No, the UDID is a privacy catastrophe.
UDID is a few years old is it not? It's surprising it took people this long to figure this out.
Apple has been telling devs to move away from it for a least a year.
The UDID leak is a privacy catastrophe
41–50 of 52 posts
Re: The UDID leak is a privacy catastrophe
#42Earlier quoted context omitted.
UDID is a few years old is it not? It's surprising it took people this long to figure this out.
Apple has been telling devs to move away from it for a least a year.
Yeah and there was an outcry over that, and nobody saying "Good decision." As Microsoft learned in the '90s, when you're on top nobody's going to do anything but rip on you.
Re: The UDID leak is a privacy catastrophe
#43Given that the UDID has been deprecated in iOS5 and Apple are now rejecting apps that use it, I'd be interested to see what level of actual vulnerability there is these days.
If they've deprecated the feature, are they doing anything instead to accomplish the same effect as the UDID?
Re: The UDID leak is a privacy catastrophe
#44Given that the UDID has been deprecated in iOS5 and Apple are now rejecting apps that use it, I'd be interested to see what level of actual vulnerability there is these days.
If they've deprecated the feature, are they doing anything instead to accomplish the same effect as the UDID?
They aren't actually rejectIng apps. But yes, they're replacing it with something akin to androidid. Check the uidevice doc for ios6 if you have it.
The real problem is the lack Of referral tags on installs. Android got this right I think. As it is ever advertiser uses a different hash of some Id whih means I have to store every possible identifier in plain text to hash later. Considering we have 3 million udids, Mac address, etc... This particular leak is unimportant.
Re: The UDID leak is a privacy catastrophe
#45Earlier quoted context omitted.
Have a quick read through the posts linked in the article this story points to. I show that using just a UDID, you could access the user's geolocation, games they played, private messages and friends lists on many of the affected social networks, and in some cases (which affected millions of users) completely take over Twitter and Facebook accounts. This is with _just_ a UDID. Some of the companies I notified a year…
I think this proves that Apple's UDIDs are a horrible, insecure system. That is a privacy catastrophe.
Not really. The UDID itself is not a "horrible, insecure system", it's just a unique identifier. It's the app developers who came up with the horrible, insecure systems due to how they used the UDID.
The problem is that the developers do not understand how to engineer secure systems. Take away the UDID and their systems will still be broken, just in a different way.
Re: The UDID leak is a privacy catastrophe
#46The server is really slow, is this being run an an FBI laptop? (asking for people to upload their UDID)
Re: The UDID leak is a privacy catastrophe
#47> If your UDID is contained in the list, take a minute to help us identify the traitor that did give your information to the FBI without any your agreement and without warrant ! Wouldn't it also be useful to gather information about who WASN'T on the list and what Apps they have? Maybe device type as well.
> identify the traitor that did give your information to the FBI
Interesting use of the word "traitor" to mean "person who cooperates with the Government".
Re: The UDID leak is a privacy catastrophe
#48A quick reminder for iOS developers:
Apple has provided a number of replacements for UDID, that address some of the UDID uses without it being as much of a privacy problem. It's all still under NDA, so I posted my summary on the Apple's developer forums (iOS developer login required): https://devforums.apple.com/message/723147
Re: The UDID leak is a privacy catastrophe
#49Given that the UDID has been deprecated in iOS5 and Apple are now rejecting apps that use it, I'd be interested to see what level of actual vulnerability there is these days.
If they've deprecated the feature, are they doing anything instead to accomplish the same effect as the UDID?
Re: The UDID leak is a privacy catastrophe
#50No, the UDID is a privacy catastrophe.
No more so than, say, a MAC address. The problem wasn't UDID, it's what people were doing with it.