4 ms·

There's something really appalling that I discovered lately and I can't believe there isn't enough uproar about it. Every attempt to talk about this gets ignore

There's something really appalling that I discovered lately and I can't believe there isn't enough uproar about it. Every attempt to talk about this gets ignored or buried (maybe by people who want this ""feature"" to be kept quiet) so I will take every opportunity on existing discussions about Facebook to bring it up: Facebook (and TikTok) store tracking data on iOS that the user CANNOT SEE and CANNOT DELETE: • It shows my previous account even after I delete the app. • Clearing Safari's cache does not work. • Disabling iCloud Drive and iCloud Keychain does not work. • Even completely signing out of iCloud does not work! • On a Mac in the Terminal, you can go to ~/Library/Mobile Documents and "ls -al" to see hidden folders like "iCloud~com~Facebook~Messenger" that you cannot otherwise view or delete. • Someone mentioned that even RESTORING an iCloud BACKUP will resurrect these "eternal cookies"!! ---- WHERE do they store this data? WHY can't the user see this data? WHY can't the user delete this data without going through the app? WHAT ELSE do apps store on our devices that we aren't even aware of? (This is just what we can see: The list of saved accounts for "quick login") HOW MANY other apps are secretly doing this? WHY does Apple, parading around as a pompous paragon of privacy, even allow this in the first place??

HumblyTossed 3y ago
This is nuts. There should be a grand total of zero files on my personal computing device that I cannot remove (no matter the consequences).
- redeeman 3y ago
  then you have chosen the wrong platform. Just be grateful that the mighty apple even deems you worthy of having files
  - Razengan 3y ago
    Android's security was way worse for years. How long did they even take before having granular permissions or a Privacy Report, if they do now at all?
    - redeeman 3y ago
      uhm, they had different permissions granularized, in some ways worse than apple, some ways better. but i was not talking security
- threeseed 3y ago
  You can remove every file on your Mac. And there are no eternal tracking cookies for Safari even first party ones are deleted every week.
- ants_everywhere 3y ago
  This seems fundamentally at odds with Apple's philosophy that they're providing you a rented appliance they control and which you have temporary access to. I'm sure you can remove most and/or all Mac OS files, but they're increasingly using trusted computing and even designing their own chips to increase the control they have over the devices (and correspondingly limit user control). They sell this as a security feature these days, but the appliance model predates that and security is kind of just along for the ride. I'm glad to see that people feel strongly that they should have control over the files on their system. I'd like to see that help move us toward users having full control over their computers.
darklion 3y ago
> WHY does Apple, parading around as a pompous paragon of privacy, even allow this crap? Good alliteration. Apple doesn’t enforce what the app does with app data. Apple makes sure that if the app uses a platform API that is sensitive, it gets your opt-in (or prohibits the use of the API altogether). Apple makes sure that the app publishes a privacy nutrition label. But what the app does inside with whatever data you choose to give it, that’s up to the app. If you voluntarily choose to give data to the app, what the app does with it is your problem. Apple just tries to make sure the app can’t take data that you haven’t chosen to give it.
- lxgr 3y ago
  That would be a nice solution, but there is no "allow app to persist data beyond deletion/reinstall" user-grantable permission on iOS.
- Razengan 3y ago
  There is no indication whatsoever that an app will leave behind an Eternal Cookie on my device, nor am I given a chance to prevent it.
quadhome 3y ago
It’s stored in your keychain. Disabling the iCloud keychain doesn’t clear your local copy.
threeseed 3y ago
Not sure why you are using this thread as technical support. Or what tracking data you are referring to ie. is it cookies or local storage but either way you should maybe speak to Apple Support. Yes iOS apps can store local data and if you're unhappy about it then just delete or reinstall the app.
- lxgr 3y ago
  > just delete or reinstall the app. Well, that doesn't delete all local data. That's exactly the problem!
alexsereno 3y ago
Hey I can shed light on this. It’s the iCloud keychain. Disabling the keychain doesn’t delete existing entries. There is no way to modify the keychain on iOS (you can on Mac). Lots of apps store sign on data in the keychain for obvious reasons. It would be really great to have a keychain section in iOS’s settings, like Keychain Access on Mac. The dev can build in-app functionality to delete keys from the keychain, but there’s not a huge incentive to. Keychain storage doesn’t let FB track you, just store sign on info, keys, and the like. It’s not able to execute arbitrary code, it’s an encrypted place to store login info that Apple syncs between your devices. Use them via Safari if you don’t want this (then your logins are saved & synced in Safaris keychain.)
- threeseed 3y ago
  You can add/delete entries in the iOS keychain from the Passwords section. And I am looking at my iPhone now and Meta does not store tracking data in the Keychain.
  - alexsereno 3y ago
    You certainly can not, here's some more info. Passwords and the keychain are separate items. https://apple.stackexchange.com/questions/441112/how-can-i-remove-keychain-data-from-ios https://apple.stackexchange.com/questions/441112/how-can-i-r...
- discostrings 3y ago
  It's not specific to iCloud Keychain--it applies to on-device Keychain on iOS devices, too, even if you don't use iCloud. Any developer can store data there with no way for the user to know or see what it's saving, and it's shared among all apps from the same developer. Keychain is quite a misnomer here--it's really "store any (short) data you want on a user's device without them ever being able to see or remove it". It transfers when you restore backups on new devices, too, even if you haven't had the developer's apps installed in the last decade. This is an issue because if you ever use an app by a company, uninstall all their apps, and then install one of the developer's apps years later, they can tell it's the same iOS profile (even restored on a different device), profile what you do across those apps/installs/decades, and associate any accounts you log in with. Essentially they can put a permanent cookie that you can't even see on your iOS profile that's shared between their apps. If you use iCloud Keychain, they can probably profile you across all your devices regardless of whether you reset one. Apple has said this isn't intended functionality and they were going to address the issue many years ago in iOS 10.3 by removing Keychain data when the last app from a developer was uninstalled [1], but they got cold feet. If I recall correctly, the reason was that some app developers were relying on this unintended functionality to ensure free trials couldn't be used more than once. Apple was going to introduce a service that could store only 2 bits of data to enable that use case and then revisit Keychain deletion when the last app from a developer is uninstalled, but it appears they haven't. It would be great if they'd finally fix this. [1] https://developer.apple.com/forums/thread/72271 https://developer.apple.com/forums/thread/72271
arp242 3y ago
> Every attempt to talk about this gets ignored or buried (maybe by people who want this ""feature"" to be kept quiet) so I will take every opportunity on existing discussions about Facebook to bring it up: Or maybe this happens because it's completely off-topic here and has nothing what-so-ever to do with WhatsApp? Most of your other messages seem similarly off-topic: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3ARazengan%20%22facebook%22&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... Not only that, people have already answered your question in a previous thread.
- Razengan 3y ago
  It's less of a "question" and more of a "WHY THE FUCK is this even a thing???" and why aren't people giving FB/Apple hell for this?? There was a popular post just a few hours ago about Filezilla (whatever that is) containing adware in the default download. This is a FAR more grave violation of privacy than anything so far — Tracking people ACROSS reinstalls AND MULTIPLE PHONES!

HumblyTossed 3y ago

This is nuts. There should be a grand total of zero files on my personal computing device that I cannot remove (no matter the consequences).

redeeman 3y ago
then you have chosen the wrong platform. Just be grateful that the mighty apple even deems you worthy of having files
- Razengan 3y ago
  Android's security was way worse for years. How long did they even take before having granular permissions or a Privacy Report, if they do now at all?
  - redeeman 3y ago
    uhm, they had different permissions granularized, in some ways worse than apple, some ways better. but i was not talking security
threeseed 3y ago
You can remove every file on your Mac. And there are no eternal tracking cookies for Safari even first party ones are deleted every week.
ants_everywhere 3y ago
This seems fundamentally at odds with Apple's philosophy that they're providing you a rented appliance they control and which you have temporary access to. I'm sure you can remove most and/or all Mac OS files, but they're increasingly using trusted computing and even designing their own chips to increase the control they have over the devices (and correspondingly limit user control). They sell this as a security feature these days, but the appliance model predates that and security is kind of just along for the ride. I'm glad to see that people feel strongly that they should have control over the files on their system. I'd like to see that help move us toward users having full control over their computers.

darklion 3y ago

> WHY does Apple, parading around as a pompous paragon of privacy, even allow this crap? Good alliteration. Apple doesn’t enforce what the app does with app data. Apple makes sure that if the app uses a platform API that is sensitive, it gets your opt-in (or prohibits the use of the API altogether). Apple makes sure that the app publishes a privacy nutrition label. But what the app does inside with whatever data you choose to give it, that’s up to the app. If you voluntarily choose to give data to the app, what the app does with it is your problem. Apple just tries to make sure the app can’t take data that you haven’t chosen to give it.

lxgr 3y ago
That would be a nice solution, but there is no "allow app to persist data beyond deletion/reinstall" user-grantable permission on iOS.
Razengan 3y ago
There is no indication whatsoever that an app will leave behind an Eternal Cookie on my device, nor am I given a chance to prevent it.

quadhome 3y ago

It’s stored in your keychain. Disabling the iCloud keychain doesn’t clear your local copy.

threeseed 3y ago

Not sure why you are using this thread as technical support. Or what tracking data you are referring to ie. is it cookies or local storage but either way you should maybe speak to Apple Support. Yes iOS apps can store local data and if you're unhappy about it then just delete or reinstall the app.

lxgr 3y ago
> just delete or reinstall the app. Well, that doesn't delete all local data. That's exactly the problem!

alexsereno 3y ago

Hey I can shed light on this. It’s the iCloud keychain. Disabling the keychain doesn’t delete existing entries. There is no way to modify the keychain on iOS (you can on Mac). Lots of apps store sign on data in the keychain for obvious reasons. It would be really great to have a keychain section in iOS’s settings, like Keychain Access on Mac. The dev can build in-app functionality to delete keys from the keychain, but there’s not a huge incentive to. Keychain storage doesn’t let FB track you, just store sign on info, keys, and the like. It’s not able to execute arbitrary code, it’s an encrypted place to store login info that Apple syncs between your devices. Use them via Safari if you don’t want this (then your logins are saved & synced in Safaris keychain.)

threeseed 3y ago
You can add/delete entries in the iOS keychain from the Passwords section. And I am looking at my iPhone now and Meta does not store tracking data in the Keychain.
- alexsereno 3y ago
  You certainly can not, here's some more info. Passwords and the keychain are separate items. https://apple.stackexchange.com/questions/441112/how-can-i-remove-keychain-data-from-ios https://apple.stackexchange.com/questions/441112/how-can-i-r...
discostrings 3y ago
It's not specific to iCloud Keychain--it applies to on-device Keychain on iOS devices, too, even if you don't use iCloud. Any developer can store data there with no way for the user to know or see what it's saving, and it's shared among all apps from the same developer. Keychain is quite a misnomer here--it's really "store any (short) data you want on a user's device without them ever being able to see or remove it". It transfers when you restore backups on new devices, too, even if you haven't had the developer's apps installed in the last decade. This is an issue because if you ever use an app by a company, uninstall all their apps, and then install one of the developer's apps years later, they can tell it's the same iOS profile (even restored on a different device), profile what you do across those apps/installs/decades, and associate any accounts you log in with. Essentially they can put a permanent cookie that you can't even see on your iOS profile that's shared between their apps. If you use iCloud Keychain, they can probably profile you across all your devices regardless of whether you reset one. Apple has said this isn't intended functionality and they were going to address the issue many years ago in iOS 10.3 by removing Keychain data when the last app from a developer was uninstalled [1], but they got cold feet. If I recall correctly, the reason was that some app developers were relying on this unintended functionality to ensure free trials couldn't be used more than once. Apple was going to introduce a service that could store only 2 bits of data to enable that use case and then revisit Keychain deletion when the last app from a developer is uninstalled, but it appears they haven't. It would be great if they'd finally fix this. [1] https://developer.apple.com/forums/thread/72271 https://developer.apple.com/forums/thread/72271

arp242 3y ago

> Every attempt to talk about this gets ignored or buried (maybe by people who want this ""feature"" to be kept quiet) so I will take every opportunity on existing discussions about Facebook to bring it up: Or maybe this happens because it's completely off-topic here and has nothing what-so-ever to do with WhatsApp? Most of your other messages seem similarly off-topic: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3ARazengan%20%22facebook%22&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... Not only that, people have already answered your question in a previous thread.

Razengan 3y ago
It's less of a "question" and more of a "WHY THE FUCK is this even a thing???" and why aren't people giving FB/Apple hell for this?? There was a popular post just a few hours ago about Filezilla (whatever that is) containing adware in the default download. This is a FAR more grave violation of privacy than anything so far — Tracking people ACROSS reinstalls AND MULTIPLE PHONES!