App Store on iOS 14.6 sends every tap you make in the app to Apple

https://twitter.com/mysk_co/status/1588308341780262912

by helical • 4 years ago

283 158 4 years ago

twitter.com

makz• 4 years ago

Well at this point I expect this to happen for any input on any web page or app.

vagabund• 4 years ago

Seems reasonable enough

filoleg3• 4 years ago

I was about to say, this is about as unsurprising and reasonable as Google Search listening to what you type into the search bar and which links on the search results page you click.

tinus_hn6• 4 years ago

Many sites, probably including Google Search, also monitor where you move your mouse cursor, even if you’re not clicking. A lot less reasonable and more surprising.

lizardactivist• 4 years ago

What else do they do, record your facial expressions and every sound you make while using the phone?

Talk about feeling like a lab-rat.

jmole• 4 years ago

They could, if battery life impact weren’t a thing. This is going to be the biggest “gotcha” with VR as well.

throwaway888abc• 4 years ago

I believe Amazon, Airbnb, airlines and many others are doing / were doing same on their web pages too. It allow to provide better personalized (TM) experience and significantly increase ROI.

There is good book how it works in offline world. https://www.npr.org/2017/02/13/514322899/aisles-have-eyes-wa...

Tepix2• 4 years ago

Just don't read it on a Kindle, another device which monitors everything you do (how long you remain on a page etc).

derwiki3• 4 years ago

I think of all the tech I use that could track me, I’m most OK with the Kindle. All my books come from Libby so the Library Industrial Complex also knows.

csommers• 4 years ago

Lots of companies use Glassbox to this degree.

cornedor• 4 years ago

There are so many sites that use Hotjar.

TheLoafOfBread2• 4 years ago

Apple iOS is turning into an Android, but without a headphone jack.

sphars• 4 years ago

Unfortunately, even most Android phones also are being made without a headphone jack nowadays

TheLoafOfBread2• 4 years ago

But I can still find a phone with headphone jack. Can't do that with Apple.

tinus_hn6• 4 years ago

Hate to break it to you but a few years after Apple made this daring move, almost all Android manufacturers have followed suit.

smoldesu3• 4 years ago

Android manufacturers also started beveling their phone corners after Apple made it popular, not that it made the phones easier to hold or easier to manufacture. It might be hard to imagine, I know, but sometimes Apple makes the wrong decision.

altairprime5• 4 years ago

OP misconstrues an iOS tracking dialog to support their complaint:

The strange thing is that Apple introduced strict measures in iOS 14.5 to prevent developers from fingerprinting users.

The dialog text in their screenshot reads:

Allow “App” to track your activity across other companies’ apps and sites?

Users refusing this permission are not prohibiting tracking by the company that issued the dialog. They are prohibiting the company from tracking users beyond the boundary of their corporation. Apple’s App Store app is within the boundary of Apple Corporation, and so the tracking dialog shown is not relevant to their complaint.

(I have no viewpoint to offer on OP’s argument beyond the logical reasoning error described above.)

tinus_hn6• 4 years ago

Also Apple doesn’t have any incentive to ‘fingerprint’ App Store users because they are either logged in or using a unique identifier.

2OEH8eoCRo0• 4 years ago

Sure they do. What if they switch accounts, usernames, phones, etc. More data is better.

altairprime5• 4 years ago

This argument’s logical reasoning error is to claim the absence of all incentive due to the absence of one incentive.

Apple has access to the logged-in account’s properties, as you assert, but this does not rule out Apple having other incentives for tracking.

m463• 4 years ago

you can use an apple device without logging into icloud

helsinkiandrew• 4 years ago

I have no viewpoint to offer on OP’s argument.

This doesn't look like tracking or fingerprinting at all to me - they're logging user interaction (that many apps and websites have done for decades).

Even if they didn't do this just about every click you make in the App Store results in a query to their backend for more information, presumably with the account id (so family, regional, parental control works).

amelius5• 4 years ago

Whatever Apple is doing, it should be possible to buy a phone and not have it phone home without permission. And you should be able to use the phone without ever contacting the vendor again. Otherwise you bought a service, not a product.

Also, I recall a case where MacOS was asking Apple permission whenever the user wished to start an executable. This is nuts.

_Algernon_• 4 years ago

That exists. It's called a dumbphone

coldtea2• 4 years ago

The line is blurry with smartphones, as all kinds of "smart" functionality IS a service, and depends on contacting the vendor.

Also, I recall a case where MacOS was asking Apple permission whenever the user wished to start an executable. This is nuts.

Not that nuts. It's intended to be able to blacklist malware and such and retroactively disable it, through notarization (basically, registering apps to Apple and them getting a kind of fingerprint).

They could have done it with a local cache (and they probably do in some capacity), but it would still need to ask/sync every now and then.

simondotau3• 4 years ago

The merits of your arguments aside, Apple is not obliged to sell you a device that satisfies your personal requirements.

Apple most definitely sells you a service, which is a managed computing platform. Alternatives exist. (And if they don’t, that’s not Apple’s problem.)

kmlx• 4 years ago

it should be possible to buy a phone and not have it phone home without permission. And you should be able to use the phone without ever contacting the vendor again.

don't connect it to the internet.

rplnt• 4 years ago

Apple doesn't even allow users to turn off Bluetooth or GPS (easily in a straight-forward way, it prevents you to make it easy). And while some of it is to provide a better experience to you, major reason is to provide service to other Apple customers.

dangus3• 4 years ago

Unless this person shows us Settings > Privacy & Security > Analytics & Improvements, the only thing I can conclude is that they left the setting on and they’re confusing third party app tracking controls with Apple’s analytics setting.

Nullabillity• 4 years ago

Doesn't that just say more about how obtuse these settings are designed to be though?

dangus3• 4 years ago

No. The settings pane has multiple sentence explanations for what the privacy settings do.

You're asked whether you want to send analytics to Apple as soon as you set up any device.

smoldesu3• 4 years ago

They literally say in the body of the first post, verbatim "(data usage & personalized ads are off)"

If the "only thing" you can conlcude is user error, you must be unfamiliar with the insane amount of ambient telemetry iOS/MacOS collects even when disabling analytics (OCSP ring a bell?)

dangus3• 4 years ago

"Data usage & personalized ads" is not the setting I'm talking about.

Personalized Ads is a different setting than the one I described, located in the "Apple Advertising" section, not the "Analytics & Improvements" section that I think the relevant setting lives in.

"Data usage" isn't the name of any setting on iOS, that phrase is too vague to be sure what they mean.

This is why I say that I'd like to see a screenshot of the relevant settings panes. How do I know this person didn't accidentally flip them back on during an update?

OCSP isn't relevant to this issue. It's not "analytics," it does not seem to collect personal data, anonymized or not.

OCSP is used to verify/revoke certificates, essentially for the purpose of removing malware and spam, which is a basic function consumer-friendly OS: https://apple.stackexchange.com/a/420002

To me that's a really legitimate use of a "phone home" when we're talking about commercial consumer operating systems.

beders• 4 years ago

We use LogRocket to record all interactions with our front-ends and it's awesome for trouble shooting and also invaluable for our product managers.

They can see where users are struggling with the app and where extra-guidance is necessary.

I'm assuming many many many other apps and web pages are doing the same thing.

Nothing to see here.

yjftsjthsd-h3• 4 years ago

That you find it useful doesn't make it not an invasion of privacy.

iLoveOncall• 4 years ago

That it's on your own app where you anyway know exactly which backend endpoint has been called by the user does.

I really don't get the outrage about that, it's something that has existed for 15 or 20 years at least and is used a lot on most websites you go on.

What private information do you think is sent to the vendor that would not be otherwise?

KingOfCoders• 4 years ago

Hopefully you have declared that in your privacy statement if you sell in the EU.

croes3• 4 years ago

We use cameras to record all interactions with our cupboards and it's awesome for trouble shooting and also invaluable for our product managers.

They can see where users are struggling with the furniture and where extra-guidance is necessary.

dkdbejwi3832• 4 years ago

I don’t think that’s a fair comparison. Screen tracking is essentially logging which UI elements users interact with and some metadata like the time, their device config, etc.

It doesn’t necessarily require capturing video of the user.

A better analogy would be hooking up a door open/closed sensor to the cupboard, and capacitive sensors that log the location of touches, so that you can analyse what % of users struggle to find the door handle.

croes3• 4 years ago

BTW which App?

benhurmarcel• 4 years ago

A major one

jeroenhd• 4 years ago

This is exactly why I distrust all the apps on my phone and desktop unless I've grabbed them from some reliable open source repository. The disgusting entitlement to stalk me at every step and use me as a lab rat is exactly what's wrong with modern software.

roguesherlock• 4 years ago

Tbh I don’t see it as a huge problem as long as a. The data is anonymous, and b. they aren’t trying to sell the data.

I mean if you choose to use someone’s service, you’d want it to get better. And one of the reasons they get better is by collecting feedback of what’s working, what isn’t.

It’s very hard to nail down a good ux without feedback.

onion2k• 4 years ago

Now imagine what LogRocket could do with that data when they blended it with data from their other users, or if they augmented it with data they bought in from other services. Or perhaps LogRocket could sell the data to a broker, and then on to [Meta|Google|me].

That's what you're doing to your users.

I'd consider that something to see.

(I don't have any evidence to believe LogRocket are doing this; LogRocket is just the example. Other tracking services exist, and they sure as hell do do this sort of thing.)

mensetmanusman• 4 years ago

After iOS 16 Apple asks for ‘analytics’ to improve iOS.

It is disingenuous of them to use the word ‘Tracking’ for everyone else and ‘experience improving’ for themselves.

comboy• 4 years ago

I mean, tracking lets companies identify you across different events. Apple doesn't need to ask for that when you are using iphone. I don't even mean it in a malicious way, just the fact that it will keep doing authenticated requests to their servers. They are not able not to track you while providing their services.

(this is regarding your comment not the article itself)

yesBut00• 4 years ago

I bought an Apple device. Did not sign up to be anyone else’s payday. I want Apple to improve their devices. Don’t care if anyone else benefits from it.

Really frustrating to live in a country that wants forced socialization if their is opportunity to make money off me, but otherwise I’m just a cost center.

In no way does my use of an Apple device act as an open door for anyone else.

I’m not interested in technology to help some coder feed himself but because tech is fun and intellectually interesting.

smoldesu3• 4 years ago

In no way does my use of an Apple device act as an open door for anyone else.

Sure, as long as your definition of "anyone else" excludes the NSA, FIVE EYES, China, anyone distributing Pegasus, Akamai and the rest of Apple's contractors.

dwaite• 4 years ago

You are still allowed to log into a google account. You are still allowed to set session cookies.

The text of the prompt people are talking about is "Allow MyApp to track your activity across other companies' apps and websites".

Third party tracking mandates permission. First party tracking and data sharing mandate disclosure.

interpol_p• 4 years ago

This is not what they are doing, though. As far as I can tell, Apple never does the kind of "Tracking" that is reserved for that popup — namely, using a unique identifier to track a user across apps & sites not owned by Apple

The Tracking popup requests that the user allows an application to send a unique identifier which can be correlated by other apps, advertising networks, social media platforms (eg. like buttons, embeds, etc), in order to correlate a user's identity between different properties on the web in order to personalise advertising. AFAIK Apple does not participate in this form of tracking

Apple does ask users if they want to opt-in to analytics (for Apple) and separately for third-party developers. This refers to allowing an application to submit analytics data purely for that application or for the operating system and not in a way which tracks the user between apps owned by different companies

In this case Apple is violating their own opt-in analytics policy with regards to the App Store application. It appears to be collecting analytics data even when a user has opted out of submitting analytics

harry82• 4 years ago

Apple: Proof you can pay and still be the product.

It's like someone breaking into your house and rummaging through your desk taking photos because that suits them and there is fine print. One day as a society having a networked cpu involved in someone doing something won't make nearly every lawmaker, lawyer, judge and customer have their brain fall out of their ear and they'll actually be able to think critically about it and respond.

"But facebrick/goog/the stasi are a little bit worse so..."

coffeeling• 4 years ago

A much easier example: TV manufacturers. High end TVs cost a couple arms and a leg and the UI is still infested with trackers and ads.

harry82• 4 years ago

Sure but the apple enthusiasts tend not to accept that because they're all companies where the managment is in Asia with those making decisions raised in the various and quite different to each other Asian cultures, (Japan, China, Korea etc.) Obviously this distinction is garbage. Surveillance capitialism is an american innovation.

Apple is as american as apple-pie. "If you don't pay for it you're the product." Comes up whenever Apple create yet another problem for which the "best" solution is to pay apple even more money.

Apple customers are an Apple product they sell. Paying Apple does not remove you from that. No matter who is your provider you are the product right up until the point someone can go to jail for it. Fines are merely a business expense and treated as such.

CEO can do time for breaking the rules. Whole different approach ensues.

What rules? How to enforce? How to interpret? How to ensure the courts don't just have a mental breakdown, throw up their hands and pass because a cpu attached to a network is on the critical path of what was done that would be clearly, wholly and totally illegal if it were replaced with an army of workers and a mountain of paper and filing cabinets.

jojobas• 4 years ago

One doesn't become a near-monopoly to play nice, you should assume everybody does everything they can get away with.

CharlesW2• 4 years ago

It's interesting that the researchers assumed turning off the transmission of device analytics would also turn off the transmission of all app analytics, whether from Apple or third parties.

I also wish they would've tried Lockdown Mode, at least.

HomePhone• 4 years ago

Per the article, other vendors do just that: “He and his research partner ran similar tests in the past looking at analytics in Google Chrome and Microsoft Edge. In both of those apps, Mysk says the data isn’t sent when analytics settings are turned off.”

gruez• 4 years ago

It's interesting that the researchers assumed turning off the transmission of device analytics would also turn off the transmission of all app analytics, whether from Apple

Given that the app store comes installed by default and can't be uninstalled, it seems fairly reasonable to assume that it's part of the OS. Therefore it's not unreasonable to assume that disabling "device analytics" would also disable app store analytics.

s3p3• 4 years ago

Lockdown mode didn't exist on iOS 14 sadly

ThePowerOfFuet2• 4 years ago

Lockdown Mode has absolutely nothing to do with any of this.

CharlesW2• 4 years ago

Your assumption is that Lockdown Mode doesn't change the scope of telemetry data sent back to Apple, but we don't know this, which is why testing it would be interesting.

Vt71fcAqt75• 4 years ago

I don't understand people still hanging on to the fiction that Apple is some sort of bastion of privacy. Do they know that google pays Apple "an estimated $8-12 billion"[0] to be default search and as a result track almost all iPhone users' searches? If that's not "selling your data" I don't know what is.

[0]https://www.nytimes.com/2020/10/25/technology/apple-google-s...

phendrenad23• 4 years ago

This is like complaining that your soundproof apartment isn't giving you the right level of privacy because when you stand on a soapbox in the town square and shout "I wear pink underwear" everyone knows what color your underwear are. If you want privacy, why not, you know, use the privacy features? (Like chat messages, which are NOT sent to Google).

Vt71fcAqt75• 4 years ago

I'm not sure you thought this through... Apple does not care about your privacy if they are willing to sell it for $12 Billion. I don't have an iPhone, and I never complained about them. To be honest, it's not clear that you even read my message at all. For context, I wrote that comment in a different thread and it got moved here: see https://news.ycombinator.com/item?id=33527500

derwiki3• 4 years ago

I have an iPhone and don’t use Google search (I’m not logged in to any Google services actually, unless Apple Mail loading Gmail counts) so I’m pretty sure Google is not tracking _all_ users’ searches.

Vt71fcAqt75• 4 years ago

Yes, you are right. Additionaly, chinese users are not using google, although they are certainly being tracked. I've added the word "almost" into my comment. So it now reads:

google pays Apple "an estimated $8-12 billion"[0] to be default search and as a result track almost all iPhone users' searches

heywoodlh2• 4 years ago

Disclaimer: happy iOS and Android user -- I like both platforms and think both have strengths and weaknesses. Mostly a Linux user on desktop.

Do they know that google pays Apple... to be default search

This statement comes off a bit ironic in the fact that you are pointing out a deal that Apple has with Google -- the current steward over Android -- as a reason that Apple isn't a bastion for privacy. This irony highlights the fact that one is often worse-off from a privacy perspective in using Android -- the main competitor to iOS -- because it is built with Google as a first party.

I absolutely agree that there is an exaggeration of privacy with Apple. But in most cases, iOS does actually do privacy better than Android. Private Relay, App Tracking Transparency and Google not being a first-party in the development in the Operating System are things that come to mind. Additionally, according to a research paper done in 2021, Google collects around 20x more data (around 1+ TB every 12 hours) on Android compared to iOS (around 6 GB)[0]. Even if the methodology behind the paper wasn't perfect (which Google claims) I don't think anyone would be surprised that Google collects more information than Apple.

My opinion is that the sweet spot for privacy on a mobile device is to buy a Pixel (for the great hardware security benefits) and go with a custom, de-Googled ROM like CalyxOS and try to use F-Droid for all your apps. For those who are even more hardcore, GrapheneOS is awesome.

In my opinion, stock Android is far worse for privacy than iOS simply because of Google's first-party influence. And then if you go with a vendor like Samsung you not only have Google as a first party on your mobile device but also Samsung.

The only option left if you want more privacy on mobile than an iPhone is to either flash a de-Googled ROM, like I said earlier, or to go with some sort of Linux distribution on mobile -- both of those alternatives come with huge downsides.

(Sorry for the rant, I always find this topic interesting)

[0] https://www.scss.tcd.ie/doug.leith/apple_google.pdf

Vt71fcAqt75• 4 years ago

I never said Google or android protect users privacy. Android violating users privacy is not to the exclusion of Apple doing the same even if to a lesser extent. Everyone knows how bad android is this respect. Yet there is this idea that Apple does care about users' privacy, and won't sell users' data, with apple themselves saying things like:

Your personal data should always be protected on your device and never shared without your permission. So we build encryption, on-device intelligence, and other tools into our products to let you share what you want on your terms.[0]

and

In iOS 11 and macOS High Sierra, we introduced Intelligent Tracking Prevention. You may have noticed that when you look at something to buy online, you suddenly start seeing it everywhere else you go on the web. This happens when a third party tracks cookies and other website data to feed you ads across various websites. Intelligent Tracking Prevention uses the latest in machine learning and on-device intelligence to reduce this cross-site tracking. It works by separating the third-party content used to track you from other browsing data, so what you look at on the web remains your business — not an advertiser’s.

This second statement, even if technically true, is incredibly disingenuous and misleading in light of the fact that typing anything that is not a URL into the safari search bar will by default cause tracking. _That's_ the issue here. "We don't sell your data, we just sell you to somone else that does"

[0]https://www.apple.com/ge/privacy/approach-to-privacy/

dang• 4 years ago

Related article, with some more background: https://gizmodo.com/apple-iphone-analytics-tracking-even-whe...

(via https://news.ycombinator.com/item?id=33527141, but we merged that thread hither)

midislack• 4 years ago

As Apple's in PRISM, I just assume everything on the device is sent to the NSA.

yrgulation2• 4 years ago

Every webapp with typeahead functionality does it. How is this any different?

speedgoose• 4 years ago

Apple is supposed to be good for privacy.

yrgulation2• 4 years ago

Indeed. Asking the question not because i am defending apple, but just pointing out that this common practice. If you want typeahead there is no way around sending all keystrokes. Poor phrasing on my end.

s3p3• 4 years ago

Why are they looking at software from 18 months ago and not iOS 16?

seydor• 4 years ago

It's for their own good

jjallen• 4 years ago

I don't know about you, but I basically assume every app is doing this. Is this really a surprise? Were not all apps doing this for a long time?

SCLeo• 4 years ago

Instagram? Facebook? Maybe.

I certainly did not think Apple would do this.

maronato• 4 years ago

Apple isn’t the savior of privacy. Their privacy features will only go as far as they can market it, and only for as long as they can profit from it.

nisegami• 4 years ago

I certainly did not think Apple would do this.

Their PR department certainly earns their keep.

deafpolygon2• 4 years ago

To be fair, they said they'd protect your data, not that THEY wouldn't collect it. They want to be the gatekeeper of it.

piyush_soni• 4 years ago

Repeat after me, "You are the product" only when you buy an Android phone.

dncornholio• 4 years ago

And this is news, why?

justapassenger• 4 years ago

Because Apple spends billions of dollars, for them fighting for user privacy and keeping all your data on the phone being a news.

sprite• 4 years ago

This is nothing new. Apple has been tracking searches in the App Store, which apps you scroll past and which ones you tap on very far back, maybe even since the initial App Store, that's how they figure out how to rank various apps for various search terms (I don't know the exact formula but one of the components is CTR for a particular search term, others appears to be rating score, number of ratings, number of written review, number of total downloads, download velocity, given keywords, title, company name, trademark, update frequency, etc).

If you search multiple times for the same term you will see a slight variation in search results, that's how they give apps a chance to move up or down. IE they move you down one slot but you still outperform the app above in CTR, you probably should remain in your current spot, or move up. Another app gets moved in front of their current ranking and the app that got moved down outperforms it in CTR, keep things as they are.

booleandilemma• 4 years ago

I'm seeing a lot of comments saying things like "seems reasonable" and "of course", but I thought Apple was supposed to be for the privacy conscious? Why is HN not bothered by this?

bakugo• 4 years ago

HN is full of not-so-subtle Apple marketers. Every other day I see a post about how privacy-first Apple is, but when the truth actually comes out the narrative instantly shifts to "well who cares, everyone else does that, stop noticing things"

2fast4you2• 4 years ago

My view on it, Apple is the least of all the evils. Even if they seem to be getting worse advertising wise

App Store on iOS 14.6 sends every tap you make in the app to Apple

Related Stories