Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The UDID leak is a privacy catastrophe

corte.si

Post reply on HN
Print view View original

51–52 of 52 posts

Re: The UDID leak is a privacy catastrophe

#51

Post by mistercow »

zmb_ wrote: post #45
api wrote: post #26

Earlier quoted context omitted.

I think this proves that Apple's UDIDs are a horrible, insecure system. That is a privacy catastrophe.

Not really. The UDID itself is not a "horrible, insecure system", it's just a unique identifier. It's the app developers who came up with the horrible, insecure systems due to how they used the UDID. The problem is that the developers do not understand how to engineer secure systems. Take away the UDID and their systems will still be broken, just in a different way.

That said, it does pose an interesting question as to what Apple could have done to prevent this eventuality. One possibility would have been not to expose a global device ID to developers, but instead to generate a per-app (or maybe per-developer-key) ID. That would have made such a leak extremely difficult, and would have isolated the damage to whatever vulnerabilities were present in a single app.

You're right that these developers would have made something broken regardless of whether this problem existed, but Apple should try not to give them enough rope to hang themselves. What's fascinating is that "globally visible unique identifier" turns out to be just enough rope.

Re: The UDID leak is a privacy catastrophe

#52

Post by prof_hobart »

idunno246 wrote: post #44
lekashman wrote: post #43

Earlier quoted context omitted.

If they've deprecated the feature, are they doing anything instead to accomplish the same effect as the UDID?

They aren't actually rejectIng apps. But yes, they're replacing it with something akin to androidid. Check the uidevice doc for ios6 if you have it. The real problem is the lack Of referral tags on installs. Android got this right I think. As it is ever advertiser uses a different hash of some Id whih means I have to store every possible identifier in plain text to hash later. Considering we have 3 million udids, Mac…

Are you sure that they aren't rejecting? I've read a fair few stories like this - http://thenextweb.com/apple/2012/03/29/confirmed-apple-now-r... - that seem to suggest that they are.
Post reply on HN