3 ms·

Why do you think fingerprinting is hard? It’s truly not — the OS sandbox is nowhere near as restrictive as, say, a browser sandbox. Moreover, if Apple is forc

Why do you think fingerprinting is hard? It’s truly not — the OS sandbox is nowhere near as restrictive as, say, a browser sandbox. Moreover, if Apple is forced to open the platform to third-party app stores, identifying unique users in collusion with the third-party app store is incredibly easy.

lcnPylGDnU4H9OF 3y ago
> Why do you think fingerprinting is hard? They did manage to answer this question in their comment. It’s the entire last sentence. (It also seems fairly well implied that they mean “iOS fingerprinting is currently hard” given the topic of discussion.) I don’t see how I could reliably fingerprint if so many APIs require user permission. It might be possible but I don’t see easy.
- catiopatio 3y ago
  iOS isn’t as sandboxed as they claim. From IOKit to getifaddrs() to file system APIs, there are straightforward ways to uniquely identify a device — and I’m sure someone who actually works in this space can think of quite a few more. Hell, even if you make it a hard problem and sandbox every possible source of unique information about the device, I’m sure Google would be happy to throw ML engineers at identifying users via impossible-to-obscure user information (keyboard timings, accelerometer readings, etc). Preventing misuse of PII requires a policy/legal solution, not a technical one.
  - grishka 3y ago
    That's the thing, all these holes need to be identified and plugged up. Google, despite being a data-hungry targeted advertising company, did a fairly good job at this in recent Android versions. Or, a much, much simpler solution: an application firewall built into the system. With downloadable easily shareable rulesets. No matter what an app collects, it's all worthless if it can't send that back to advertisers. We already do that for websites by using ad blockers.
    - catiopatio 3y ago
      You really, truly, cannot close all the holes necessary to prevent fingerprinting while still providing a useful general purpose OS. You especially cannot achieve this while providing third parties access to what has traditionally been vendor-only API on mobile devices; e.g. to support third-party app stores. This simply is not solvable through technical means. It must be solved through policy and law.
    - nemothekid 3y ago
      >No matter what an app collects, it's all worthless if it can't send that back to advertisers. We already do that for websites by using ad blockers. Using an application firewall to prevent the facebook app from sending tracking data backing to facebook?
      - grishka 3y ago
        Facebook app can, of course, send its tracking data back to Facebook, but it will only be able to track what you do within Facebook itself. That's fair and that can't be prevented. I'm talking specifically about cross-app and cross-site tracking.

lcnPylGDnU4H9OF 3y ago

> Why do you think fingerprinting is hard? They did manage to answer this question in their comment. It’s the entire last sentence. (It also seems fairly well implied that they mean “iOS fingerprinting is currently hard” given the topic of discussion.) I don’t see how I could reliably fingerprint if so many APIs require user permission. It might be possible but I don’t see easy.

catiopatio 3y ago
iOS isn’t as sandboxed as they claim. From IOKit to getifaddrs() to file system APIs, there are straightforward ways to uniquely identify a device — and I’m sure someone who actually works in this space can think of quite a few more. Hell, even if you make it a hard problem and sandbox every possible source of unique information about the device, I’m sure Google would be happy to throw ML engineers at identifying users via impossible-to-obscure user information (keyboard timings, accelerometer readings, etc). Preventing misuse of PII requires a policy/legal solution, not a technical one.
- grishka 3y ago
  That's the thing, all these holes need to be identified and plugged up. Google, despite being a data-hungry targeted advertising company, did a fairly good job at this in recent Android versions. Or, a much, much simpler solution: an application firewall built into the system. With downloadable easily shareable rulesets. No matter what an app collects, it's all worthless if it can't send that back to advertisers. We already do that for websites by using ad blockers.
  - catiopatio 3y ago
    You really, truly, cannot close all the holes necessary to prevent fingerprinting while still providing a useful general purpose OS. You especially cannot achieve this while providing third parties access to what has traditionally been vendor-only API on mobile devices; e.g. to support third-party app stores. This simply is not solvable through technical means. It must be solved through policy and law.
  - nemothekid 3y ago
    >No matter what an app collects, it's all worthless if it can't send that back to advertisers. We already do that for websites by using ad blockers. Using an application firewall to prevent the facebook app from sending tracking data backing to facebook?
    - grishka 3y ago
      Facebook app can, of course, send its tracking data back to Facebook, but it will only be able to track what you do within Facebook itself. That's fair and that can't be prevented. I'm talking specifically about cross-app and cross-site tracking.