Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google, Meta 'break' Apple's device fingerprinting rules

theregister.com

Post reply on HN
Print view View original

71–78 of 78 posts

Re: Google, Meta 'break' Apple's device fingerprinting rules

#71

Post by Spivak »

caf wrote: post #60
Spivak wrote: post #23

Earlier quoted context omitted.

Not sure why you're being downvoted for this, iOS devices aren't servers, apps have very little control over their lifecycle, and the existing time APIs for an app's internal sense of time are plenty. There is no reason at all an app would need to know this random piece of global state. I'm not even sure why Apple offers the real uptime instead of an offset starting when the app first called the API. It's the first t…

The first-time-the-app-called-the-api-since-device-boot is just as unique as device-boot-time.

It isn't though, at least not in the same way. It's not as if apps can't generate unique identifiers like a UUID. What's important for fingerprinting isn't that it's unique but that it's stable across different apps which this wouldn't be. You could maybe try to eek out a bit of information with "value is greater than" but it would be hard to orchestrate because you can't guarantee that all apps will be first used around the same time.

Re: Google, Meta 'break' Apple's device fingerprinting rules

#72

Post by nozzlegear »

int_19h wrote: post #69
nozzlegear wrote: post #66

Earlier quoted context omitted.

I expect Apple to figure out how to provide apps with such a timer in a way that also prevents them from having access to the system uptime.

If there's a random offset applied, how would they have access to the actual system uptime?

I don’t know, like I said, I expect Apple to figure that out. Their engineers get paid to figure out such problems, not me!

Re: Google, Meta 'break' Apple's device fingerprinting rules

#74

Post by xyst »

Tagbert wrote: post #42
xyst wrote: post #38

The claims of privacy by Apple are just a facade. I’m done with this walled in ecosystem (jail). They have good looking products but the company itself is as rotten as their competition.

And you got all of that from an article about Google and Facebook, maybe, trying to get around Apple’s attempts to provide more privacy?

It’s a history of this behavior that has convinced me that Apple’s claims of being a privacy advocate is nothing but lip service.

Re: Google, Meta 'break' Apple's device fingerprinting rules

#75

Post by yencabulator »

caf wrote: post #58
idle_zealot wrote: post #45

Earlier quoted context omitted.

Surely the fix here is to lie to apps about uptime, adding the offset at the OS level.

"boot time plus random offset" is going to be just as much of a fingerprint as "boot time" is, though (the offset can't change once picked for a boot because the whole point is to be able to calculate the time between events in the app). Something that reduces the granularity a lot, like "time since UTC 00:00:00 on the day of the last device boot", might work.

Make the offset app-specific. Then pretend the phone ran out of memory and ask the app to terminate every now and then, switch to a new random offset for every run.

Re: Google, Meta 'break' Apple's device fingerprinting rules

#76

Post by int_19h »

nozzlegear wrote: post #72
int_19h wrote: post #69

Earlier quoted context omitted.

If there's a random offset applied, how would they have access to the actual system uptime?

I don’t know, like I said, I expect Apple to figure that out. Their engineers get paid to figure out such problems, not me!

My original response in this thread was to a comment that said, "I'm not comfortable with the offset either".

Re: Google, Meta 'break' Apple's device fingerprinting rules

#77

Post by int_19h »

refulgentis wrote: post #55
int_19h wrote: post #53

Earlier quoted context omitted.

You expect apps to have no access to a simple monotonic timer?

I expect privacy theater; I err towards having opinions that enforce privacy - i.e. a time that's guaranteed to be x seconds since the app first started after system boot can be used to diminish privacy

Why would you expect privacy theater, though. Apple genuinely tries to frustrate this kind of snooping from (third-party) apps, so if they choose to obfuscate the timer in the first place, I don't see what the point is for them to make it a security theater. The obvious and trivial implementation for this is adding a random number, and that's what any minimally competent dev will do unless specifically told otherwise. So, why would they be told otherwise?

Re: Google, Meta 'break' Apple's device fingerprinting rules

#78

Post by Tagbert »

xyst wrote: post #74
Tagbert wrote: post #42

Earlier quoted context omitted.

And you got all of that from an article about Google and Facebook, maybe, trying to get around Apple’s attempts to provide more privacy?

It’s a history of this behavior that has convinced me that Apple’s claims of being a privacy advocate is nothing but lip service.

or it's more complicated than a simple all or nothing rule.
Post reply on HN