Oh, the Places Your Apple ID Will Go

https://pxlnv.com/blog/oh-the-places-your-apple-id-will-go/

by HelenePhisher • 4 years ago

336 151 4 years ago

pxlnv.com

trollied• 4 years ago

Good to see somebody talking sense. Lots of journalists jumped on this, framing Apple as evil.

At a high level, the whole thing is no different to a website using a cookie to keep you logged in.

kleiba• 4 years ago

But cookies I can choose not to allow, right?

Cthulhu_2• 4 years ago

Well yeah, your browser, your rules; it'll just come at a convenience fee of having to log back in every time, and that for the duration of your session you HAVE to have a cookie or your login won't work. There used to be an alternative of a session ID in every URL, but I haven't seen that in years.

jll29• 4 years ago

A cookie is not a PII identifier, it is an "identity discriminator".

In other words cookies let them tell you the _same_ person 104898 that was already here in March, welcome back!, and not any other person e.g. 298472, but without telling them your actual name etc.

In contrast, a PII identifier is a unique ID that is linked to personal attributes in real life like a person's name ("John Doe"), address ("6400 Boulevard Court, Beverly Hills, CA"), e-mail address ("john.doe@acm.org") or credit card number ("VISA 4879 5223 6537 9935").

So, this is indeed different from visiting a Website that places a cookie.

Rygian• 4 years ago

PII is never black or white. "_same_ person 104898" will become PII at any moment when the site can collate it on a one-to-one mapping with some other PII of yours (e.g. your email or login).

From GDPR Recital 30: "Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them."

So your Apple ID becomes PII for a specific site at the precise instant you share any other PII to that site, that they are able to link to the Apple ID.

amelius4• 4 years ago

Apple ID is still a cookie and that is enough for me to avoid them like the plague.

tzs• 4 years ago

VISA 4879 5223 6537 9935

I'm curious where that number came from. It passes the Luhn check so it probably isn't just some random number, and has the right first few digits for Visa but doesn't match any of the Visa test card numbers that I happen to know.

Looking up the issuing bank from the first 6 digits gives inconsistent results. Half of the several BIN lookup sites I tried just say it is from the US. The other half say it is from Blom bank in the country of Lebanon.

Googling it gives me a small number of sites about "unlimited credit card numbers that work 2022" which seem quite shady but I can't quit figure out what the heck that are actually trying to accomplish.

Here are those sites: https://www.financegab.com/credit-card/unlimited-credit-card... and https://paisabank.org/unlimited-credit-card-numbers-that-wor...

headsoup3• 4 years ago

Except there's no opt-out or prompt to inform you. Quite a difference I'd say.

JamesSwift• 4 years ago

This seems pretty different. This is a _cross channel correlated ID_. In other words, this is able to (and presumably used for) tying the user record together between multiple, separate applications. This isn't a "generated ID that only identifies you within the current application vertical". Those IDs would not be able to cross-correlate between other app properties if leaked. The IDs as described in the article would be able to be used to build out a more rich "permanent record" on the given user as more information flows in from various apps.

TylerE• 4 years ago

Isn’t this a misunderstanding of what PII is? An evil entity, given this couldn’t unmake me the way they could with a name, e-mail, or even IP

withinboredom5• 4 years ago

If it can be traced to a natural person, it is PII. IP addresses are PII, ids are PII. It is in the name "Personally Identifiable Information." If it can be used to personally identify you, it's PII.

If you gave me this ID number, I could use it to locate your information in breached db dump, or if it is used in API requests, impersonate you.

null_object• 4 years ago

or if it is used in API requests, impersonate you

You're suggesting it's an authorization token - which it obviously is not.

glitchc2• 4 years ago

No, that's not the definition of PII. That the ID maps to a person doesn't mean they know that person's SSN, which is PII.

IP counts as metadata. It uniquely identifies you as an entity but does not reveal other details except geographic location. If IP addresses are PII, then any use of the internet is violating your privacy. Perhaps unplug your modem, turn off cell service on all devices and read a book instead.

lern_too_spel2• 4 years ago

It is tied to your Apple ID, which is tied to those details.

cmeacham983• 4 years ago

I may be getting something wildly wrong here, but I am not sure I see the presence of this Apple ID proxy in Apple’s services logs to be a violation of either its own policies or users’ expectations for using internet services in general.

I strongly disagree that the iOS App Store should be treated as an "internet service" rather than a part of the device. The iOS App Store only comes on iOS devices, it comes on all iOS devices, and it is the only way to access a crucial feature of the device. It is, for all meaningful purposes, part of the iPhone in the same way iOS is.

It would be a bit like Microsoft saying "explorer.exe? Policy A only covers the OS, and that is clearly not part of Windows! - so therefore you are covered by Policy B". While Apple may be legally in the right, I strongly believe they are morally in the wrong and have betrayed the trust their users put in them to safeguard their privacy.

I believe that a casual user of the iPhone would take a look at Apple's iPhone privacy policy and expect that to apply to the iOS App Store as well, as for all intents and purposes that is a part of the iPhone.

simonh4• 4 years ago

I strongly disagree that the iOS App Store should be treated as an "internet service"

It’s entire purpose is to look up data and download stuff across the internet. How can it not be an internet service? How much use could it be if it was cut off from internet connectivity, what would you even do in it?

Lukas_Skywalker• 4 years ago

Sure, it requires internet for it to work, just as the phone itself requires cellular service so you can make a call. Calling is still part of the phone.

Of how much use is an iPhone without the App Store? You can still use the preinstalled apps, but your expectation as a consumer is that you can install new apps. This expectation is broken without the App Store.

1vuio0pswjnm72• 4 years ago

"It would be like Microsoft saying "explorer.exe? Policy A only covers the OS, and that is clearly not part of Windows! - so therefore you are covered by Policy B."

This made me remember a long time ago when I ran Windows I used to disable explorer.exe by editing a certain registry key.

Not sure if this still works today, but it did back then. This reduced distraction as only one window could be maxmized at a time. Also made the OS feel more stable and snappier. In any event it was one less memory-consuming process running.

drooopy• 4 years ago

I remember that back in the windows 95 days i used the same trick to load progman.exe instead of explorer.exe during boot.

I was too used to the Windows 3.1 desktop environment...

klabb3• 4 years ago

Finally, someone puts words on the irks I felt the last times this came up. Thank you.

Apple is basically loopholing all the shitty ad-tech engagement surveillance bs that plagues the rest of the industry through the app store, pretending like it's any other app. Of course they can, but a lot of the hard-line privacy stuff goes down the drain with the hypocrisy.

What bothers me is that Apple really doesn't have to move in this direction, at all. They've been uniquely positioned to basically do things that nobody else can, because they sell so much expensive hardware. Instead, all mega corps seem to blend together and follow the same playbook. It's sad.

dessant3• 4 years ago

The public dismissal of the evidence these researchers presented in the last few weeks was surprising. It isn't truly important whether the App Store is an integral component of iOS, which it practically is until Apple becomes compliant with the provisions of the Digital Markets Act, it merely compounds their legal issues due to ignoring user intent when iOS analytics are disabled.

The main issue here is that Apple has been collecting personal data for years through its own apps without informed consent, which is in breach of GDPR. You need to ask for express consent to collect personal data in the form of non-essential user analytics, having a privacy policy and a toggle in settings to opt out of data collection is not enough, and it does not matter if the data collection is done by a website, app or an operating system.

It was particularly frustrating to see people argue that it's just an older version of iOS, when the reality is that one needs to hack an iPhone to see how this data is being syphoned off, and that jailbreaks for new iOS versions can be prohibitively expensive to achieve. Despite that, researchers pointed out that they see similar encrypted packets being sent with a recent iOS version.

I think it's worrying that consumers can't inspect the traffic of a device they own, and this is also an area that should be regulated so that our rights are respected.

bsenftner2• 4 years ago

Instead, all mega corps seem to blend together and follow the same playbook. It's sad.

Yet another glaring indicator identifying our species as not mature enough to manage our own society. If this occurs everywhere, no matter what, then it is us, our constitution, our chemistry, our maturity as a species that is at fault.

interpol_p• 4 years ago

Apple is basically loopholing all the shitty ad-tech engagement surveillance bs that plagues the rest of the industry

That's a pretty extreme description of what's happening here. I agree that they should not be doing this, and that App Store analytics should be opt-in like the rest of the device analytics, however, they are not correlating your unique identifier with other web properties — i.e. when you visit through Safari. I also doubt they are selling that data to third parties, allowing ads to target you on the basis of it, or using it to build a profile against other application analytics.

In fact, it seems like the article says: they do no clever stuff with it whatsoever. They should remove it in a future update

yreg4• 4 years ago

Devil's advocate:

Contrary to explorer.exe, App Store is an internet service in the sense that it requires sending requests to backend for pretty much any user action. There is zero functionality without a data connection.

newaccount743• 4 years ago

How does that justify logging user actions? Just because you can log customer requests does not mean it is morally right to do so.

quickthrower22• 4 years ago

Windows is now entirely an internet service as you need a microsoft account and internet connection to install it.

2OEH8eoCRo0• 4 years ago

Uninstall requires a backend? If uninstall doesn't require a backend then it's not an internet service. It's manipulating things on-device.

It's a package manager and tracker designed in such a way that it only talks to Apple's backend.

It's still the system package manager though.

r0m4n02• 4 years ago

I'm not sure what is being argued by the semantics here but the app store is an important aspect of the device but does that make it not an internet service? An app store by definition is almost a direct equivalent to a web browser. It's just a tool to allow you to move data/code onto your device to do more things. Without it, your device still has a functioning OS. Apple has coupled the functionality of app installation and a curated remote repository of apps on the internet and bundled it as "the app store." I'd say most people aren't referring to the app installation aspect when they refer to the app store.

If an app store is a glorified web browser and apple is maintaining content that is loaded into it, it's almost the definition of an internet service no?

placatedmayhem• 4 years ago

It's not just a web browser, though. It's the sole method to install software, most similar to a package manager on a desktop operating system. On your point, many package managers do have the ability to browse the remote index of the software they can install (e.g. `brew search [X]`, dnf search [X]`). However, the primary purpose of a package manager, including the App Store, is to install and manage software. This is a critical operating system function, made more critical on iOS by the fact that the App Store is the only way to get software.

cmeacham983• 4 years ago

Let me repost what I wrote elsewhere in this thread:

The point is not that the App Store isn't an online service (although I would argue that it more "relies on" an online service), but that its role as part of the OS supersedes that.

I can't go back and edit my comment now, but to make it more clear I probably should have written something like:

I strongly disagree that the iOS App Store should be treated as ___only___ an "internet service" rather than...

timmg• 4 years ago

I strongly disagree that the iOS App Store should be treated as an "internet service" rather than a part of the device.

It's also on the web, e.g.: https://apps.apple.com/us/app/facebook/id284882215

Which means apps, for example, show up on Google searches.

newaccount743• 4 years ago

Can someone explain why the App Store doesn't show the "Ask App Not To Track" dialog?

Why do 3rd party apps have to ask for permission to track, but Apple's apps do not?

chrischen• 4 years ago

The information Apple holds on users is valuable so they don't want third parties to get it for free.

wingerlang• 4 years ago

I'm only picking things up passively but as far as I have read, it is because the App Store does not track you across OTHER COMPANIES apps and websites. If they only track you within their own Apple ecosystem, they don't need to ask for permission (same as other apps).

smoldesu7• 4 years ago

Facebook kept their shadow profiles to themselves, but that didn't make it any less gross. Defending Apple's data collection on the basis that "they don't share it" is like defending a guy taking creepshots of you in the bathroom because he doesn't look like the sort of person who would cause you trouble.

simonh4• 4 years ago

Tracking is about following breadcrumbs across activity in third party apps. So if the Facebook app uses identifiers in common with Uber, and can see what you do in Uber or something, that’s tracking. Recording what you do in a single app, or apps from one company that isn’t strictly necessary for providing the service is telemetry.

Apple doesn’t share user data and identifiers with third parties except as necessary to provide specific services, so it doesn’t track. It does record telemetry though, most of that is in a non personally identifying way, but some of it can be traced to a user.

Obviously identifying information necessary to provide a service is different. If I buy an app off the App Store, they need to identify who bought it. The edge cases are things like, do they need to know I searched for fitness apps on the App Store and associate that with my ID. Amazon does on their web site so they can show ads related to my recent searches, but it’s not strictly necessary for providing the service.

_heimdall2• 4 years ago

Agreed that is the technical distinction made today, but for an end user that really is splitting hairs.

When Apple is offering first-party services that compete with Netflix, Spotify, etc. my privacy concern is that someone is tracking and aggregating data on what I watch and listen to.

As a user I don't really care if that's two separate corporations sharing unique identifiers or two departments in the same umbrella corporation, it's still a privacy concern.

Cthulhu_2• 4 years ago

There's probably a line in the T's and C's that nobody reads when you first start up the phone where you give them permission. Reading the other comments, it will be in there if they even need to ask; on websites, websites do not need to ask for permission for functional cookies.

rahoulb2• 4 years ago

I read somewhere (sorry can't remember where but it was quite recent) that Apple has defined "tracking" as "allowing third parties to monitor you over multiple sites and apps".

My that definition, Apple, as a first party, is not tracking you (and likewise, I can monitor you over my apps but not allow anyone else access to that data)

UPDATE: It was from AppStore Connect itself, when you fill out the privacy data form.

Also here: https://support.apple.com/en-gb/HT211970 "data from the app that is linked with your data collected from other companies’ apps, websites or offline properties, and used for ads or shared with a data broker."

taneq• 4 years ago

Sounds exactly like Google’s definition. “Private” means “just between you and Google.”

mtts• 4 years ago

This definition is not necessarily wrong. It’s easier for them to argue that they need telemetry to provide (and improve) their own services than it is to argue some third party advertising behemoth needs it. The former is perfectly acceptable, also according to the GDPR (first party advertising is also A-Ok according to he GDPR, btw).

amelius4• 4 years ago

Why don't apps show the EU cookie banner? It seems that apps have an unfair advantage over websites.

Aaargh20318• 4 years ago

App do not have an advantage here. the EU 'cookie law' doesn't mention cookies at all. All it says is that you cannot track users without permission, and that this permission must be freely and explicitly given. It's just that this is usually done using cookies on websites, but the specifics don't matter. Apps absolutely have to ask for permission before tracking a user.

Now if this is actually enforced or not is a different matter.

scarface749• 4 years ago

Unfair advantage == it isn’t a usability nightmare caused by ignorant lawmakers

ezfe• 4 years ago

Because "Ask App Not To Track" refers to (for all apps, not just the App Store) tracking across different systems/companies.

For example, a Weather app collaborating with an ad sales company to provide them tracking data would violate "Ask App Not To Track," but Facebook tracking you within the Facebook app does not because it's all internal.

The reason for this is just about the practicality of enforcement: You cannot enforce companies not doing internal tracking because they still have to collect data for their business, so how do you distinguish it.

nonrandomstring• 4 years ago

I see a lot of very intelligent people here unable to agree upon a matter that seems, in essence, simple enough.

That is in itself troubling and partly answers a question.

If developers on Hacker News cannot fathom whether Apple deceptively transmitted PII, or whether zealous journalists are over-egging the pudding, then we have another problem.

Obfuscation is a form of deception through complexity. It can be hard to tell from the outside whether that complexity is "necessary" and whether its ill effects are deliberate or accidental.

Nevertheless, it remains a form of deception if you present a system as simple, with controls that apparently do understandable things as a front for another system that even you, as a developer, no longer understand. This same theme is coming up in AI, social algorithms, moderation/censorship of speech. We are muddying the waters in the hope that people believe they are shallow.

sendfoods• 4 years ago

Could not have expressed my thoughts more clearly.

headsoup3• 4 years ago

And some would say this is a deliberate adversarial tactic to guide people to surrender their privacy and freedoms, because those that would defend them can't sufficiently explain the complexity to be more convincing than 'simple' messages.

smoldesu7• 4 years ago

We say that because Apple has a history of using deliberate adversarial tactics to abuse the market and claim dominance. It's almost as iconic as Google killing off their own products.

BLKNSLVR2• 4 years ago

I think this can be explained by simple denial; Apple's reality distortion field, or some variation on "It is difficult to get a man to understand something, when his salary depends on his not understanding it." Maybe not salary, but a foundational world view, much like religion.

I mean, people on HN will argue that it's wrong to block ads, a point of view that only makes sense to me through the lens of the above quote.

But, yes, it's a big problem because people that don't factor in the inherent biases of those making the arguments will take on those biases without the salary that makes it make sense. Is that like a Stand Alone Complex?

Ensorceled4• 4 years ago

I think this can be explained by simple denial; Apple's reality distortion field, or some variation on "It is difficult to get a man to understand something, when his salary depends on his not understanding it." Maybe not salary, but a foundational world view, much like religion.

My personal view, which I presume is the same as many others, is that these things keep being a "if there is smoke, there's fire" situation. Yes, this could be abused, but is it?

Meanwhile, in full "what aboutism" mode, I know Google does crappy shit with my data, I know Meta is full blown flaming evil. I know Ad Tech has the entire world ablaze with privacy abuse.

Meanwhile, people keep pointing to smoke from Apple and screaming that I just can't see what they think they see ...

hellfish3• 4 years ago

I mean, people on HN will argue that it's wrong to block ads

I've never seen this attitude here. Not once. Do you have any examples?

eugenekolo2• 4 years ago

Can you show me where obfuscation was mentioned? The DSID is transmitted clearly in many web requests from iOS. SSL isn't a form of obfuscation.

I don't think there's anything wrong in transmitting an ID to a web service, but I'm not actually sure what Apple claimed about privacy.

scarface749• 4 years ago

You’re logged into an Apple device with your Apple ID going to an Apple online service where Apple obviously knows what you bought. Saying that Apple is keeping track of what you do on their service is like saying that you didn’t know your doctor has your medical records and took notes of your interactions with them

knorl• 4 years ago

This "Directory Services Identifier" is not sent outside of Apple's services though right? And only sent to Apple services that need to know the identity of the user?

If so I'm wondering what the issue is here.

Ensorceled4• 4 years ago

The issue is that iCloud knows that I'm the same Apple user coming to get my files from iCloud as accessed the App Store!!! With my Apple account!

Wait ... I'm also not sure what the issue is.

Fundamentally this is only a problem because Apple is too big and controls the App Store, iCloud and all the rest of your device. This is a reasonable artifact of an unreasonable situation.

I also think Apple is too big but I'm more concerned about Big Pharma, Big Oil, Big Banks, Ad Tech, Growing Fascism, ... Big Apple is a worry way down on my list.

rkagerer• 4 years ago

It seems a little more leaky than I'd expect:

Because that identifier is also used in some iCloud API requests, I also spotted the same value in activity logs for third-party applications using things in my iCloud account, as well as in metadata for local copies of documents I downloaded from my drive at iCloud.com.

eugenekolo2• 4 years ago

It's a little unclear what they mean here, but that can easily be because of a service/system server model. The third party apps use things like "icloud daemon" (not sure that one actually exists) which does the iCloud request and passes along the data back to the app. Because the logs are generated with a high privilege level, they are also including what icloud daemon did for those specific apps, but those apps did not get access to that DSID, it was kept internal to icloudd.

If the journalists or whomever wants to claim the DSID is leaky, then they need to show a POC with an app actually obtaining that DSID, and not only in a system logger that only saves files sandboxed locally, or sends to Apple.

flyingsky• 4 years ago

Reason x why I'm rooting for Zack and his metaverse bet! I love the iPhone & Mac but I dislike apples approach to "privacy" feels hypocritical

headsoup3• 4 years ago

Not sure if sarcasm, but just in case...

My friend you need to open a window and see the rest of the world that exists outside that binary choice...

Ensorceled4• 4 years ago

Well, even if it's a binary choice ... Facebook is the weird bit to pick.

sdze• 4 years ago

That's why I turned all this junk OFF on all my apple devices. Why would I help them better their software? Hire more test engineers.

emsixteen2• 4 years ago

We also showed earlier that the #AppStore keeps sending detailed analytics to Apple even when sharing analytics is switched off.

charcircuit• 4 years ago

Why would I help them better their software?

Because you too benefit from the software you use getting better.

emsixteen2• 4 years ago

That's completely besides the points. When you choose to opt out you're explicitly indicating you don't want this to happen.

lapcat2• 4 years ago

Some trivia: the "DS" in DSID is "Directory Services", which is a giant Apple-internal database. Apple employees and contractors have a DSID too. It's basically a database of all people that Apple knows, and it's very old.

bryan_w• 4 years ago

Would you say it could contain shadow profiles of anyone who ever used any apple product (e.g. opened iTunes on windows)

lapcat2• 4 years ago

No, I don't think so. It would contain anyone who ever created an Apple ID though.

BirAdam• 4 years ago

Well, I’m not surprised. All the megacorps seem to be crap at privacy because privacy interferes with their lucre. So, Apple is just another Google, Microsoft, Meta, Amazon, etc. I know that they advertised otherwise, but that’s a matter for court and truth in advertising laws; personally I’ve always assumed that every phone is a passive surveillance device.

pacifika2• 4 years ago

Allegedly it’s fine because they’re collecting information for internal use and not sharing with third parties, but really the industry is trying to redefine tracking as cross service/site tracking. Well I think they should set the same bar internally

shawn-butler• 4 years ago

Why?

What is the value in anonymizing your voluntary engagement within a single corporate entity?

As long as that entity provides me with an accurate reporting of access when I request it?

Why for example would I want to make it any more difficult for my doctor at a hospital and the hospital pharmacy to share my confidential health information to ensure I get the right treatment?

pacifika2• 4 years ago

1) tech companies should not be Doctors. Apple is not a doctor. 2) there are additional privacy protections around medical uses, for these reasons.

hellfish3• 4 years ago

What is the value in anonymizing your voluntary engagement within a single corporate entity?

Because up to a certain point it isn't voluntary

Why for example would I want to make it any more difficult for my doctor at a hospital and the hospital pharmacy to share my confidential health information to ensure I get the right treatment?

Because principle of least privilege. This is one example, another could be the doctor sharing health data with an internal hospital logging service, which is utilizing some cloud service, which is utilizing some other cloud service, etc

jensensbutton• 4 years ago

IF it's fine then why was Google data collection ever an issue?

JKCalhoun• 4 years ago

I am also shocked by the granularity of information in these storefront analytics. It is relevant to Apple’s recommendation engine if I listened to an album or song and whether I finished it, but it is hard to see what value it has in knowing my track playback to the millisecond.

Not surprised. As soon as it was possible to get this kind of information about app usage (thanks, Internet!) of course management wanted everything.

Apple has its own privacy teams that work with the teams developing apps. Data collection is treated as a Big Deal and "Privacy" will grill you on every single byte that you want to collect. And any bit of data that might reveal personally-identifiable-information is a nonstarter.

As an example, we could not report back error messages from the OS, only error codes. Why? Error code might be "123" but error message could be "Error 123, You just removed hard drive 'Calhoun Data' without unmounting..."

Perhaps the downside of this gatekeeping though is that I feel it causes management to come to the table asking for everything, letting privacy whittle it down. With major app release cycles 6 or 12 months apart, I think management sometimes don't know what data they might want - would rather not have to wait perhaps up to a year for the new metric to be included.

yencabulator• 4 years ago

Data collection is treated as a Big Deal and "Privacy" will grill you on every single byte that you want to collect.

I find this optimistic view hard to reconcile with the article. It seems collecting personally identifying data is the default mode. For example:

I have a spreadsheet of the nearly nine hundred times me and my DSID ignored Apple’s attempts to upsell me on Apple One

hellfish3• 4 years ago

This isn't really all that surprising

Anyone who uses Apple/Google/Microsoft/other products as intended will have no privacy. By as intended, I mean using chrome while logged into a google account, using MacOS while logged into an apple account (and using all of apple's internal applications), using android with a google account, etc

I wouldn't be surprised if the usage data, health data, from e.g. iOS+services goes straight to data brokers. I can't prove this, but it wouldn't surprise me. Even if it didn't, there's no guarantee of how the data will be used internally (or whether it's given to law enforcement, for example)

If someone uses these products as intended and has even the slightest expectation of privacy (e.g. believing any of the vague BS in the TOS), they're probably not the sharpest knife in the drawer (or at the very least, grossly misinformed)

talkingtab• 4 years ago

Leaving behind the discussion of whether this is a problem, it is a problem for me. I paid Apple for a device. I don't want Apple to use devices to track me or target me with ads or anything else. That is my personal take.

But what can you do assuming that you want or need a phone? Android is no better. Class action lawsuits enrich law firms and get users a gift card for $0.20 (sarcasm).

I just wonder what would happen if everyone who doesn't want this decides to take Apple to small claims court? These companies, Google, Apple, Microsoft, Facebook continue to violate fundamental rights to privacy because they have no reason to stop. There are no significant penalties.

Or perhaps we need a bill of rights. Anyone know of such a thing?

giancarlostoro• 4 years ago

Anyone reading this article from Illinois is about to have a fun time with Apple, their privacy laws are reasonably strict. Of course, I'm not a layer, so maybe they found the one legal "loophole" or lawful way to do it.

raxxorraxor• 4 years ago

I think in case of any smartphone OS, you are sadly not really the owner of the device and in contrast the manufacturer has wide reaching permissions for everything. That is partially true for desktop OS as well, but at least here you can override everything to your liking. Those that argued for these mechanism in the interest of security do not get any sympathy from me.

Complaining after that fact seems pointless. If you had administrative rights, you wouldn't have as many issues with being tracked. Being able to freely modify the software running the device and accessing its hardware in the same manner would paint a different landscape.

gunapologist992• 4 years ago

But what can you do assuming that you want or need a phone? Android is no better.

GrapheneOS, Calyx, and LineageOS would like a word..

lern_too_spel2• 4 years ago

Android is no better.

You don't have to use an app store that violates your privacy on Android. You don't have to send your location to Google every time you get your GPS location, unlike how iOS sends all your GPS lookups to Apple. Android is far better. The key difference is user control.

rthomas6• 4 years ago

I use GrapheneOS and it works reasonably well for limiting the amount of data I send to Google. I still use the play store, but you don't have to, you can go 100% open source and Google-free. And Play Services is optional and sandboxed so it doesn't get any privileges beyond what a normal app gets, so you can block tracking and it spying on other apps' usage.

ProAm• 4 years ago

The irony of Tim Cook only a few years ago claiming they don't want your data [1] "We treasure your data. We wanna help you keep it private and keep it safe."

[A] https://observer.com/2019/05/tim-cook-apple-data-privacy-cru...

gunapologist992• 4 years ago

Apple’s analytics data include an ID called “dsId”. We were able to verify that “dsId” is the “Directory Services Identifier”, an ID that uniquely identifies an iCloud account. Meaning, Apple’s analytics can personally identify you. Apple states in their Device Analytics & Privacy statement that the collected data does not identify you personally.

Even if legal, this is obviously a very bad look for a company that claimed they were all about privacy and took actions against competitors to protect users' privacy.

sneak3• 4 years ago

Apple is only about privacy as a marketing differentiator.

Apple's software clearly demonstrates that they do not place a high value on user privacy. iPhones and Macs phone home constantly with all sorts of information even if you never use iCloud or the App Store or Apple's service offerings. It's ridiculous.

user3939382• 4 years ago

Yep. Set up Charles Proxy (GUI) or mitmproxy (CLI) if you want to take a look at the actual data. It's huge and non-stop. Some of this even Little Snitch can't stop because it's sent to random IPs inside huge blocks belonging to Apple with no DNS. Unless you go to extraordinary lengths it's the same with Firefox FYI.

These companies' privacy concerns are a marketing gimmick, and the situation is so out of control we have to be thankful even for those crumbs.

gcanyon2• 4 years ago

I'm curious: do you think Apple is exactly as invasive as the companies they compare themselves to? Or are they not as invasive, but still not as non-invasive as their marketing materials claim?

beders• 4 years ago

I really don't get the outrage.

I assumed that by stepping into Apple's walled garden, they would know and store:

- where my devices are

- what I'm doing with them (i.e. apps downloaded and started, which features I use yadda yadda yadda

- any app I download and use will independently log all my taps and interactions within that app

- and since I use iCloud: where all my data is

What would make you think otherwise?

Helmut10001• 4 years ago

All of these issues with UIDs make me believe that we should maybe transition to Probabilistic Data Structures and group users randomly together, e.g. based on HyperLogLog abstracted UIDs. Only the user device itself would have the full ID, the service would get an abstracted, probabilistic version of it, which can (and will) collide with other abstracted IDs. Thus, the service could never be 100% sure who exactly a single user is - out of a group of (e.g.) 12 people that happen to yield the same probabilistic representation.

(I know there're also many issues with this approach, so take it with a grain of salt)

dang• 4 years ago

Recent and related:

Apple sends DSID with iPhone analytics data, tests show - https://news.ycombinator.com/item?id=33695937 - Nov 2022 (111 comments)

Proposed class action alleges that Apple tracks users despite privacy assurances - https://news.ycombinator.com/item?id=33593455 - Nov 2022 (191 comments)

App Store on iOS 14.6 sends every tap you make in the app to Apple - https://news.ycombinator.com/item?id=33520775 - Nov 2022 (190 comments)

rswail• 4 years ago

The use of tracking is acceptable under the GDPR if it is necessary for providing the product/service. The Apple ID, being necessary for determining the applications you have bought/are installing would be considered necessary. Permission to have it is not required.

If the Apple ID is shared to another 3rd party by Apple, then it is not just being used for providing the product/service. So it would be required to get permission under GDPR.

Apple sells a service which is iPhone+iOS+App Store. While it is technically possible to separate, Apple doesn't. It's all required. So the Apple ID is required for doing that.

The fact that the Apple ID can be associated to an individual and their PII is something that theoretically could be isolated, but Apple are not required by law or regulation to do so as long as their use of the ID stays unshared and "necessary".

Oh, the Places Your Apple ID Will Go

Related Stories