6 ms·

Google, Meta 'break' Apple's device fingerprinting rules

104 points by gulced 2y ago

ipython 2y ago
I would believe this - after all how many billions of dollars did Google pay Apple to be the primary search engine on iOS? This further erodes my confidence in Apple doing the right thing and I think the EU is doing the world a service by setting in motion alternative app stores.
- gruez 2y ago
  >I would believe this - after all how many billions of dollars did Google pay Apple to be the primary search engine on iOS? The OP also mentions Facebook and Spotify also are violating rules, and to my knowledge they're not paying apple "billions", so this explanation doesn't pass the sniff test. The actual reason is probably far more banal: these apps command a huge user base, which would be very upset if apple banned these apps. As a result apple is letting such infractions slide because they don't want to upset users.
  - burnerthrow008 2y ago
    Could also be that they are afraid of more antitrust attention if they enforce the rules too strictly. The EU already handed Google the browser market on a silver platter, under the guise of “competition”. How much farther would they go if Apple prevented a perceived competitor from abusing users?
    - MBCook 2y ago
      They’ve done this for years before the EU started stepping up. I think a more likely explanation is they know what would happen to their sales numbers if they kicked off Facebook and Spotify.
- burnerthrow008 2y ago
  > I think the EU is doing the world a service by setting in motion alternative app stores. Why, so that developers can have absolutely no rules against abusing their users?
  - DEADMINCE 2y ago
    So people can actually have some control over the device they OWN.
- davidf18 2y ago
  [dead]
- MBCook 2y ago
  There’s a second set of rules for mega popular apps. Always has been. FB should have been permanently banned 15 years ago. If you’re important enough Apple will let you get away with murder compared to normal devs. Users don’t buy phones without FB, Instagram, Spotify, WhatsApp, Google apps, etc. There is only one time I remember anything happening to a big app. Fortnite probably could have tracked people for years. But the they took away Apple’s cut and publicly stuck a thumb in Apple’s eye at the same time. So they got booted.
  - refulgentis 2y ago
    15 years ago apple was proudly announcing they were integrating Facebook accounts into iPhone OS and making their APIs available to apps, to thumb their nose at Google. (iPhone OS 4, IIRC) That's part of why Facebook felt rightfully indignant when Apple moved to kneecap attribution and acted like it had never heard of it
firecall 2y ago
Well I never! Side note: I wonder how much harm Apple is doing to it's brand with it's Pious Attitude and Arrogant Behaviour? Even as a long time, but relatively small shareholder, I'm on the fence about Apple right now. I cant see the iPhone failing to lay golden eggs anytime soon. But the Apple Vision Pro feels like they took those golden eggs and gold platted a toilet seat. Tim Cook runs a tight shop, but he's been riding the wave of iPhone growth and the engineering excellence that gave us Apple Silicon. The overall Apple brand hasnt been doing so well IMHO, and it's the Brand that saved Apple back in the 90s! You cant fake passion, and everytime we see Tim Cook on stage or presenting, I get the vibe he would rather be somewhere else!
- SunlitCat 2y ago
  [flagged]
  - havaloc 2y ago
    No, it's because SMS is awful. I'm looking forward to see how well Apple implements RCS and how many of these problems go away.
    - deleted 2y ago
      [deleted]
    - SunlitCat 2y ago
      Well, my comment wasn't aiming towards the technical details (which I even agree!), but more about the social background, with people considering other people who "just send green text" as "lesser". And no, it's not just the "young people crowd", but a certain part of society.
      - ElFitz 2y ago
        One could argue it’s a good thing: these people filter themselves out of our lives. It could almost make me wish for an Android.
  - 2y ago
gruez 2y ago
Original source, buried within the article: https://www.mysk.blog/2024/05/03/apple-required-reason-api/ https://www.mysk.blog/2024/05/03/apple-required-reason-api/
- ajross 2y ago
  Yeah, this is much clearer than The Register's attempt to summarize/explain/sensationalize it. And the meat seems... pretty bland. They caught a bunch of "plausibly fingerprinty"[1] tokens (that a reasonable interpretation of Apple policy would require being stored on the device) being sent unobfuscated in later requests. That looks a lot more like a genuine mistake by developers than a real attempt to evade tracking controls to me. [1] But... not very? Seems like they're mostly concerned with system uptime. And, sure, boot time can be a fingerprint, but by definition an ephemeral one. In combination with other techniques, sure, maybe there's a way to construct an user profile. But alone? Meh. And it seems like that's all the investigators found.
  - KerrAvon 2y ago
    Uptime can be pretty long on iOS devices, and the developers have no legitimate use for that information.
    - Spivak 2y ago
      Not sure why you're being downvoted for this, iOS devices aren't servers, apps have very little control over their lifecycle, and the existing time APIs for an app's internal sense of time are plenty. There is no reason at all an app would need to know this random piece of global state. I'm not even sure why Apple offers the real uptime instead of an offset starting when the app first called the API. It's the first thing that talk about in the docs https://developer.apple.com/documentation/foundation/nsprocessinfo/1414553-systemuptime https://developer.apple.com/documentation/foundation/nsproce...
      - refulgentis 2y ago
        Cupertino, if you're listening, I'm not comfortable with the offset either, that would also do fine as an identifier.
tremarley 2y ago
Could this be the reason why on iPhones, nearly everything we search for in Google Chrome is advertised to us on Instagram?
- kurthr 2y ago
  Yep, just noticed exactly this.
- staplers 2y ago
  Look up "retargeting ads"
  - calmworm 2y ago
    Right. This is the most basic level of marketing. Is this not as widely known as I assumed it was?
    - Dudhbbh3343 2y ago
      How does it work exactly? Google sells lists of search terms and associated device ids to Meta?
      - repeekad 2y ago
        Google data never leaves their platform, it’s too valuable to them. Retargeting works the other way where a site or app attempts to get a cookie or fingerprint and gives them to Google or Meta to target that user with ads
      - littlestymaar 2y ago
        IIRC not to Meta themselves but to Meta's customers (I mean, the advertisers, which are the ones who pay. You the user aren't Meta's customer, you are their product) but it's been a long time since I hear Criteo's technical pitch so I don't remember how it works.
- calmworm 2y ago
seeknotfind 2y ago
The software stack on a modern cellphone, or of a browser, is about as likely to stop fingerprinting as a sticky-fingered burglar already in the police database can, in an oil and sugar factory, prevent his identification after touching every knob and lever in a warehouse of machines by wiping off the door handle on the front door alone. Rules are important because we cannot prevent crime from occurring at all. Though a truly isolated, truly privacy-preserving technology may seem on the horizon - whether it be through statelessness, homomorphic encryption, distributed governance, or some other odd and yet unproven technology, I can only hope we can one day look back on the sorry state of affairs today with nostalgia as the rash and haphazard painful afflictions of passion for the stars and the unlimited potential we set ourselves out for today.
- Dudhbbh3343 2y ago
  Librefox does a decent job at resisting fingerprinting, at least against the fairly standard service that we used at my previous company. I'm sure with a little effort it could easily be defeated, but for some purposes it's enough.
BenFranklin100 2y ago
This shouldn’t be a cat and mouse game. Google and Meta should be subject to a class action lawsuit for gross privacy violations and sued into smithereens. All the developers whose livelihood depends on surveillance capitalism can go do something more productive with their lives.
xyst 2y ago
The claims of privacy by Apple are just a facade. I’m done with this walled in ecosystem (jail). They have good looking products but the company itself is as rotten as their competition.
- Tagbert 2y ago
  And you got all of that from an article about Google and Facebook, maybe, trying to get around Apple’s attempts to provide more privacy?
  - xyst 2y ago
    It’s a history of this behavior that has convinced me that Apple’s claims of being a privacy advocate is nothing but lip service.
    - Tagbert 2y ago
      or it's more complicated than a simple all or nothing rule.
DueDilligence 2y ago
[dead]

104 points by gulced 2y ago

I would believe this - after all how many billions of dollars did Google pay Apple to be the primary search engine on iOS? This further erodes my confidence in Apple doing the right thing and I think the EU is doing the world a service by setting in motion alternative app stores.

gruez 2y ago
>I would believe this - after all how many billions of dollars did Google pay Apple to be the primary search engine on iOS? The OP also mentions Facebook and Spotify also are violating rules, and to my knowledge they're not paying apple "billions", so this explanation doesn't pass the sniff test. The actual reason is probably far more banal: these apps command a huge user base, which would be very upset if apple banned these apps. As a result apple is letting such infractions slide because they don't want to upset users.
- burnerthrow008 2y ago
  Could also be that they are afraid of more antitrust attention if they enforce the rules too strictly. The EU already handed Google the browser market on a silver platter, under the guise of “competition”. How much farther would they go if Apple prevented a perceived competitor from abusing users?
  - MBCook 2y ago
    They’ve done this for years before the EU started stepping up. I think a more likely explanation is they know what would happen to their sales numbers if they kicked off Facebook and Spotify.
burnerthrow008 2y ago
> I think the EU is doing the world a service by setting in motion alternative app stores. Why, so that developers can have absolutely no rules against abusing their users?
- DEADMINCE 2y ago
  So people can actually have some control over the device they OWN.
davidf18 2y ago
[dead]
MBCook 2y ago
There’s a second set of rules for mega popular apps. Always has been. FB should have been permanently banned 15 years ago. If you’re important enough Apple will let you get away with murder compared to normal devs. Users don’t buy phones without FB, Instagram, Spotify, WhatsApp, Google apps, etc. There is only one time I remember anything happening to a big app. Fortnite probably could have tracked people for years. But the they took away Apple’s cut and publicly stuck a thumb in Apple’s eye at the same time. So they got booted.
- refulgentis 2y ago
  15 years ago apple was proudly announcing they were integrating Facebook accounts into iPhone OS and making their APIs available to apps, to thumb their nose at Google. (iPhone OS 4, IIRC) That's part of why Facebook felt rightfully indignant when Apple moved to kneecap attribution and acted like it had never heard of it

firecall 2y ago

Well I never! Side note: I wonder how much harm Apple is doing to it's brand with it's Pious Attitude and Arrogant Behaviour? Even as a long time, but relatively small shareholder, I'm on the fence about Apple right now. I cant see the iPhone failing to lay golden eggs anytime soon. But the Apple Vision Pro feels like they took those golden eggs and gold platted a toilet seat. Tim Cook runs a tight shop, but he's been riding the wave of iPhone growth and the engineering excellence that gave us Apple Silicon. The overall Apple brand hasnt been doing so well IMHO, and it's the Brand that saved Apple back in the 90s! You cant fake passion, and everytime we see Tim Cook on stage or presenting, I get the vibe he would rather be somewhere else!

SunlitCat 2y ago
[flagged]
- havaloc 2y ago
  No, it's because SMS is awful. I'm looking forward to see how well Apple implements RCS and how many of these problems go away.
  - deleted 2y ago
    [deleted]
  - SunlitCat 2y ago
    Well, my comment wasn't aiming towards the technical details (which I even agree!), but more about the social background, with people considering other people who "just send green text" as "lesser". And no, it's not just the "young people crowd", but a certain part of society.
    - ElFitz 2y ago
      One could argue it’s a good thing: these people filter themselves out of our lives. It could almost make me wish for an Android.
- 2y ago

gruez 2y ago

Original source, buried within the article: https://www.mysk.blog/2024/05/03/apple-required-reason-api/ https://www.mysk.blog/2024/05/03/apple-required-reason-api/

ajross 2y ago
Yeah, this is much clearer than The Register's attempt to summarize/explain/sensationalize it. And the meat seems... pretty bland. They caught a bunch of "plausibly fingerprinty"[1] tokens (that a reasonable interpretation of Apple policy would require being stored on the device) being sent unobfuscated in later requests. That looks a lot more like a genuine mistake by developers than a real attempt to evade tracking controls to me. [1] But... not very? Seems like they're mostly concerned with system uptime. And, sure, boot time can be a fingerprint, but by definition an ephemeral one. In combination with other techniques, sure, maybe there's a way to construct an user profile. But alone? Meh. And it seems like that's all the investigators found.
- KerrAvon 2y ago
  Uptime can be pretty long on iOS devices, and the developers have no legitimate use for that information.
  - Spivak 2y ago
    Not sure why you're being downvoted for this, iOS devices aren't servers, apps have very little control over their lifecycle, and the existing time APIs for an app's internal sense of time are plenty. There is no reason at all an app would need to know this random piece of global state. I'm not even sure why Apple offers the real uptime instead of an offset starting when the app first called the API. It's the first thing that talk about in the docs https://developer.apple.com/documentation/foundation/nsprocessinfo/1414553-systemuptime https://developer.apple.com/documentation/foundation/nsproce...
    - refulgentis 2y ago
      Cupertino, if you're listening, I'm not comfortable with the offset either, that would also do fine as an identifier.

tremarley 2y ago

Could this be the reason why on iPhones, nearly everything we search for in Google Chrome is advertised to us on Instagram?

kurthr 2y ago
Yep, just noticed exactly this.
staplers 2y ago
Look up "retargeting ads"
- calmworm 2y ago
  Right. This is the most basic level of marketing. Is this not as widely known as I assumed it was?
  - Dudhbbh3343 2y ago
    How does it work exactly? Google sells lists of search terms and associated device ids to Meta?
    - repeekad 2y ago
      Google data never leaves their platform, it’s too valuable to them. Retargeting works the other way where a site or app attempts to get a cookie or fingerprint and gives them to Google or Meta to target that user with ads
    - littlestymaar 2y ago
      IIRC not to Meta themselves but to Meta's customers (I mean, the advertisers, which are the ones who pay. You the user aren't Meta's customer, you are their product) but it's been a long time since I hear Criteo's technical pitch so I don't remember how it works.
calmworm 2y ago

seeknotfind 2y ago

The software stack on a modern cellphone, or of a browser, is about as likely to stop fingerprinting as a sticky-fingered burglar already in the police database can, in an oil and sugar factory, prevent his identification after touching every knob and lever in a warehouse of machines by wiping off the door handle on the front door alone. Rules are important because we cannot prevent crime from occurring at all. Though a truly isolated, truly privacy-preserving technology may seem on the horizon - whether it be through statelessness, homomorphic encryption, distributed governance, or some other odd and yet unproven technology, I can only hope we can one day look back on the sorry state of affairs today with nostalgia as the rash and haphazard painful afflictions of passion for the stars and the unlimited potential we set ourselves out for today.

Dudhbbh3343 2y ago
Librefox does a decent job at resisting fingerprinting, at least against the fairly standard service that we used at my previous company. I'm sure with a little effort it could easily be defeated, but for some purposes it's enough.

BenFranklin100 2y ago

This shouldn’t be a cat and mouse game. Google and Meta should be subject to a class action lawsuit for gross privacy violations and sued into smithereens. All the developers whose livelihood depends on surveillance capitalism can go do something more productive with their lives.

xyst 2y ago

The claims of privacy by Apple are just a facade. I’m done with this walled in ecosystem (jail). They have good looking products but the company itself is as rotten as their competition.

Tagbert 2y ago
And you got all of that from an article about Google and Facebook, maybe, trying to get around Apple’s attempts to provide more privacy?
- xyst 2y ago
  It’s a history of this behavior that has convinced me that Apple’s claims of being a privacy advocate is nothing but lip service.
  - Tagbert 2y ago
    or it's more complicated than a simple all or nothing rule.

DueDilligence 2y ago

[dead]