4 ms·

Seems like in general the iPhone was not designed to avoid fingerprinting from installed apps. Only protection would be avoid installing apps and use the web br

Seems like in general the iPhone was not designed to avoid fingerprinting from installed apps. Only protection would be avoid installing apps and use the web browser when possible.

p-e-w 4mo ago
The intended “protection” is the ToS, which requires apps to disclose what they are tracking and whether they perform cross-premise tracking.
- paytonjjones 4mo ago
  Often it's not the app itself doing tracking or cross-premise tracking, but data is passed to installed third party SDKs that do.
- Barbing 4mo ago
  Ah, that’s funny. Too bad those privacy nutrition labels are only honor system. They give that one completely up to businesses, then, to devs. They also thought they should let an app maker prohibit screen recording, which might promote development since it protects revenue of e.g. subtitling apps as one example. But end result is you even end up with a black screen when recording the iPhone Mirroring app from a Mac. Apple owes us a better balance here. iCloud Private Relay for all apps (why only Safari?! and Mail and HTTP) as a start, and plugging some of the privacy holes Loupe exposes. They don’t want us abusing free trials I suppose.
cute_boi 4mo ago
These days many things don't work on browser. Even reddit is very difficult as we get constant nagging.
- potatoproduct 4mo ago
  old.reddit.com
  - brador 4mo ago
    For now but you know they’re coming for that ass.
    - inigyou 4mo ago
      It used to be widely thought they were keeping it around because the most important users who actually posted the content preferred it. But they drove all those people away in 2023 by blocking apps except for their spyware one, and everything is posted by LLMs now anyway.
- Gigachad 4mo ago
  That’s usually a warning the service is malware that wants you to install an app for deeper tracking.
- Cider9986 4mo ago
  Brave blocks those switch to app notices by default.
- water-drummer 4mo ago
  LinkedIn is the worst offender imo. I am not gonna list every shitty thing they do that goes away the moment you switch to desktop mode but the worst one is that they keep showing you the same feed for weeks if you're on mobile web.
  - Laurel1234 4mo ago
    https://browsergate.eu/ https://browsergate.eu/
    - inigyou 4mo ago
      .EU? I'd be scared to publish something like that under EU jurisdiction. I could be fined for full actual damages to Microsoft's reputation and I might even be jailed for defamation.
      - Laurel1234 4mo ago
        .
        inigyou 4mo ago
        I live in Germany. It's extremely repressive here, especially around Palestine, or any criticism of ruling politicians or rich people.
saturn8601 4mo ago
Cut your selection of apps and find/build privacy respecting alternatives for the remainder. Im trying to do this. Music is now locally hosted, Youtube is sorta kinda coming along. I've been working on reversing some of my more basic iOS apps to extract the data/endpoints they use and write my own apps. Fable really helped with this and Opus just does not cut the mustard. I hope it comes back. :/
camkego 4mo ago
This. This is why everyone who wants to fingerprint and collect tons of data on end users pushes them hard on installing an app. The amount of valuable data is 10x what’s available in the browser
- microtonal 4mo ago
  And it is not just the fingerprinting, it is also that a good number of people will install an ad/tracker blocker in their browser, but almost nobody knows or cares about the multiple trackers that most apps have. To make it worse, Apple's naming undermines consciousness about this issue, since they have an option to block cross-app/site tracking (which IIRC blocks access to the advertising identifier), but called it "Allow Apps to Request to Track". A lot of people seem to hold the belief that disabling this option blocks all in-app trackers. It just blocks one way to correlate, but as this app shows, there are other ways to correlate (as well as correlating server-side using IP addresses, etc.). On this topic, I somehow missed that Apple added a generic URL filtering API to macOS/iOS 26, which extends Safari filtering to the whole OS (well, as long as apps are using Apple's APIs). It's not perfect, but a nice addition to DNS-based blocking: https://adguard.com/en/blog/apple-url-filter-system-wide-filtering-api.html https://adguard.com/en/blog/apple-url-filter-system-wide-fil... The author of Wipr added support to Wipr 2 as an extra in-app purchase: https://kaylees.site/wipr2-whats-new.html#filtr https://kaylees.site/wipr2-whats-new.html#filtr Aside from technical methods to address this, all this in-app tracking must be a violation of the GDPR, no? I can't imagine this all falls under legitimate interest.
  - deanishe 4mo ago
    > all this in-app tracking must be a violation of the GDPR, no? Probably, but we're gonna have to wait for the courts to weigh in for a definitive answer. Same with the very popular pay-or-accept-tracking model. An Austrian court found it illegal, but we'll probably have to wait for a case to make it all the way to the ECJ.
  - deleted 4mo ago
    [deleted]
st3fan 4mo ago
Browsers are also a continuous finger printing target.

Seems like in general the iPhone was not designed to avoid fingerprinting from installed apps. Only protection would be avoid installing apps and use the web browser when possible.

p-e-w 4mo ago

The intended “protection” is the ToS, which requires apps to disclose what they are tracking and whether they perform cross-premise tracking.

paytonjjones 4mo ago
Often it's not the app itself doing tracking or cross-premise tracking, but data is passed to installed third party SDKs that do.
Barbing 4mo ago
Ah, that’s funny. Too bad those privacy nutrition labels are only honor system. They give that one completely up to businesses, then, to devs. They also thought they should let an app maker prohibit screen recording, which might promote development since it protects revenue of e.g. subtitling apps as one example. But end result is you even end up with a black screen when recording the iPhone Mirroring app from a Mac. Apple owes us a better balance here. iCloud Private Relay for all apps (why only Safari?! and Mail and HTTP) as a start, and plugging some of the privacy holes Loupe exposes. They don’t want us abusing free trials I suppose.

cute_boi 4mo ago

These days many things don't work on browser. Even reddit is very difficult as we get constant nagging.

potatoproduct 4mo ago
old.reddit.com
- brador 4mo ago
  For now but you know they’re coming for that ass.
  - inigyou 4mo ago
    It used to be widely thought they were keeping it around because the most important users who actually posted the content preferred it. But they drove all those people away in 2023 by blocking apps except for their spyware one, and everything is posted by LLMs now anyway.
Gigachad 4mo ago
That’s usually a warning the service is malware that wants you to install an app for deeper tracking.
Cider9986 4mo ago
Brave blocks those switch to app notices by default.
water-drummer 4mo ago
LinkedIn is the worst offender imo. I am not gonna list every shitty thing they do that goes away the moment you switch to desktop mode but the worst one is that they keep showing you the same feed for weeks if you're on mobile web.
- Laurel1234 4mo ago
  https://browsergate.eu/ https://browsergate.eu/
  - inigyou 4mo ago
    .EU? I'd be scared to publish something like that under EU jurisdiction. I could be fined for full actual damages to Microsoft's reputation and I might even be jailed for defamation.
    - Laurel1234 4mo ago
      .
      - inigyou 4mo ago
        I live in Germany. It's extremely repressive here, especially around Palestine, or any criticism of ruling politicians or rich people.

saturn8601 4mo ago

Cut your selection of apps and find/build privacy respecting alternatives for the remainder. Im trying to do this. Music is now locally hosted, Youtube is sorta kinda coming along. I've been working on reversing some of my more basic iOS apps to extract the data/endpoints they use and write my own apps. Fable really helped with this and Opus just does not cut the mustard. I hope it comes back. :/

camkego 4mo ago

This. This is why everyone who wants to fingerprint and collect tons of data on end users pushes them hard on installing an app. The amount of valuable data is 10x what’s available in the browser

microtonal 4mo ago
And it is not just the fingerprinting, it is also that a good number of people will install an ad/tracker blocker in their browser, but almost nobody knows or cares about the multiple trackers that most apps have. To make it worse, Apple's naming undermines consciousness about this issue, since they have an option to block cross-app/site tracking (which IIRC blocks access to the advertising identifier), but called it "Allow Apps to Request to Track". A lot of people seem to hold the belief that disabling this option blocks all in-app trackers. It just blocks one way to correlate, but as this app shows, there are other ways to correlate (as well as correlating server-side using IP addresses, etc.). On this topic, I somehow missed that Apple added a generic URL filtering API to macOS/iOS 26, which extends Safari filtering to the whole OS (well, as long as apps are using Apple's APIs). It's not perfect, but a nice addition to DNS-based blocking: https://adguard.com/en/blog/apple-url-filter-system-wide-filtering-api.html https://adguard.com/en/blog/apple-url-filter-system-wide-fil... The author of Wipr added support to Wipr 2 as an extra in-app purchase: https://kaylees.site/wipr2-whats-new.html#filtr https://kaylees.site/wipr2-whats-new.html#filtr Aside from technical methods to address this, all this in-app tracking must be a violation of the GDPR, no? I can't imagine this all falls under legitimate interest.
- deanishe 4mo ago
  > all this in-app tracking must be a violation of the GDPR, no? Probably, but we're gonna have to wait for the courts to weigh in for a definitive answer. Same with the very popular pay-or-accept-tracking model. An Austrian court found it illegal, but we'll probably have to wait for a case to make it all the way to the ECJ.
- deleted 4mo ago
  [deleted]

st3fan 4mo ago

Browsers are also a continuous finger printing target.