6 ms·

As somebody who actually has first hand knowledge of this issue (I wrote and designed the tracking for a major iOS ad network), I can say that this is an incred

by SeoxyS 14y ago

As somebody who actually has first hand knowledge of this issue (I wrote and designed the tracking for a major iOS ad network), I can say that this is an incredibly misleading article. Here's what's actually going on: - Apple has deprecated the UDID. We're still allowed to use it for a while, but in the long term it's going away. - Apple has created a new identifier (the IFA), specifically for the use case of advertising. This identifier uniquely identifies a device across apps, but beyond that provides no information about the device or its user. - This ID comes with strings. There's an option in Preferences to "Limit Ad Tracking." The terms and conditions specify that when this option is enabled, we still get access to the ID, but we are only allowed to use it for some specific purposes like conversion tracking (eg. making cost-per-action campaigns possible), and fraud detection (eg. preventing fake clicks). We are not allowed to use it to create profiles, or to improve our ad targeting algorithm. We are absolutely not allowed to divulge the information to third parties. Without this, advertising wouldn't be possible. Some may think that that'd be for the best (myself included), but that's an entirely different argument, and you'd have to realize that the market would be very different (No free/freemium apps, and everything would be more expensive). You can't have your cake and eat it too. I expected better from Schneier.

mikeash 14y ago
Without this, advertising wouldn't be possible? Maybe it would be less successful, maybe less prevalent, maybe less useful, but I'm pretty sure advertising would still be possible in a world with no device-specific IDs made accessible to the advertisers.
- SeoxyS 14y ago
  Maybe I should have been clearer. I don't mean that it wouldn't be possible, just not a successful business model like it is now.
  - mikeash 14y ago
    That, too, is clearly false. Perhaps not as successful, but advertising built plenty of powerful businesses long before this kind of technology became available.
- salem 14y ago
  Really what should be happening is that Google Play and iTunes should support affiliate tags on URLs/intents that are passed through to the app on install.
revelation 14y ago
Thanks for giving us the information on "what's actually going on". But that makes it seem worse, even when you apparently can't see it from working in the field. Apple continues to give apps access to the UDID; the recent leaks were apparently not as stark a reminder as some people thought. The "Limit Ad Tracking" option seems wholly useless; another "X-Do-Not-Track". In this case, the user even expresses the wish to not be tracked, and Apple just continues to provide the data while telling the apps you checked a meaningless box. Apple is in no position to control what app developers do with the data after the fact; the only possible way here is to not disclose that data at all. (Also, Google does just fine without a globally unique "advertising number". It can do so because people get actual value for the advertisements, and the advertisements are targeted. Apple is just providing this trove of data on the cheap to every hinterland app developer. Thats a huge mistake.)
- ralfd 14y ago
  If Apple wouldn't provide an ID then developers would code their own device identifiers. This here is crossplatform for iOS and Android: https://github.com/ylechelle/OpenUDID/blob/master/README.md https://github.com/ylechelle/OpenUDID/blob/master/README.md Or just read the MAC address: http://stackoverflow.com/questions/677530/how-can-i-programmatically-get-the-mac-address-of-an-iphone http://stackoverflow.com/questions/677530/how-can-i-programm... > Google does just fine without a globally unique "advertising number". It can do so because people get actual value for the advertisements, and the advertisements are targeted. I don't understand, can you elaborate? How can advertisements be targeted without tracking?
  - jonknee 14y ago
    > I don't understand, can you elaborate? How can advertisements be targeted without tracking? Keywords is how Google does it. Try using Google in Incognito mode (or whatever your browser of choice calls it) and note the relevant ads. Obviously this does not work as well in all apps, but to say you can't do targeted advertising without tracking is not true.
  - salem 14y ago
    At least on Android, this becomes a little more transparent, and why so many Android apps request permission to access to network and/or phone state, to get access to unique Ids.
JoshTriplett 14y ago
> the market would be very different (No free/freemium apps Most freemium apps seem to rely on in-app purchases, not ads. (Leaving aside the ones that combine the two by having you pay for not having ads, but many apps manage to come up with something more creative than that.) And quite a few free apps exist that don't have ads.
- josereyes 14y ago
  In-app purchases are most commonly a supplemental revenue stream. Most of the largest free apps are backed by ad revenues.
SCdF 14y ago
> We are not allowed to use it to create profiles, or to improve our ad targeting algorithm. We are absolutely not allowed to divulge the information to third parties. Sorry I'm pretty ignorant on how this kind of thing works, but when you say 'not allowed', what's actually stopping you? I mean, how is Apple or anyone else going to know if you do or do not use these IDs?
0wza 14y ago
Depends what your cake is. The internet was not always ad-supported. We know for fact it was valuable before commercial activity was permitted. Suggesting that any improvements since that time are attributable to web advertising is perhaps an easy argument to make, but a very difficult one to support with evidence. Showing correlation is easy. Any fool can do it. Causation OTOH requires work: a well designed experiment, using acceptable methods with controls, and data subjected to rigorous statistical analysis. Web and mobile advertising does not need to become "impossible" in order for you to stop suggesting it's unavoidable. Any fool can also make predictions of the future. Given Y, X will not exist. But given Z, X will exist. If we could be so certain about cause and effect and how to shape the future, mobile advertising would be quite easy, wouldn't it? However we can all see that is not the case. Uncertainty favors those selling advertising services, not advertisers. Allowing commercial activity does not necessarily mean the internet has to be an ad channel. I'd still buy things from Amazon even if I never saw a single web ad for the company. There are many other ad channels besides the web. They still work.
salem 14y ago
Privacy-wise this strategy is bogus. It requires API users to do the right thing (TM), but has no real way to enforce it.
cbs 14y ago
>I expected better from Schneier. What did you really expect? Him to buy into your weak hand-waving rationalization for this information exposure? Computer security is about what is possible for malicious actors, contractual "strings attached" and what you're "allowed to use it for" are next to irrelevant. If we could safely assume everyone is acting with the other's best interests in mind and respecting their privacy, computer security wouldn't even be a thing. I get it that you were on the inside of one of these companies. Its really easy to have your perspective shifted when you live something for so long. It lets you draw conclusions based on your anecdotal experiences there. That's fine and all, but don't attack the guy for pointing out the real issues you've chosen to marginalize.

by SeoxyS 14y ago

mikeash 14y ago

Without this, advertising wouldn't be possible? Maybe it would be less successful, maybe less prevalent, maybe less useful, but I'm pretty sure advertising would still be possible in a world with no device-specific IDs made accessible to the advertisers.

SeoxyS 14y ago
Maybe I should have been clearer. I don't mean that it wouldn't be possible, just not a successful business model like it is now.
- mikeash 14y ago
  That, too, is clearly false. Perhaps not as successful, but advertising built plenty of powerful businesses long before this kind of technology became available.
salem 14y ago
Really what should be happening is that Google Play and iTunes should support affiliate tags on URLs/intents that are passed through to the app on install.

revelation 14y ago

Thanks for giving us the information on "what's actually going on". But that makes it seem worse, even when you apparently can't see it from working in the field. Apple continues to give apps access to the UDID; the recent leaks were apparently not as stark a reminder as some people thought. The "Limit Ad Tracking" option seems wholly useless; another "X-Do-Not-Track". In this case, the user even expresses the wish to not be tracked, and Apple just continues to provide the data while telling the apps you checked a meaningless box. Apple is in no position to control what app developers do with the data after the fact; the only possible way here is to not disclose that data at all. (Also, Google does just fine without a globally unique "advertising number". It can do so because people get actual value for the advertisements, and the advertisements are targeted. Apple is just providing this trove of data on the cheap to every hinterland app developer. Thats a huge mistake.)

ralfd 14y ago
If Apple wouldn't provide an ID then developers would code their own device identifiers. This here is crossplatform for iOS and Android: https://github.com/ylechelle/OpenUDID/blob/master/README.md https://github.com/ylechelle/OpenUDID/blob/master/README.md Or just read the MAC address: http://stackoverflow.com/questions/677530/how-can-i-programmatically-get-the-mac-address-of-an-iphone http://stackoverflow.com/questions/677530/how-can-i-programm... > Google does just fine without a globally unique "advertising number". It can do so because people get actual value for the advertisements, and the advertisements are targeted. I don't understand, can you elaborate? How can advertisements be targeted without tracking?
- jonknee 14y ago
  > I don't understand, can you elaborate? How can advertisements be targeted without tracking? Keywords is how Google does it. Try using Google in Incognito mode (or whatever your browser of choice calls it) and note the relevant ads. Obviously this does not work as well in all apps, but to say you can't do targeted advertising without tracking is not true.
- salem 14y ago
  At least on Android, this becomes a little more transparent, and why so many Android apps request permission to access to network and/or phone state, to get access to unique Ids.

JoshTriplett 14y ago

> the market would be very different (No free/freemium apps Most freemium apps seem to rely on in-app purchases, not ads. (Leaving aside the ones that combine the two by having you pay for not having ads, but many apps manage to come up with something more creative than that.) And quite a few free apps exist that don't have ads.

josereyes 14y ago
In-app purchases are most commonly a supplemental revenue stream. Most of the largest free apps are backed by ad revenues.

SCdF 14y ago

> We are not allowed to use it to create profiles, or to improve our ad targeting algorithm. We are absolutely not allowed to divulge the information to third parties. Sorry I'm pretty ignorant on how this kind of thing works, but when you say 'not allowed', what's actually stopping you? I mean, how is Apple or anyone else going to know if you do or do not use these IDs?

0wza 14y ago

Depends what your cake is. The internet was not always ad-supported. We know for fact it was valuable before commercial activity was permitted. Suggesting that any improvements since that time are attributable to web advertising is perhaps an easy argument to make, but a very difficult one to support with evidence. Showing correlation is easy. Any fool can do it. Causation OTOH requires work: a well designed experiment, using acceptable methods with controls, and data subjected to rigorous statistical analysis. Web and mobile advertising does not need to become "impossible" in order for you to stop suggesting it's unavoidable. Any fool can also make predictions of the future. Given Y, X will not exist. But given Z, X will exist. If we could be so certain about cause and effect and how to shape the future, mobile advertising would be quite easy, wouldn't it? However we can all see that is not the case. Uncertainty favors those selling advertising services, not advertisers. Allowing commercial activity does not necessarily mean the internet has to be an ad channel. I'd still buy things from Amazon even if I never saw a single web ad for the company. There are many other ad channels besides the web. They still work.

salem 14y ago

Privacy-wise this strategy is bogus. It requires API users to do the right thing (TM), but has no real way to enforce it.

cbs 14y ago

>I expected better from Schneier. What did you really expect? Him to buy into your weak hand-waving rationalization for this information exposure? Computer security is about what is possible for malicious actors, contractual "strings attached" and what you're "allowed to use it for" are next to irrelevant. If we could safely assume everyone is acting with the other's best interests in mind and respecting their privacy, computer security wouldn't even be a thing. I get it that you were on the inside of one of these companies. Its really easy to have your perspective shifted when you live something for so long. It lets you draw conclusions based on your anecdotal experiences there. That's fine and all, but don't attack the guy for pointing out the real issues you've chosen to marginalize.