Smart app banners don’t work in webviews, so on iOS you could block this technique by using a different browser. However, most iOS browsers set a different user agent that’s distinct from Safari, which might make you even more fingerprintable.
Smart App Banners can be used to reveal Apple ID region
11–20 of 23 posts
Re: Smart App Banners can be used to reveal Apple ID region
#12I hate those things. Anyone know of a way to get rid of them?
In particular, the "Open in the X app" banner is obnoxious. I get showing it once, but if I remove it, don't show it again.
Re: Smart App Banners can be used to reveal Apple ID region
#13> de-anonymize Where by "de-anonymize" they actually mean "detect what region the user's Apple ID is set to". The fingerprinting value of this is pretty weak, especially since, in most cases, it'll be the same as the country inferred from the user's IP. It's also trivial for Apple to mitigate if they consider it to be an issue -- they can make the banner appear regardless of whether the app is available to the user.
Your Apple ID country has a lot of implications if changed (certain app access will be available/restricted, payment methods, etc). You aren't going to be able to identify a user specifically, but you could detect if a user is currently traveling internationally or may be a frequent VPN user.
This is the case anyways with the user’s IP.
Re: Smart App Banners can be used to reveal Apple ID region
#14Earlier quoted context omitted.
Your Apple ID country has a lot of implications if changed (certain app access will be available/restricted, payment methods, etc). You aren't going to be able to identify a user specifically, but you could detect if a user is currently traveling internationally or may be a frequent VPN user.
This is the case anyways with the user’s IP.
The problem is that combining the two would actually give you significantly more information than either individual datapoint. A mismatch between Apple ID region and IP region will very reliably identify a subset of users (either expats or travellers).
Re: Smart App Banners can be used to reveal Apple ID region
#15The method de-anonymises to the “Apple ID region”. At most it gets your country. By design Apple’s own iCloud Private Relay¹ anonymises at best to the country level, so I doubt they’ll see this method as a problem. Though important to note: > this information remains constant across various networks and VPN usage. ¹ https://support.apple.com/en-us/HT212614
However the exit nodes used by Private Relay always map to your current country and not the billing region of the Apple ID, thus a persistent discrepancy is still possible.
Re: Smart App Banners can be used to reveal Apple ID region
#16Earlier quoted context omitted.
This is the case anyways with the user’s IP.
The problem is that combining the two would actually give you significantly more information than either individual datapoint. A mismatch between Apple ID region and IP region will very reliably identify a subset of users (either expats or travellers).
Or VPN users, which is still relatively small.
Re: Smart App Banners can be used to reveal Apple ID region
#17This works around VPNs, but something similar could also be done using the Accept-Language header or JS internationalization (Intl.DateTimeFormat().resolvedOptions().timeZone). It's a clever find, but also very disruptive to the user when it happens, and even using a binary search tree still takes a long time.
The accept-language header isn't very reliable. For example, I'm not anywhere near the US but my language is set to en-us because that is where I'm from originally (same with the timezone trick). So you end up just identifying immigrants, migrants, and tourists, not necessarily people on a VPN.
Re: Smart App Banners can be used to reveal Apple ID region
#18> de-anonymize Where by "de-anonymize" they actually mean "detect what region the user's Apple ID is set to". The fingerprinting value of this is pretty weak, especially since, in most cases, it'll be the same as the country inferred from the user's IP. It's also trivial for Apple to mitigate if they consider it to be an issue -- they can make the banner appear regardless of whether the app is available to the user.
Ok, we've changed the title to reflect that. Thanks!
(and thanks also to the user who emailed this suggestion to hn@ycombinator.com)
Re: Smart App Banners can be used to reveal Apple ID region
#19This works around VPNs, but something similar could also be done using the Accept-Language header or JS internationalization (Intl.DateTimeFormat().resolvedOptions().timeZone). It's a clever find, but also very disruptive to the user when it happens, and even using a binary search tree still takes a long time.
The accept-language header isn't very reliable. For example, I'm not anywhere near the US but my language is set to en-us because that is where I'm from originally (same with the timezone trick). So you end up just identifying immigrants, migrants, and tourists, not necessarily people on a VPN.
True, all three (including the Apple ID region) are not very reliable.
Re: Smart App Banners can be used to reveal Apple ID region
#20Good find. I’m mostly surprised that Safari allows you to show a banner for any app. I would have thought that Apple would validate that the domain of the site matches what is registered in App Store Connect before it shows the banner, but apparently not. Not a huge deal, you’re not fully de-anonymizing the user, but it’s an information leakage regardless.
> domain of the site matches what is registered in App Store Connect before it shows the banner, but apparently not.
This might be by design... For example, a podcast website might be interested in showing a banner for the app that you can get their podcast on. (This isn't a defence of the banners themselves, which IMO are naggy and unnecessary)