SecureUDID Is An Open Source Solution To The Apple UDID Problem
1–10 of 19 posts
Re: SecureUDID Is An Open Source Solution To The Apple UDID Problem
#2Question: In the example given, you supply a salt and a domain when coming up with your UDID.
Isn't the salt of another app really easy to decompile and figure out?
After that, a competing app could find out if you've used the device ID already, which actually seems less secure than the original UDID apple provided.
The last thing I want is for apps I install to phone home with a list of other apps I have installed!
Re: SecureUDID Is An Open Source Solution To The Apple UDID Problem
#3In his Android Pro-tips talk, Reto Meier (tech lead on the Android Developer Relations team) recommends generating a random UUID and saving it in your app's SharedPreferences. The Android BackupManager will backup SharedPreferences in the Google cloud. If the user restores their user profile from the BackupManager to a new phone, their UUID will be preserved.
http://blog.radioactiveyak.com/2011/05/android-protips-where...
Re: SecureUDID Is An Open Source Solution To The Apple UDID Problem
#4Question: In the example given, you supply a salt and a domain when coming up with your UDID. Isn't the salt of another app really easy to decompile and figure out? After that, a competing app could find out if you've used the device ID already, which actually seems less secure than the original UDID apple provided. The last thing I want is for apps I install to phone home with a list of other apps I have installed!
If any of your apps has registered a custom URL scheme, and many do, any other app on your phone can easily check to see whether it's installed. That's by design.
Back when I was keeping up, it was also possible to read the mobile installation cache and get access to all of your installed applications, which is what some 'app recommender' applications did. That was an exploit which violated App Store policies - no idea if it still works.
Re: SecureUDID Is An Open Source Solution To The Apple UDID Problem
#5What a lot of apps really need is for Apple to provide a UDID replacement that gives a different ID per app, but is consistent if the app is deleted and re-installed on the same device. SecureUDID is still based on CFUUID which is not consistent across re-installs.
Re: SecureUDID Is An Open Source Solution To The Apple UDID Problem
#6Interesting. Based off of the FAQ, the only thing that keeps developers from sharing their users' SecureUDID with other developers and/or SDK-based companies seems to be their own discretion - turning over the domain and salt unlocks the keys.
There's also, as far as I can see, nothing to stop a company with a SDK from including this code in their SDK and tracking across every application that uses it. If I was still running an iOS analytics company, I'd be pretty tempted by this in the post-UDID era.
Well intentioned, I'm sure, but to me this looks like a great tool for continuing business as usual. I'm no expert, though - please let me know if I missed something.
Re: SecureUDID Is An Open Source Solution To The Apple UDID Problem
#7Question: In the example given, you supply a salt and a domain when coming up with your UDID. Isn't the salt of another app really easy to decompile and figure out? After that, a competing app could find out if you've used the device ID already, which actually seems less secure than the original UDID apple provided. The last thing I want is for apps I install to phone home with a list of other apps I have installed!
If any of your apps has registered a custom URL scheme, and many do, any other app on your phone can easily check to see whether it's installed. That's by design. Back when I was keeping up, it was also possible to read the mobile installation cache and get access to all of your installed applications, which is what some 'app recommender' applications did. That was an exploit which violated App Store policies - no id…
Ah, that makes sense, thanks.
Re: SecureUDID Is An Open Source Solution To The Apple UDID Problem
#8What a lot of apps really need is for Apple to provide a UDID replacement that gives a different ID per app, but is consistent if the app is deleted and re-installed on the same device. SecureUDID is still based on CFUUID which is not consistent across re-installs.
They store it in the pasteboard, which potentially will persist across reinstalls.
If its like how openudid works(and I understand it right), as long as one app remains that has secureudid installed, it will persist all the apps whether installed or not.
Re: SecureUDID Is An Open Source Solution To The Apple UDID Problem
#9Most of the UDID replacement "solutions" proposed so far are just cookies. They generate an identifier and write the data to a location such as the keychain, or a private pasteboard as in the case of SecureUDID. These locations may be somewhat persistent and might even outlast a delete & reinstall of a particular app in some cases, but in the end they are still volatile and therefore do not actually identify devices. The information can still be lost in the event of an OS restore.
For some (most?) developers, this might be sufficient. But if you need to actually, truly identify devices, these solutions are not good enough. The only way to identify a device itself is to use actual hardware-specific info. Since Apple is removing the UDID, the WiFi MAC address is pretty much the only thing left.
Any solution not based on hardware-specific info but which pretends to "distinguish devices" (as SecureUDID does) is not actually doing what it claims to do. It's a subtle but important distinction.
Re: SecureUDID Is An Open Source Solution To The Apple UDID Problem
#10I don't understand why Apple instead of just deprecating the UDID API did not added at the same time an API returning an application-specific UDID. No privacy problems, no issues for developers.