Is Apple Really Your Privacy Hero?
bloomberg.com
bloomberg.com
For now. When their growth, or margins start shrinking, Wall Street will push hard on them to collect and monetize this data.
Remember when you paid a premium for cable TV, because it didn't have advertisements? Now, you still pay a premium, but it's 33% ads.
No, cable originated as means to deliver broadcast channels, which had ads. You never paid for basic cable because it did have ads, because it always did. You paid a premium because you got a clear signal not degraded by distance and atmospheric conditions. And later because it offered channels (still ad supported) that you couldn't get over the air at all.
Now, even later, it was possible to pay a premium on top of basic cable to get additional channels without ads, but those premium channels still don't have ads.
Building weapons wasn't in Google's DNA either, yet Maven happened. It was only shut down because the pushback succeeded. Its success was not a sure thing.
Corporations aren't people - the only principles or ethical compasses they follow are those of their employees. Employees come and go, and, in the case of leadership, can be fired by the owners.
There's a long history of tech companies that have done a 180, in terms of their DNA. Microsoft, SUN (Having been bought by Oracle), Google, are some of the more prominent ones.
But make no mistake, Apple won't think twice before handing over data to the government or any other party if it makes business sense, as they did in China.
Also, your China example is also a straw man because Apple's terms in China explicitly allowed for that before they even sold a single phone there. In the US, for example, Apple isn't able to provide personal data to authorities. It can only provide information that doesn't live on-device and that's stored unencrypted which, as of right now, is nothing unless a user explicitly asks for it to be stored unencrypted.
I don't know if ads on AppleTV to be part of iAds or not, but I was a little surprised to see this menu on my AppleTV today:
Settings > General > Privacy > Advertising
The choices for this are Limit Ad Tracking, Reset Advertising Identifier, and About Advertising and Privacy.
Apple has an entire web page showing how to opt-out of targeted advertising on its devices, including the iPhone:
https://support.apple.com/en-us/HT202074
The most telling one is
Settings > Privacy > Location Services > System Services > Location-Based Apple Ads
Second, did you read that page at all, then? That's not at all the same as advertising based on your personal data. That's Apple showing you App Store promotions based on the searches you're typing in from the App Store and is completely localized to the App Store and App Store search. It's what allows you to go to the App Store and have the McDonald's sponsored ad show up when you visit a McDonald's. The only information being sent is your search term, anonymously, and the location-based ads are served based on iBeacons. None of your personal info is ever sent outgoing from your phone.
>Apple has a lot of knowledge regarding its users,but what it doesn’t do with that data is share it with advertisers very freely. That makes Madison Avenue very mad.
>rather than offering a cookie-based ad-tracking and targeting mechanism, it essentially requires partners to tell it what kind of audience it needs to reach, and then trust that Apple will handle the rest, AdAge says. And it’s well worth noting that Apple prioritizes customer privacy here over a big potential upside in ad revenue.
>what it doesn’t do is hand over the keys to all that data and let advertisers plug into it directly with their own data-mining and targeting software. That’s not standard for the ad industry and that’s likely the reason a few Madison Avenue feathers are ruffled over their approach.
https://techcrunch.com/2014/02/18/advertisers-not-thrilled-w...
Many people in the general public don't realize that you can have an iPhone and not have a computer, as long as you enable iCloud so you can migrate all of your apps and other information from one iPhone to another.
If you're doing an upgrade from one iPhone to another, you only have to turn on your iCloud for a time before the upgrade, then once you migrate, you can turn it off again.
Though, if you have no computer backup you should really keep iCloud on all the time so that if your phone gets eaten by a tiger, all your stuff can appear on your new phone.
I remember Mr. Jobs talking about this once.
Not the tiger part. That was just me.
idevicepair and idevicebackup2 are the relevant utilities, I've used them successfully on macOS and Linux.
Really? They don't collect any info in their app store / itunes? That seems hard to believe..
In general, companies like Facebook and Google view personal data as an asset and seek to acquire as much as possible. But Apple views personal data as a liability and seeks to have as little as possible.
In comparison to Google, for example, the difference in what the two companies want to know about you is huge.
Google has announced that it buys copies of your credit card purchase data from third party data brokers.
>Google has been able to track your location using Google Maps for a long time. Since 2014, it has used that information to provide advertisers with information on how often people visit their stores. But store visits aren’t purchases, so, as Google said in a blog post on its new service for marketers, it has partnered with “third parties” that give them access to 70 percent of all credit and debit card purchases.
https://www.technologyreview.com/s/607938/google-now-tracks-...
It's one thing to store data necessary to complete a financial transaction with your customer. Buying a customer's entire credit card purchase history regardless of who they are doing business with is an entirely different thing.
> the first step is obvious: Restrict [apps] from getting any information from users' lists beyond phone numbers and email addresses. The next step is redesigning the controls of the list to allow users to encrypt or decline to share certain contacts. The names in a contact list could be benign, or they could be revealing—a doctor's patients, a dealmaker's network, a journalist's sources.
If I’m in all honest i don’t have that many apps on my iPhone and the same goes for most of the people I know the app craze has I think settled down quite a bit.
I have 15 apps installed and only 3 have access to my contact list and those are Protonmail, Signal and WhatsApp which I would allow access too anyhow for convenience.
Apple can and should improve permission granularity but as far as contacts go I’m not sure that it’s even a good idea.
All or nothing seems like a good compromise to ensure that apps that you don’t want to have access to contacts don’t, how many usecases can you see when you’ll have to go to individual contacts and approve them one by one?
The best thing beyond that that Apple can implement is per field permissions e.g. I would like ProtonMail to only have access to the contact name and email fields but not to phone number or address but this level of granularity isn’t available on any platform afaik.
Am I trust Apple with my data? No, but that's my best choice for now and near future.
Yeah, one of them shares your contacts with Facebook. Might as well given all 15 this permission..
W/A can function just as well without access to contacts I just don’t see the benefit of doing that considering that W/A has my details and likely my social network from the other end anyhow.
In my experience, whatsapp does not "function just as well without access to contacts."
It used to be possible to add and initiate a contact within the app but that has been deprecated. Which leads to a terrible UX; why would I want to add a one-off contact like an airline or gig-organiser to my contacts just to ping them on WhatsApp? It just clutters my list, but of course Facebook loves it.
And more importantly if you are using W/A Facebook will know all your details from the other end.
If only takes a few people in your social network to share dats with Facebook or Google for them to be able to construct your entire social network quite accurately.
You can do this experiment yourself, take one of each: a colleague, a family member and a friend combined is all it takes to expose high double digit % of your entire social network and for most people 2-3 of each type would likely expose all of it.
And that isn’t something Apple can protect you from the only option is to not use any such services and not to be in contact with anyone who does and that isn’t something most people would are willing to do.
1. Request permission to access all contacts at runtime - user chooses yes or no.
2. Ask the user to choose a specific contact. This pops up some system UI, and then relays back the information the app requested about the contact the user chose:
public void pickContact(View v) {
Intent contactPickerIntent = new Intent(Intent.ACTION_PICK,
ContactsContract.CommonDataKinds.Phone.CONTENT_URI);
startActivityForResult(contactPickerIntent, RESULT_PICK_CONTACT);
}
@Override
protected void onActivityResult(int requestCode, int resultCode, Intent data) {
if (resultCode == RESULT_OK) {
switch (requestCode) {
case RESULT_PICK_CONTACT:
soSomethingWithContact(data);
return;
}
} else {
Log.e("MainActivity", "Failed to pick contact");
}
}
https://developer.apple.com/documentation/contactsui/cnconta...
I don't think I ever allowed any app to access my address book ever.
The article seems to really be trying hard to gloss over a lot of details to make a relatively minor complaint (really? The notes field in your contacts is your big concern?).
It's perfectly clear when you try to use an app that wants to access your contacts, and Apple makes it very easy to prevent. And unlike other platforms, apps are required to still work even if you deny such access.
"We are committed to never sharing your data with 3rd parties or governments for the entirety of our existence as a company. This contract can not be changed, and in doing so we are guilty of blah blah" (not a lawyer)
Questions I have are...
Is there privacy statement a legally binding contract? Is there any legal recourse for customers if they are have found to violate it?
Is it only applicable to particular countries? Does it change when you go to different countries?
Could Apple decide that the data they harvest is more valuable then their privacy claim and retract their so-called privacy commitment? Could retroactive data then be exploited?
Does it matter?
They’re no worse than MS (maybe better? Honestly don’t know). They’re way better than Google. Or Amazon.
If we ignore phones or what Android does natively, TV makers like LG and Samsung and even Sony have all sorts of stuff on their TVs to spy on you.
My guess is Apple could fall very far and still be one of the best, because the bar is incredibly low.
Unlike FB they don’t do secret backdoor deals with phone manufacturers to spy on you. Also they don’t spy on you. Also they don’t make ALL their money from advertising creating an unavoidable incentive for violating your privacy (and wasting your time but that’s beside the point).
Unlike Android they aren’t a Wild West of malware and dodgy phone manufacturers who do secret deals with everyone to spy on you.
Unlike Google they don’t make almost all their money from advertising (see above).
Unlike Microsoft they don’t bake ads into their OS despite the fact that they don’t make much money from it. Also they aren’t trying to compete with Google. Also hardware Wild West thing.
Unl
How do you know this to be true?
B) Not dealing with 3rd party manufacturers seems unrelated to the discussion. Can you expand?
B) Apple controls the entire supply chain for iPhones. They have no need from a profit standpoint to try and insert hardware that allows other companies to do anything to their users. The secret backdoors are almost always the result of some exchange - FB offers data about users in exchange for the ability to insert hardware/software into a phone. Since that exchange doesn't exist for Apple, there's no reason for it.
Apple complied while still retaining as much security as possible. They assert that the data is still encrypted, and they hold the keys:
https://www.nytimes.com/2017/07/12/business/apple-china-data...
Apple had, as I see it, two choices: disable current customers and refuse to sell any more devices, or comply with the law.
So, yes, Apple could have walked away from their customers, but how would that have helped anyone? Their phones are still more secure from non-state actors than nearly anyone else's, and Chinese citizens, for better or worse, have to live with the dictatorship's rules.
(And to preempt the inevitable comparison: https://www.theguardian.com/technology/2015/sep/21/google-is...)
So "They literally made a deal to spy on Chinese citizens as soon as that made them profit" is only true if you assume Apple is lying about the encryption and lying about their reasons for opening the new data center.
It's also possible the OP is talking about some other Apple cooperation with China, but that seems to be the one most people throw at them.
Additionally, Google is absolutely bad, but that is just whataboutism. If Apple valued privacy as much as they say they do, they would take a stand. Lost profits are part of taking a stand.
I still don't see how that original statement is innacurrate.
It's still not clear what anyone gains by them walking away from China.
Sticking by your ethics isn't about what you gain, it is about being honest and trustworthy.
"We slowed down your battery to make your phone last longer"
The data is encrypted and users in China have to accept the terms that explicitly state that Apple must comply with government requests for access to their cloud servers in China. It wasn't a situation where they changed course or pulled the wool over someone. You're being deliberately disingenuous and misleading.
I'm genuinely curious. How do you know that?
That is not a given.
The only future-proof way around this is to be in control of the software (and hardware) you use, something Apple is not very comfortable with.
I have zero hope that we’ll get anything remotely comparable in the USA, though.
Good luck with that!
You can only protect your privacy 1) by remaining completely anonymous or 2) by trusting those your share your information with not to abuse it. It seems that Apple does not currently have much in the way of personally identifiable information on their customers. Whether you choose to believe them is up to you. Personally I feel like Apple's stance on privacy is self-serving, but still valuable. In the future, I believe that we will need to decide as a society how individual privacy should be handled and enact new laws and social norms.
Like simply collecting and holding that data is somehow wrong.
Apple doesn't collect the same customer data that Google does, but even if they did, it's much much more important to talk about how that data is used.
Google are an advertising company. It's in their best interest to use that data to INFLUENCE you to the whims of the highest bidder.
Google are running a platform whereby they sell their brainwashing services to anyone willing to pay. That's not an exaggeration.
It does seem like many people expect them to fight for justice. Protect the innocents. Maybe not punch the bad guys, but at least banish them.
This is not what corporate PR is usually going for. But suppose someone decided, heck yeah, we're going to be a virtual superhero, and just ran with that?
We should work on a system where it's not possible for a company to accumulate that much data.
And if it is PR, it's a weird tactic. The article seems to be using FB as benchmark for "worst offender".
So sure, I don't have any definite proof that this was a story planted by Facebook's PR team. That would require me to have seen the communications between this reporter and them, but I don't think the hurdle is "beyond a reasonable doubt" to say this was A Facebook Production given the context (the running spat between Tim Cook and Mark Zuckerberg, Facebook employees on Twitter whining about this very thing, etc).
I'm not defending the quality of the article, it's bad. And I think if the reasons you just listed were in your original comment, I would have upvoted it instead of viewing it as overly dismissive.
>I don't think the hurdle is "beyond a reasonable doubt" to say this was a Facebook Production given the context
For sure, the bar is low because the stakes are low. But a shitty writer and a need to inflate word count for the editor yields articles like this as well, no need for a PR conspiracy. I guess it depends a lot on how you feel about Hanlon's razor.
That's fair. I should have written a fuller comment off the bat, but everyone can read my reasoning now.
>For sure, the bar is low because the stakes are low. But a shitty writer and a need to inflate word count for the editor yields articles like this as well, no need for a PR conspiracy. I guess it depends a lot on how you feel about Hanlon's razor.
I actually don't think this is anything particularly nefarious or underhanded. It's all in the game, as Omar would say. In fact I'm amused by how transparently bad it is. She brings up some good points (the permissions should be more granular) but the framing of the story is clearly working in service of Facebook's agenda. The actual solution that needs to happen isn't technical at all. It requires new legislation establishing equivalents to Data Protection Commissioners in the EU and creating a comprehensive, omnibus policy for them to enforce.
I wish we could all just agree not to cite that (13 year old) PG article anymore. We all know what PR is now, right? That's all it is about. I don't think we need a special HN-only term ("submarine") for basic tactics of PR.
A personal anecdote - last year I tried to (for the first time) use an iPhone. First of all, why do we need to "activate" it? What's wrong with just turning it on and using?
Then comes data collection, they wouldn't allow me to use my smartphone without a SIM card (I couldn't use my old SIM in that moment because it was not in the micro format). So, you can't "activate" your iPhone and use it as wifi-only device, they want your SIM card's data first.
OK, trying again with an old inactive SIM card from the drawer, now they want my full name, my email, my telephone, my birthday and my address. Why though? I decided to play their game and entered bogus data and a temporary email address. Now they want me to confirm the email and the telephone. Just let me use it already! I managed to confirm the email (the unconfirmed telephone number was nagging in the notifications area), and hooray, I already could use some of my phone and get online.
Next comes the iTunes account. If you want to install any app from the store you must have an iTunes account. Again, full name, telephone, address, zip code, etc.. In the end it refused to register (maybe some algo detected my bogus data which I didn't even try to make it look legit) and it just suggested to contact their support.
This is when I reseted it and decided to return it.
“This is when I reseted it and decided to return it” - I respect this. I’m honestly very curious what you’ve decided on in its place.
Me too. I'm looking for something with good privacy and good security, including things like anti-imaging or timely security updates for at least 3 years (don't change my phone very often). Seems like I could either buy Apple, maybe flash LineageOS (what a pain), or not use a smartphone.
You can create a bogus iTunes account by using gift cards and creating an anonymous account with that. At that point, yes the device is linked back to an account, but it's just as opaque as say, Reddit is.
Beyond that, Apple doesn't even require you to sign into use the device. You can take photos and use Maps, and even surf the web all without any kind of account.
There seems to be a lot of this willful misinformation being posted around this article. I wonder why HN is now getting inundated with this anti-Apple nonsense.