valuable to me - NYTimes, New Yorker, local paper, and phone (nothing sensitive on GMail so I don't care). As the saying goes, you're not the customer, you're the product.
- pyre 15y agoSo all of this tracking is only necessary due to the web? What about retailers such as Target or Walmart? Their weekly fliers have been around longer than the web, yet they too are tracking us as much as they can in order to target their advertising. This has nothing to do with there being too many channels to choose from.
- tomjen3 15y agoSo Zynga goes banckrupt? Let me see where I put that timy violin...
- Xuzz 15y agoSadly, this all could have been avoided with one simple change four years ago: rather than having the UDID match the specific device, have it be hash of the app's "keychain identifier" (usually set at the company level, enabling cross-product identification) and the real UDID. Then, it doesn't matter if an app finds out the UDID it can access: it's specific to that app or company anyway, and can't be abused as it currently is. But as the UDID was implemented poorly (and immediately overused for everything, including from server-side account keying, which Apple can't just break), they have to essentially remove it now.
- stcredzero 15y agoSo, are you saying that now, we >can't< use the hash(UDID+keychain_id)? EDIT: On 2nd thought, isn't hash(UDID+keychain_id) almost as bad as just squirting UDID over the network anyhow?
- Xuzz 15y agoI'm talking about Apple, not about developers. If Apple had returned SHA1(KeychainID + UDID) instead of just UDID when the SDK was released, then apps would never have seen the "real" UDID, and we wouldn't have this issue now. However, since Apple did not do that and they can't change the UDID now (for a variety of reasons, including various abuses of it by developers), it's too late for them to fix it now with such a simple change.
- shangrila 15y agoThey certainly could still add a new API which does something along the lines of what you describe while still deprecating the UDID API. The only real catch is that they'd had have to do it in such a way as to make it difficult to figure out the un-hashed UDID from the value they give you. It's certainly possible to do that, though. For example, instead of hashing the UDID along with the keychain identifier, they could hash it along some other app-specific or vendor-specific info which only Apple knows and is not shared with developers.
- pagekalisedown 15y agoIf you want to switch to using MAC addresses, look up getifaddrs().
- saurik 15y agoThe fact that this seems to be entirely legitimate entirely undermines the point of removing the UDID.
- irons 15y ago"The point" is to make Congress stop yelling at Apple. Forcing developers to jury-rig something other than a system API gives them an out, rhetorically.
- saurik 15y agoI find the word "jury-rigged" to be a stretch for "get the MAC address". There is no difference between the BSD API to get the MAC address and the Cocoa API to get the UDID; maybe to a software historian, but certainly not to a member of Congress: the level of explanation you are looking at there is "a mechanism supported by the vendor that returns a unique identifier for the device".
- uuilly 15y agoYikes. We have a version awaiting review that migrates us off udids. We need the udid for one last login before they get an oauth token. Perhaps we will get lucky and apple won't test a migration bc fresh installs don't use it. This really sucks, we were following the rules and they changed the schedule.
- SquareWheel 15y agoThat's unfortunate, I hope things work out for you. To other developers, this is an inherent risk of working under somebody else's rules. Open platforms like the web are in constant flux, but won't reject you for political/monetary reasons.
- stcredzero 15y agoTo other developers, this is an inherent risk of working under somebody else's rules. Yes, but the alternative might be something like a cesspool of everybody squirting out their UDID either in plaintext or using encryption with an easily findable key in the app -- resulting in lots of counterfeiting of UDIDs and potentially lots of bad things enabled by that.
- SquareWheel 15y agoYou're right, there are pros and cons to both approaches. The web isn't perfect. Personally what I'd like to see is a system like webintents.org taking off. I way of linking sites through services, not just hyperlinks.
- calloc 15y agoIf you do have issues maybe you can use that justification in an attempt to get it passed anyway.
- stock_toaster 15y agoI hear it is only a percentage of apps being rejected so far (some percentage of the approval team being told to check/reject apps using UDID calls). So, you might make it through anyway.
- deleted 15y ago[deleted]
- jakejake 15y agoI'm sure there is a backdoor... for iAds. I can't imagine why they would have any interest in helping other ad networks.
- forrestthewoods 15y agoAre iAds popular? In 3+ years of owning an iPhone I'm not sure I have ever seen one in the wild. I've used a fair number of free apps that have ads but not a single one of them used iAds.
- fpgeek 15y agoNo, iAds aren't popular (Apple is more secretive about iAds revenue than Google is about the Android Market... I mean the Google Play Store). But then neither is the iBookstore and Apple keeps plugging away at it (and their competition) nevertheless.
- objclxt 15y agoI think the key difference between iBooks and iAds is that there is at least some demand from users for the former - some people buy iPads to primarily use as eReaders, whereas nobody is buying iPads to look at iAds.
- jeremyflores 15y agoA nifty replacement category: https://github.com/gekitz/UIDevice-with-UniqueIdentifier-for-iOS-5 https://github.com/gekitz/UIDevice-with-UniqueIdentifier-for.... It generates a different token than the UDID, so you will have to migrate users.
- goronbjorn 15y agoDoes this mean anything for companies that do device management? It seems like most enterprise apps are logging some kind of device id.
- aritraghosh007 15y agoThis company AppsFire is coming up with an alternative standard http://techcrunch.com/2011/09/01/appsfire-announces-open-source-udid-replacement-for-ios-openudid/ http://techcrunch.com/2011/09/01/appsfire-announces-open-sou...
- kingnothing 15y agoEverything I've seen about push notifications relies on the device id. How do you do push without having the udid?
- mpakes 15y agoPush notifications use a device token that is separate from the UDID. An app can only get access to the device token if the user enables push notifications for that app.
- deleted 15y ago[deleted]
- startupcto 15y agoIf indeed UDID is still available down at the OS level, which iAd is working at, then wouldn't this be anti-competitive and ad networks has a shot of getting Apple for it?
- jakeludington 15y agoThe UDID issue isn't about Apple controlling the ad market (though that may be a benefit). They are getting pressure from congress about the perceived privacy issues. There are single SDK solutions like Mobile App Tracking that don't require UDID, allow the app developer to own their data, and provide a viable alternative to the current state of tracking via UDID.
- startupcto 15y agoI take issue to this and it's because iAd is probably using the same approach tracking users. There is no known way to track users across applications ( applications released by the same company ). Again I take issue to iAd and if iAd is only the service that has access/ability to track users, isn't there an anti-competition conduct.
- SeoxyS 15y agoThis has one major implication: killing ad networks. Or, more specifically, killing ad targeting and CPA. Advertising is not going away. Let's face it, people are just not willing to pay when it comes to the type of games that are popular on the iPhone. That's in large part a result of the race-to-the-bottom environment Apple created with App Store. Advertising is what makes this economy work. Whether it's ultimately a good thing or not to kill advertising is a debate I'm not going into (tho, I'd personally err on the side of it being a good thing long term). But, good ad targeting and CPA has the effect of improving the ad experience for everybody: making more money, and seeing more relevant ads. Admittedly, I'm biased since I'm part of a mobile advertising startup, but I think Apple fucked up here. Having a way to uniquely identify a device across apps is very important. I'd suggest creating a unique identifier on device installation, and formatting the device would reset a new identifier. I know for a fact that if we were to play by Apple's rules, and this goes through, we're going to be very hurt by this change.
- demallien 15y agoThis has one major implication: killing ad networks. Or, more specifically, killing ad targeting and CPA. I for one won't be shedding any tears - as a woman that spends a lot of time on tech (and hence nominally male) websites, I am decidedly over getting ads for dating sites telling me how I'll be able to hook up with young women with no complexes... Another classic - I hang out on some atheist sites, so of course I'm vitally interested in some Christian alpha course or what not - after all, I spend time on sites talking about religion, don't I? The model is flawed. I find that so called targeted ads are almost entirely out of phase with my interests, almost comically so. That being the case, I'd rather not be giving unknown people the ability to more easily monitor my online behaviour.
- gyardley 15y agoThis is completely backwards - you're complaining about untargeted ads, based only on the rough context of the page you're on. Properly-targeted ads would know you're a) female and b) an atheist and show appropriate advertising if any was available. Removing the UDID does nothing to prevent the type of ads you're complaining about - they work off of context, and context is always available to the ad server - but it does prevent ad targeting from getting better.
- msh 15y agoBut you still need the uuid for push messages, so how are they handling that?
- cmelbye 15y agoPush notifications do not use UDID, they use a different device token.
- nullflux 15y agoThis seems to me to be something that should have been issued as an OS-level patch. Apple could prevent a lot of these issues by using an application-specific UDID generated by the device. Hash the UDID with a random salt generated from entropy on the device, and use it only for that app install. Developers then couldn't track you from install to install, or across their application ecosystems. Privacy issue averted. Any existing calls that hundreds of thousands of applications make to currently get the UDID just return this application-specific one instead.
- Jyaif 15y agoThey can't patch the OS because some applications rely on the UDID being constant. For example, some games check if the scores/progress are real by storing a hash of the scores and the UDID. This allows the dev to check that the scores/progress file wasn't downloaded from internet. Changing the UDID would make the application think that the scores were tampered with.
- gmac 15y agoBut they could change the kind of UDID returned to apps installed after the OS update. That seems like a reasonable compromise?
- rbarooah 15y agoAs pointed out in the article, they warned us about this more than 6 months ago. Changing up the timetable isn't great, but there's not much reason for people to be 'scrambling' to figure out what to do.
- Revisor 15y agoHow does the ability to get the UDID combine with the (recently leaked) silent ability to access and upload the whole contact directory on iOS?
- ludflu 15y agoi hope they dont kill TestFlight
- bri3d 15y agoTestFlight uses a device enrollment challenge to get your device identifier, not native code. There's no native code in TestFlight - that's why it's not in the App Store and hence can't get rejected. It's just a clever use of Apple's remote provisioning capabilities (originally designed for enterprise customers). So this change both can't and won't kill TestFlight - the only way Apple could kill TestFlight would be to change the way their enterprise provisioning and OTA installation process works, which they have no incentive to do as the process requires very explicit user permission, isn't being probed by lawmakers, and makes them that much more attractive to enterprises.
- Sujan 15y agoAre there any other sources on this? This Techcrunch article sounds a lot like hearsay to me, especially the part about the review teams.