Live data from Hacker News

Ask HN: How do Google's iOS apps track your identity even after reinstalling?

news.ycombinator.com

11–20 of 23 posts

Re: Ask HN: How do Google's iOS apps track your identity even after reinstalling?

#11
post #8

More importantly, how can gmail preserve your identity yet after every update it asks again if you want to view links with Chrome (which, by the way will have to be installed), no matter how many times you select "Do not ask again"?

Asking the important questions

Re: Ask HN: How do Google's iOS apps track your identity even after reinstalling?

#12
post #9

There are basically two ways this can work: the old way, and the new way. In the old way, an implementation detail of the Keychain was that data saved in the Keychain would not be purged on app uninstall. Basically, the Keychain can be thought of as a fancy key-value store where your keyspace is further scoped to your app's bundle ID. It's intended to provide a secure place to generate and store keys, etc., but you c…

Any Apple engineers reading this, please give users control over this. This is a privacy hole.

Don't think they can. Keychain is supposed to be a secure storage solution, so I can't imagine they want users to be able to view that data, and it would be hard to manage it without knowing what it was.

That said, I found a post from last year saying that they would like to phase key-chain persistence out at some point, but it was fairly free of actual commitments.

Re: Ask HN: How do Google's iOS apps track your identity even after reinstalling?

#13
post #9

There are basically two ways this can work: the old way, and the new way. In the old way, an implementation detail of the Keychain was that data saved in the Keychain would not be purged on app uninstall. Basically, the Keychain can be thought of as a fancy key-value store where your keyspace is further scoped to your app's bundle ID. It's intended to provide a secure place to generate and store keys, etc., but you c…

Any Apple engineers reading this, please give users control over this. This is a privacy hole.

How?

Re: Ask HN: How do Google's iOS apps track your identity even after reinstalling?

#15
post #12
post #9

Earlier quoted context omitted.

Any Apple engineers reading this, please give users control over this. This is a privacy hole.

Don't think they can. Keychain is supposed to be a secure storage solution, so I can't imagine they want users to be able to view that data, and it would be hard to manage it without knowing what it was. That said, I found a post from last year saying that they would like to phase key-chain persistence out at some point, but it was fairly free of actual commitments.

> it would be hard to manage it without knowing what it was.

If you wanted to remove all Google data from your phone, surely it would be enough to just display the app name.

Re: Ask HN: How do Google's iOS apps track your identity even after reinstalling?

#16
post #12
post #9

Earlier quoted context omitted.

Any Apple engineers reading this, please give users control over this. This is a privacy hole.

Don't think they can. Keychain is supposed to be a secure storage solution, so I can't imagine they want users to be able to view that data, and it would be hard to manage it without knowing what it was. That said, I found a post from last year saying that they would like to phase key-chain persistence out at some point, but it was fairly free of actual commitments.

> so I can't imagine they want users to be able to view that data

Why not? They allow you to see your passwords that are stored in the keychain. And on macOS I can poke around the keychain to my heart’s content.

It would be ralatively easy to provide a way to dump an app’s (or app group’s) keychain values in Settings.app.

Re: Ask HN: How do Google's iOS apps track your identity even after reinstalling?

#17

There are basically two ways this can work: the old way, and the new way. In the old way, an implementation detail of the Keychain was that data saved in the Keychain would not be purged on app uninstall. Basically, the Keychain can be thought of as a fancy key-value store where your keyspace is further scoped to your app's bundle ID. It's intended to provide a secure place to generate and store keys, etc., but you c…

ISTR it's the latter, so that users don't need to enter username and password (and maybe 2FA) five times because they install five different Google apps.

Re: Ask HN: How do Google's iOS apps track your identity even after reinstalling?

#18

One way is saving data in keychains. Data persist between installation in keychain until you erase the iPhone. You can easily track the device and user with keychain.

I would also think keychain syncing could also play a part in this as well.

Re: Ask HN: How do Google's iOS apps track your identity even after reinstalling?

#19
post #8

More importantly, how can gmail preserve your identity yet after every update it asks again if you want to view links with Chrome (which, by the way will have to be installed), no matter how many times you select "Do not ask again"?

Probably intentional? If user had selected Safari. I would use this as an excuse to ask again and upsell chrome.

Re: Ask HN: How do Google's iOS apps track your identity even after reinstalling?

#20
post #12
post #9

Earlier quoted context omitted.

Any Apple engineers reading this, please give users control over this. This is a privacy hole.

Don't think they can. Keychain is supposed to be a secure storage solution, so I can't imagine they want users to be able to view that data, and it would be hard to manage it without knowing what it was. That said, I found a post from last year saying that they would like to phase key-chain persistence out at some point, but it was fairly free of actual commitments.

You can set some expiration linked back to the app that created that pair and when that app goes away that invalidates that pair, or have app related containers inside the Keychain that also get removed with the app. It is an implementation detail.
Post reply on HN