9 ms·
iOS 8 Privacy Updates
- chollida1 12y agoIs there a reason the author's name is in the title. Seems to violate the HN's guidelines. Is the author so important that we should know of him/her? Having said that, the article is awesome and if the author keeps writing pieces like this I'll be reading more!
- josephlord 12y agoAlso I understand that it will be possible to set DuckDuckGo as the search engine in Safari.
- sibbl 12y agoScreenshots, created with Sketch... Doesn't look good on devices that don't have "Helvetica Neue" installed.
- shurcooL 12y agoUnrelated to content, it's interesting that I could reduce the scaling to not 90, not 75, not even 67, but a whole 50%, in order to have the font sizes be of comfortable normal size rather than extremely large. It's a pattern I'm noticing more and more, and it makes me worry.
- mikestew 12y agoOdd, it looks like you're getting down-voted. I mean, I'm no more of a fan of "page layout complaint that has nothing to do with the article" comments than anyone else, but I don't know that it's down-vote-worthy. Anyway, at the apparent risk of being on the receiving end of some down votes myself, I'm more curious why giant fonts are a trend. I'm old, I wear progressive lens (what used to be known as "bifocals"), and I still hit the Cmd⌘-+- combo a few times to crank it down to a readable size. Is it some attempt to capture the aging baby boomer market? (I ask with tongue somewhat in cheek...)
- untog 12y agoI'm more curious why giant fonts are a trend If you imagine that page on a phone screen, you'd find that the font size is probably a lot more normal than it is large. If you're expecting > 50% of traffic on mobile then that's the use-case you optimise for.
- jamesbritt 12y agoWhy not use media queries to apply screen-appropriate CSS?
- dictum 12y agoFonts render better at larger sizes (i.e. with less subpixel antialiasing issues). Also, until recently most browsers didn't support subpixel typographic adjustments (for instance, "letter-spacing: 0.4px"), and you could only adjust this stuff reliably if your font-size was higher than 20px. That said, 16px is the default base font size on most user agents, and it seems adequate for reading on many devices. However, I tested 16px in Luis's site and it was not quite satisfactory. 19px seems to be the sweet spot in this case. Ultimately, no font-size is perfect for everyone. Be thankful that your browser zoom works ;) Even on a desktop, sometimes at night, with f.lux on, I have to zoom HN to read it comfortably (thankfully Safari has tap to zoom in an area).
- jakebellacera 12y agoIt's fascinating how so many apps can be rendered useless by the simple mistake of tapping "Deny" instead of "Allow."
- GrantS 12y agoYou can, of course, navigate to settings and toggle the switch for anything you accidentally denied, but I wonder how many users know that. Also, unless a developer explicitly adds some message reminding the user that they have already denied access to some resource, the user may very well forget that they ever denied anything and think that the app just doesn't work. All that said, I think Apple is making the right choice by favoring privacy and security even if it's at the expense of a completely frictionless user experience.
- MBCook 12y agoThe article says that Apple is making it possible to put a link in your app to get users straight to that screen so you don't have to try to talk them through it. I agree with you that I doubt many people have any idea that stuff is there.
- josephlord 12y agoAt least in iOS 8 the developer can add actions to send the user to the correct part of the settings app.
- gergles 12y agoAnd let's hope the review process is very tight about this. If I deny you some permission, you shouldn't be able to pester me every time I run the app to turn it back on. Some apps (cough Facebook cough) are already REALLY bad about this.
- micampe 12y agoI denied location access and Facebook never asks me anything more than once.
- qwerfdsa 12y agoWhat about the privacy issues of keychain-stored identifiers (iOS 7)? For example Facebook stays signed in across its apps, even if they are deleted. So they could just put an Ad identifier inside the keychain storage and have an unremovable tracking identifier. An user can't remove that on his own. Even if he signs out, they can keep the identifier in the keychain for tracking. I'm curious why I couldn't find any info on that in the internet?
- GrantS 12y agoI had somehow missed the news from WWDC that accessing the camera now requires explicit permission from the user. I'm really surprised camera privacy took this long to arrive, and I wonder what the reasoning was for not implementing it at the same time as microphone permissions arrived in iOS 7.
- coldtea 12y ago>I'm really surprised camera privacy took this long to arrive, and I wonder what the reasoning was for not implementing it at the same time as microphone permissions arrived in iOS 7. I don't think apps could take photos without you explicitly triggering the process, so no permission was needed anyway IIRC.
- GrantS 12y agoUsing the lower level AVFoundation classes to start a capture session, any app could absolutely get live camera access to either front or back camera without the user knowing anything. I know because my app shows a live preview to the user right when the app starts up, no permission required, direct access to pixels, and if I chose not to display the UIView that shows the live camera data, that would not change my app's access to the data (under iOS 7 and earlier, I mean). It's possible Apple screened for non-camera apps using those APIs to keep spying apps out but (Edit: bad example, this was an Android app. I had said: "there was that flashlight app that was storing/reporting user GPS locations without permission so obviously things were slipping through the old system.")
- ROFISH 12y agoRandom question: If the specially blessed form names for user signup is 'username' and 'new-password', what's the name of the field that's "password again" (for typos)?
- melvinmt 12y agoI don't think autocomplete is supposed to work for fields that check typos?
- schrodinger 12y agoIt's necessary when you're letting safari generate a password for you. Safari needs to type in the same password twice.
- abritishguy 12y agoAutocomplete doesn't make typos so why shouldn't it work?
- melvinmt 12y agoBecause it defeats the purpose of the field that's checking for typos.
- abritishguy 12y agoAnd that purpose is obsolete when a computer is inputting the password.
- mightykan 12y agoAccording to the "Your App, Your Website, and Safari" WWDC session from this year [1] (Slide titled "Signing up with confirmation" towards the end of the document), you simply use the `current-password` or `new-password` autocomplete attribute again for confirmation of either field. [1] (Session PDF Link): http://devstreaming.apple.com/videos/wwdc/2014/506xxeo80e5kykp/506/506_ensuring_continuity_between_your_app_and_web_site.pdf?dl=1 http://devstreaming.apple.com/videos/wwdc/2014/506xxeo80e5ky...
- fi8on 12y agoLooks like they just copied another feature as usual from some competitive OS and made it sound like something new.
- rimantas 12y agocan you name that OS?
- mwfunk 12y agoI swear there is no weaker criticism on tech forums than people complaining about how technology X is lame because it has some nifty feature that competing technology Y has been doing for a long time, which is always followed by a complaint that whoever made technology X is guilty giving the false impression that they are 100% responsible for inventing whatever that feature was, by virtue of the fact that they don't include a long list of thank yous to said competitors in their marketing materials. In previous decades, this argument was every bit as silly when someone used it to claim that Windows sucked because the Mac came first, or that the Mac sucked because the Xerox Alto came first, or that the Xerox Alto sucked because the Analytical Engine came first, or that the Analytical Engine sucked because the abacus came first, or that the abacus sucked because fingers came first, or that fingers sucked because...well, I don't know. Maybe there were a bunch of flagella graybeards on the forums who would get super pissed anytime someone made a positive comment about fingers without acknowledging the evolutionary contributions of their species.
- weinzierl 12y agoOn the iOS 8 preview page for the Photos App the iCloud Photo Library integration is featured very prominently. I wondered what this means for privacy. It isn't mentioned in the original post, probably because it's an extra app therefore out of scope of the article. I'd be interested anyway in any information on this, primarily: Will Photos be practically usable without iCloud? Syncing my devices with iPhoto is pretty seamless, will it still work? [1] https://www.apple.com/ios/ios8/photos/ https://www.apple.com/ios/ios8/photos/
- glasshead969 12y agoYou can disable iCloud Photo library, atleast in current betas. Regarding iPhoto, it is being discontinued in favor of a new Photos app in Yosemite. Existing app should work with maintenance updates to it.
- mikelat 12y agoI do hope this privacy conscious software becomes a trend and a race to the top. The amount of data collection is scary and the worse thing is the encouragement of sharing this information. I would like it even more if the data is encrypted to the point where not even the company has access to it... but with the cloud trends that doesn't seem like that's going to happen. With the recent android updates to reduce importance of application permissions already has me urked, and I'm not a big fan of google now nagging me to enable search history. I'm considering to install a more privacy conscious ROM or put firefox OS soon on my phone.
- cordite 12y agoI wonder how Google will react to this? I already feel betrayed by how apps seem to meaninglessly and without reason request arbitrary information. Microsoft also seems to be making a trend about "We care about your data privacy."
- r00fus 12y agoGood point about Microsoft - if they bandwagon and properly implement some of the good-privacy approaches Apple takes, it will put big pressure on Google to do the same. Ultimately, that will help all users, and in the long run, even app developers as trust increases.
- Chronic29 12y agoAlthough IE sucks, Microsoft is the only one to enable "Send Do Not Track" by default. Chrome and Firefox have this feature disabled.
- john2x 12y agoChrome I expected, but why does Firefox have it disabled by default?
- burkaman 12y ago"As we have been arguing for a long time, the point of the feature is to reflect the individual’s preference, so the user must make a choice before we send any stance on tracking." https://blog.mozilla.org/privacy/2013/01/28/newdntui/ https://blog.mozilla.org/privacy/2013/01/28/newdntui/
- lostlogin 12y agoI'm cynical, but guess who pays the bills? http://www.forbes.com/sites/timworstall/2013/01/22/so-why-is-google-funding-its-own-competition-in-the-firefox-os/ http://www.forbes.com/sites/timworstall/2013/01/22/so-why-is...
- 12y ago
- cstrat 12y agoI really like the changes they are making here. One that stands out that I think will cause plenty of issues is the "Block Cookies not from Current Website". This should basically block all tracking, like, +1 etc... buttons, right? I think it will even impact the SSO that Google has across its properties.
- jbg_ 12y agoI’m running Yosemite and the default is “block cookies not from current or previously visited websites”. Not sure if it’s the same on iOS 8, but that would seem to allow the buttons to use cookies as long as the user has been to that website (e.g. Facebook, for a “like” button) before.
- cstrat 12y agoohhh ok, but it would block pure advertising cookies because its less likely that a user would directly visit the domain that they originate from. that is still good, however I would prefer if it did allow you to block all cookies that aren't from the current website.
- zevyoura 12y agoWith comprehensive shared web history via iCloud this could sort of work, but I never (for example) visit the Facebook mobile site from my phone, despite using their apps daily.
- adamlett 12y agoIs there a difference between "not from current website" and "3rd party"?
- rizwan 12y agoThis article is so very thorough and great. I'd love to have some anchor links within the piece though, so when I'm referring my team to some of the changes, I can direct them right to the relevant information.
- sb23 12y agoPick a phrase in the spot you want and CTRL - F. Almost the same thing.
- rizwan 12y agoSure, that's possible. When you're passing around the links to other people, it gets old to have a bunch of "[link] and search for 'Keychain|HealthKit|HomeKit'"
- tillinghast 12y agoIt looks like he's adding anchor links as he updates the article. Currently, the major sections are linked: http://lmjabreu.com/post/ios-8-privacy-updates/#safari http://lmjabreu.com/post/ios-8-privacy-updates/#safari
- johnvschmitt 12y agoA welcome change. But, for this to work, the violators (even past) can't be allowed to bypass the rules. For example, how many of the top apps that explicitly allow kids, violate some or all of the COPPA standards? Clash of Clans is just one example, ages 9+, but allows custom usernames and p2p chat with very little filters. Those social features are key to long term engagement, even of 9 year olds.
- tlrobinson 12y agoI think Secure Enclave and other hardware crypto technologies are massively important, especially if cryptocurrencies are to be widely used. Trezor (http://www.bitcointrezor.com/ http://www.bitcointrezor.com/) and other dedicated wallets are a decent stopgap, but I'd really like to let my phone do everything, if it can be done securely, which I think it can with the right hardware (of course auditing hardware is a lot more difficult) Hal Finney has done some good work here, applying TPMs to Bitcoin: https://bitcointalk.org/index.php?topic=154290.0 https://bitcointalk.org/index.php?topic=154290.0
- AllenKids 12y agoThe biggest win for me is contact access control, it drives me absolutely nuts when a messaging app or whatever insists on having full access of my very private and valuable contact info.
- robmcm 12y agoWhat's more worrying is my contact information on friends devices. I have zero control over that. Some of them are even on Android! ;)
- fredsted 12y agoNice detail on SVG graphics.
- gurkendoktor 12y agoI wish networking was sandboxed in iOS 8, at least for particular kinds of apps (e.g. diary apps). Apple could use the chance to promote iAds and CloudKit at the same time by whitelisting them. :)
- junto 12y agoI'm trying to get my head around the keychain changes, and whether they fix one particular annoyance that I have with iOS. Currently I have the Gmail app installed on our family iPad. My Google account details are therefore stored in the keychain. If I use the Google Maps app, it PERSISTENTLY asks the user to sign in (using my account already in the keychain). My wife doesn't want her location searches saved to my account, nor those of my kids. I don't want to login to the Google Maps app, but Google seems to want to force me to, even though this is a shared device. There doesn't appear to be an option to say "no, thanks, stop f%*king asking". So instead I use Google Maps in Safari and cringe if I really need to use Apple Maps - slooooooooow. Can anyone shed any light on whether I'll be able to block the sharing of my Google account details between Google apps?
- smackfu 12y agoNo, this actually goes the other direction. If you have stored your Google login credentials in Safari, then the Google Maps app could login automatically without prompting you. Currently only apps from the same developer can share keychain items. Apple would rather you buy two iPads than share one, and their OS is designed around that.