Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple’s Anti-Tracking Plans for iPhone

foundation.mozilla.org

Post reply on HN
Print view View original

211–220 of 403 posts

Re: Apple’s Anti-Tracking Plans for iPhone

#211

Post by alwillis »

littlestymaar wrote: post #127
objclxt wrote: post #87

Earlier quoted context omitted.

> They spy on their users as much as anyone else (and overall, they have access to much more information than everybody else except Google). This is easily disproven by making a GDPR access request to see what various companies have retained on you, or if you’re extra paranoid inspecting what the device is sending back over the network.

Well, less than a month ago all Mac apps worldwide refused to open because the listening service at Apple failed to respond, so you don't even have to look at the network to know that Apple is spying… Apple has access to all apps you open, your position, the content of your iCloud, etc. etc.

Short answer: apps are signed with a developer's certificate they get from Apple; the OCSP check for certificate validation went down. To put this in context, whenever you connect to a secure website, OCSP is used to make sure the certificate is still valid (unless OCSP stapling is used, but that's another issue). BTW, OCSP checks are unencrypted, but Apple says it will change to an encrypted protocol.

And it wasn't all apps—unsigned apps are allowed to run, so by definition, there's no way for Apple to "know" about them. Many people didn't know it was happening because they weren't affected.

Details: https://eclecticlight.co/2020/11/16/checks-on-executable-cod...

Re: Apple’s Anti-Tracking Plans for iPhone

#212

Post by 0x53 »

jforman wrote: post #181
rndgermandude wrote: post #163

Earlier quoted context omitted.

Ad fraud... How exactly is this my problem as a consumer? This sounds pretty much like a "you" (ad networks and advertisers) problem... So why should you be allowed to spy on me - who never defrauded any advertisers - to fix your problem?

Because it makes advertising more expensive, which in turn makes the products and services you use more expensive.

I think most places have a somewhat fixed advertising budget. Hopefully the outcome would be less advertising!

Re: Apple’s Anti-Tracking Plans for iPhone

#213

Post by jefftk »

suprfsat wrote: post #139
sradman wrote: post #133

Earlier quoted context omitted.

> it has literally no purpose beyond mining peoples' data Its main purpose is targeted ads while repurposing or reselling peoples’ data is a nefarious secondary use. Multi-sided markets are important revenue models that are tailored to user preferences and behavior. We are trying to strike a balance; we don’t need to demonize all advertising centric business models to win the argument for better privacy options. I th…

How do you propose to target ads without mining peoples' data?

One of the most common cases of targeting ads is remarketing: someone comes to your site, they start the process of buying a tablesaw but then leave for whatever reason. You pay to show ads of the saw so they can come back and finish their purchase if they want to.

Traditionally, this has been implemented with third party cookies. The retailer drops a cookie on the users browser, and then buys ads to be shown to anyone matching that cookie. I don't know if I would call this data mining, but it is certainly not private.

It is possible to build a system that supports remarketing in a private way, however, with new browser APIs: https://github.com/WICG/turtledove

(Disclosure: I work on ads at Google, speaking only for myself)

Re: Apple’s Anti-Tracking Plans for iPhone

#214

Post by pwinnski »

ThePhysicist wrote: post #22

In Europe, cross-app, cross-browser & cross-device tracking is on very thin ice legally under the GDPR, so I'm not surprised Apple finally curbs the use of "sticky" identifiers on their devices. Honestly, it's a bit shameful that a device that is marketed as the gold standard in privacy would even support such an identifier in the first place, it has literally no purpose beyond mining peoples' data. Now that the thir…

Things have changed really dramatically in in the last 13 years or so. When iPhone first launched, developers could (and did) just grab the UDID of the device and use that.

Apple has been restricting things almost from day one, and creating the IDFA in the first place was part of that, but this seems like the biggest step forward by far.

Re: Apple’s Anti-Tracking Plans for iPhone

#216

Post by snarf21 »

pradn wrote: post #157
LC_ALL wrote: post #50

Say what you want about Apple but they are by far the most privacy focused big company. Their income is from selling physical devices. Typical megacorps in 2020 are leveraging economies of scale to sell their users' attention. Apple has a unique value add in that when their users benefit they benefit. Sent from my Thinkpad.

Apple gets on the order of $12 billion a year from Google to make Google Search the default search engine in iOS. All that money comes from ads. They care about privacy until it hits their pocketbook.

And they will probably have to stop doing so very soon.

Re: Apple’s Anti-Tracking Plans for iPhone

#217

Post by fumar »

coldpie wrote: post #196
jforman wrote: post #181

Earlier quoted context omitted.

Because it makes advertising more expensive, which in turn makes the products and services you use more expensive.

I would be thrilled if online advertising became unviable as a business model. Most of what makes the web suck today (megabytes of javascript on every page; clickbait articles; outrage-driven social media; warehouses of PII waiting to be bought/sold/stolen) is because of advertising. Yes, I do want to pay for the services I use.

How would you pay for the services and content you consume?

Re: Apple’s Anti-Tracking Plans for iPhone

#218

Post by HatchedLake721 »

shawnz wrote: post #206
HatchedLake721 wrote: post #177

Earlier quoted context omitted.

They haven't just "lately been marketing themselves as an improvement over Google and Microsoft". Anyone aware of Apple's history knows that Apple has always pushed consumer privacy forward, forcing others in the industry to follow. I don't know any other consumer electronics company other than Apple that has been championing consumer privacy so much over the last 12-15 years. If you learned about Apple's stance on p…

What are they doing that other vendors aren't? From what I can tell their privacy-forward marketing began with the rollout of the Secure Enclave in the 5S, but Android vendors were already using hardware key stores and full disk encryption at that time. I will admit that this action to change the advertising ID to default-off is a promising one though.

This is a good overview from last week what they've done so far (where others had to follow) and what they're doing next

https://youtu.be/08IC1AZTxls?t=2941

Re: Apple’s Anti-Tracking Plans for iPhone

#219

Post by jefftk »

alwillis wrote: post #211
littlestymaar wrote: post #127

Earlier quoted context omitted.

Well, less than a month ago all Mac apps worldwide refused to open because the listening service at Apple failed to respond, so you don't even have to look at the network to know that Apple is spying… Apple has access to all apps you open, your position, the content of your iCloud, etc. etc.

Short answer: apps are signed with a developer's certificate they get from Apple; the OCSP check for certificate validation went down. To put this in context, whenever you connect to a secure website, OCSP is used to make sure the certificate is still valid (unless OCSP stapling is used, but that's another issue). BTW, OCSP checks are unencrypted, but Apple says it will change to an encrypted protocol. And it wasn't…

> To put this in context, whenever you connect to a secure website, OCSP is used to make sure the certificate is still valid

This is not how any browser implements it today. Browsers either do not check (Chrome, Safari) or check but fail open (Firefox, Edge). I'm not aware of any browser that fails closed in its default configuration. More: https://www.ssl.com/article/how-do-browsers-handle-revoked-s...

Browsers primarily handle revoked certs by pushing certificate revocation lists (CRLs).

Re: Apple’s Anti-Tracking Plans for iPhone

#220

Post by pwinnski »

fbelzile wrote: post #205
LC_ALL wrote: post #50

Say what you want about Apple but they are by far the most privacy focused big company. Their income is from selling physical devices. Typical megacorps in 2020 are leveraging economies of scale to sell their users' attention. Apple has a unique value add in that when their users benefit they benefit. Sent from my Thinkpad.

> Their income is from selling physical devices. Not entirely true anymore: 1) About $8-12 billion paid by Google to have their search engine default. [1] 2) About $20 billion from their 15-30% cut of third party app developers. Where the App Store is protected from competition. [2] 3) Apple services (like Apple TV+), which collects usage data for itself and third parties. [3] [1] https://www.macrumors.com/2020/10/25…

Apple revenue for the last year was $275 billion. So you've listed 3.5%, 7%, and probably-rounds-to-0% of their revenue, which doesn't seem like it actually counters the original point.
Post reply on HN