Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google, Meta 'break' Apple's device fingerprinting rules

theregister.com

Post reply on HN
Print view View original

31–40 of 78 posts

Re: Google, Meta 'break' Apple's device fingerprinting rules

#31

Post by MBCook »

ipython wrote: post #2

I would believe this - after all how many billions of dollars did Google pay Apple to be the primary search engine on iOS? This further erodes my confidence in Apple doing the right thing and I think the EU is doing the world a service by setting in motion alternative app stores.

There’s a second set of rules for mega popular apps. Always has been. FB should have been permanently banned 15 years ago.

If you’re important enough Apple will let you get away with murder compared to normal devs. Users don’t buy phones without FB, Instagram, Spotify, WhatsApp, Google apps, etc.

There is only one time I remember anything happening to a big app. Fortnite probably could have tracked people for years. But the they took away Apple’s cut and publicly stuck a thumb in Apple’s eye at the same time. So they got booted.

Re: Google, Meta 'break' Apple's device fingerprinting rules

#32

Post by MBCook »

burnerthrow008 wrote: post #10
gruez wrote: post #7

Earlier quoted context omitted.

>I would believe this - after all how many billions of dollars did Google pay Apple to be the primary search engine on iOS? The OP also mentions Facebook and Spotify also are violating rules, and to my knowledge they're not paying apple "billions", so this explanation doesn't pass the sniff test. The actual reason is probably far more banal: these apps command a huge user base, which would be very upset if apple bann…

Could also be that they are afraid of more antitrust attention if they enforce the rules too strictly. The EU already handed Google the browser market on a silver platter, under the guise of “competition”. How much farther would they go if Apple prevented a perceived competitor from abusing users?

They’ve done this for years before the EU started stepping up.

I think a more likely explanation is they know what would happen to their sales numbers if they kicked off Facebook and Spotify.

Re: Google, Meta 'break' Apple's device fingerprinting rules

#33

Post by voltaireodactyl »

kernal wrote: post #28
poochkoishi728 wrote: post #14

Earlier quoted context omitted.

Devil's advocate: People using Android accept (for whatever reason) a less fluid, subpar UI and UX, while iPhone users are less likely to tolerate it (by nature of not using Android). Thus, using an iPhone could actually suggest a more sophisticated sense of taste i.e. being cooler.

Devil’s brother advocate: People prefer using iOS over Android because they cannot handle having complete control over their UI and UX. They prefer having strict rules on what they can and cannot do and what apps they can and cannot use.

It’s a division of markets similar to the auto industry: you see tons of Camrys customized with after market parts, but very rarely a BMW/Lexus similarly tricked out.

Re: Google, Meta 'break' Apple's device fingerprinting rules

#34

Post by refulgentis »

Spivak wrote: post #23
KerrAvon wrote: post #18

Earlier quoted context omitted.

Uptime can be pretty long on iOS devices, and the developers have no legitimate use for that information.

Not sure why you're being downvoted for this, iOS devices aren't servers, apps have very little control over their lifecycle, and the existing time APIs for an app's internal sense of time are plenty. There is no reason at all an app would need to know this random piece of global state. I'm not even sure why Apple offers the real uptime instead of an offset starting when the app first called the API. It's the first t…

Cupertino, if you're listening, I'm not comfortable with the offset either, that would also do fine as an identifier.

Re: Google, Meta 'break' Apple's device fingerprinting rules

#35

Post by refulgentis »

MBCook wrote: post #31
ipython wrote: post #2

I would believe this - after all how many billions of dollars did Google pay Apple to be the primary search engine on iOS? This further erodes my confidence in Apple doing the right thing and I think the EU is doing the world a service by setting in motion alternative app stores.

There’s a second set of rules for mega popular apps. Always has been. FB should have been permanently banned 15 years ago. If you’re important enough Apple will let you get away with murder compared to normal devs. Users don’t buy phones without FB, Instagram, Spotify, WhatsApp, Google apps, etc. There is only one time I remember anything happening to a big app. Fortnite probably could have tracked people for years.…

15 years ago apple was proudly announcing they were integrating Facebook accounts into iPhone OS and making their APIs available to apps, to thumb their nose at Google. (iPhone OS 4, IIRC)

That's part of why Facebook felt rightfully indignant when Apple moved to kneecap attribution and acted like it had never heard of it

Re: Google, Meta 'break' Apple's device fingerprinting rules

#36

Post by yosito »

ajross wrote: post #15
gruez wrote: post #5

Original source, buried within the article: https://www.mysk.blog/2024/05/03/apple-required-reason-api/

Yeah, this is much clearer than The Register's attempt to summarize/explain/sensationalize it. And the meat seems... pretty bland. They caught a bunch of "plausibly fingerprinty"[1] tokens (that a reasonable interpretation of Apple policy would require being stored on the device) being sent unobfuscated in later requests. That looks a lot more like a genuine mistake by developers than a real attempt to evade tracking…

Uptime might be somewhat ephemeral, but it can be a pretty clear signal to indicate that two different user profiles are actually the same person. For example, it would be a plausible explanation for why even when I took several steps to hide my identity when creating a new Meta account (new Safari profile, tracking blockers, VPN, anonymous email account, etc), Facebook immediately suggested all of the contacts from my other account as friends. Or perhaps they picked up on some other signal. My point is, I absolutely don't consent to my devices sending their uptime to third parties without explicitly asking me every time.

Re: Google, Meta 'break' Apple's device fingerprinting rules

#37

Post by SunlitCat »

havaloc wrote: post #6
SunlitCat wrote: post #4

Earlier quoted context omitted.

[flagged]

No, it's because SMS is awful. I'm looking forward to see how well Apple implements RCS and how many of these problems go away.

Well, my comment wasn't aiming towards the technical details (which I even agree!), but more about the social background, with people considering other people who "just send green text" as "lesser". And no, it's not just the "young people crowd", but a certain part of society.

Re: Google, Meta 'break' Apple's device fingerprinting rules

#39

Post by SunlitCat »

samplatt wrote: post #25
poochkoishi728 wrote: post #14

Earlier quoted context omitted.

Devil's advocate: People using Android accept (for whatever reason) a less fluid, subpar UI and UX, while iPhone users are less likely to tolerate it (by nature of not using Android). Thus, using an iPhone could actually suggest a more sophisticated sense of taste i.e. being cooler.

Devil's advocate or just trolling? I can't bloody stand using Apple's unintuitive garbage. I have great admiration for the hardware, but trying to drive their O/S I've always found to be a horribly frustrating experience.

While their mobile OS doesn't differ much in usability from android phones, the ux / ui on their desktop operating system can be quite frustrating, confusing and especially if you come from a windows world, outright weird.

Re: Google, Meta 'break' Apple's device fingerprinting rules

#40

Post by jonas21 »

KerrAvon wrote: post #18
ajross wrote: post #15

Earlier quoted context omitted.

Yeah, this is much clearer than The Register's attempt to summarize/explain/sensationalize it. And the meat seems... pretty bland. They caught a bunch of "plausibly fingerprinty"[1] tokens (that a reasonable interpretation of Apple policy would require being stored on the device) being sent unobfuscated in later requests. That looks a lot more like a genuine mistake by developers than a real attempt to evade tracking…

Uptime can be pretty long on iOS devices, and the developers have no legitimate use for that information.

The only monotonically increasing clock available on iOS is based on uptime. If you need to measure accurate timings or guarantee that events are in the right order, you have to use it. As Apple points out in their guidelines, there are many legitimate uses for this information.

Developers can add an offset to the values before sending them off the device, and that might be what Apple wants them to do, but these companies have over a decade of pre-existing code that didn't do this. It's not surprising to me that there are things that haven't been updated yet given that Apple only made these requirements public fairly recently.

Post reply on HN