Smart App Banners can be used to reveal Apple ID region
fingerprint.com
Smart App Banners can be used to reveal Apple ID region
1–10 of 23 posts
Re: Smart App Banners can be used to reveal Apple ID region
#2The method de-anonymises to the “Apple ID region”. At most it gets your country. By design Apple’s own iCloud Private Relay¹ anonymises at best to the country level, so I doubt they’ll see this method as a problem.
Though important to note:
> this information remains constant across various networks and VPN usage.
Re: Smart App Banners can be used to reveal Apple ID region
#3> de-anonymize
Where by "de-anonymize" they actually mean "detect what region the user's Apple ID is set to". The fingerprinting value of this is pretty weak, especially since, in most cases, it'll be the same as the country inferred from the user's IP.
It's also trivial for Apple to mitigate if they consider it to be an issue -- they can make the banner appear regardless of whether the app is available to the user.
Re: Smart App Banners can be used to reveal Apple ID region
#4Good find. I’m mostly surprised that Safari allows you to show a banner for any app. I would have thought that Apple would validate that the domain of the site matches what is registered in App Store Connect before it shows the banner, but apparently not.
Not a huge deal, you’re not fully de-anonymizing the user, but it’s an information leakage regardless.
Re: Smart App Banners can be used to reveal Apple ID region
#5> de-anonymize Where by "de-anonymize" they actually mean "detect what region the user's Apple ID is set to". The fingerprinting value of this is pretty weak, especially since, in most cases, it'll be the same as the country inferred from the user's IP. It's also trivial for Apple to mitigate if they consider it to be an issue -- they can make the banner appear regardless of whether the app is available to the user.
Definitely a click-bait title. I'd argue the IP alone gives you even more useful information.
Re: Smart App Banners can be used to reveal Apple ID region
#6> de-anonymize Where by "de-anonymize" they actually mean "detect what region the user's Apple ID is set to". The fingerprinting value of this is pretty weak, especially since, in most cases, it'll be the same as the country inferred from the user's IP. It's also trivial for Apple to mitigate if they consider it to be an issue -- they can make the banner appear regardless of whether the app is available to the user.
I presume they also allow you to detect if you have the app installed or not.
Re: Smart App Banners can be used to reveal Apple ID region
#7> de-anonymize Where by "de-anonymize" they actually mean "detect what region the user's Apple ID is set to". The fingerprinting value of this is pretty weak, especially since, in most cases, it'll be the same as the country inferred from the user's IP. It's also trivial for Apple to mitigate if they consider it to be an issue -- they can make the banner appear regardless of whether the app is available to the user.
I presume they also allow you to detect if you have the app installed or not.
No, the banner shows up either way and the size of the banner doesn't change based on whether the app is installed or not. So there's no way to determine whether or not the app is installed using this method.
Re: Smart App Banners can be used to reveal Apple ID region
#8> de-anonymize Where by "de-anonymize" they actually mean "detect what region the user's Apple ID is set to". The fingerprinting value of this is pretty weak, especially since, in most cases, it'll be the same as the country inferred from the user's IP. It's also trivial for Apple to mitigate if they consider it to be an issue -- they can make the banner appear regardless of whether the app is available to the user.
Your Apple ID country has a lot of implications if changed (certain app access will be available/restricted, payment methods, etc). You aren't going to be able to identify a user specifically, but you could detect if a user is currently traveling internationally or may be a frequent VPN user.
Re: Smart App Banners can be used to reveal Apple ID region
#9Earlier quoted context omitted.
I presume they also allow you to detect if you have the app installed or not.
No, the banner shows up either way and the size of the banner doesn't change based on whether the app is installed or not. So there's no way to determine whether or not the app is installed using this method.
I thought a web page could take a screenshot of itself which would include the banner, but apparently that’s a complete new rendering.
Re: Smart App Banners can be used to reveal Apple ID region
#10This works around VPNs, but something similar could also be done using the Accept-Language header or JS internationalization (Intl.DateTimeFormat().resolvedOptions().timeZone).
It's a clever find, but also very disruptive to the user when it happens, and even using a binary search tree still takes a long time.