iOS 13’s privacy pop-ups of Facebook data grabs
techcrunch.com
techcrunch.com
iOS 13 has several great privacy-focused changes:
- WiFi SSID is protected behind location permissions (ie, an app must request and be granted location permissions to be able to access the current SSID)
- Bluetooth has additional permission prompts (as detailed in the article)
- When an app has been using location data, the user is periodically prompted to confirm continued background location use (with a map of locations the app has used).
- Safari has several on top of all these, like prompting a user to allow cross-site cookie loading, etc
In some of these, Apple is catching up to Android, and in others, it is ahead. Either way, it seems that most of these come from a directive from inside Apple to clean up 3rd party app behavior, likely prompted by things like last year's analytics & enterprise deployment scandals.
Where Android/Google itself is a bigger problem perhaps than the 3rd party apps.
Its constant presence is an artifact of apple pretending the mouse will only be used by those who need the pointer always for accessibility reasons.
As I said above the only real criticism I have is that the pointer/accessibility box doesn't disappear when the mouse is disconnected.
I haven't tried it over Remote Desktop (I don't know if the "raw" mouse presses are relayed), only to interact with native iOS Apps.
Also Apple (as opposed to Google) is the one actively cooperating with Chinese government and giving them decryption keys for iCloud.
If you look beyond the marketing spiel it's kinda ridiculous marking one of those corporations to be more trustworthy than the other.
Sorry, what?
2.) Apple admits it was giving Siri recordings to contractors with no ability to opt out of the functionality. This included false activations not meant for Siri. Seemingly what happened near iPhones did not stay on iPhones:
https://www.theverge.com/2019/8/23/20830120/apple-contractor... [August 29th]
3.) In 2016 Apple shifted their iCloud servers to China to abide Chinese limitations and give access to content on governmental request. It seems, again, what happens on iPhone does not stay on iPhones: https://www.latimes.com/business/technology/la-fi-apple-chin...
But of course, this whole topic on HN shows that the money on marketing is well spent. Lesson for Google and Facebook: up the marketing spending to keep repeating how privacy concious they are. ;)
Admittedly, the distribution of Android devices on 8.x+ is higher than I even expected before looking at this.
[0] https://developer.android.com/guide/topics/connectivity/wifi...
[1] https://developer.android.com/about/versions/pie/android-9.0...
https://developer.android.com/about/versions/marshmallow/and...
By eye, that covers nearly 75% of current devices.
How on earth it occurred to someone in the first place, that determining whether the phone is in use or not and reading the phone #, IMEI, etc. should be the same permission is beyond me.
- write access
- read access (all photos)
- read access (through a special iOS picker that acts as a middle man)
The longer people have their phones, the more photos they have. And with them a whole lot of meta data such as location etc.
I simply don’t trust most apps these days that they really don’t touch any of that data.
Of course, you can already "share" a photo with an app, but this doesn’t let you change a profile picture in Instagram for example.
The cynical person might say: why not stop using these apps in the first place? Because it’s difficult to say who is exploiting photo library access and who is not. Does VSCO do it? I’d think they have no interest, but it’s too much based on trust vs. something I can control.
Stripping location metadata before handing photos off to apps would be nice too.
As a technology change, online dating has become a "radical monopoly (Illich)," in the sense that whether you use it or not, you are subject to it, the way a cyclist is subject to the car, and any algorithmic bias or site policy is in effect a eugenics program. Of course nobody criticizes something when they are winning, and an ostensible losers view of dating is the very popular definition of disgusting, but for a ubiquitous global company whose business model reduces to selling ads on addictive pocket slot machines to become a dominant player in the genetic selection game should give people at least some pause.
That makes a great quote!
I switched mostly for privacy reasons as as well. The original idea of why I liked Android: open source / Linux based, I developed apps for it, are not as important as giving too much control and my data to Google at this point.
Been pretty happy with it as a new user. At first it was hard getting used to not having a back button where I expected it but after a few days got used to it.
I like that there is an Apple store I can go to.
The interface is slick and nice, however, I'd have have to say in recent years Android mostly caught up in that regard.
But most of all, I like that Apple's primary business is not selling my info so I am happy to pay a premium to have a bit more privacy.
How would you say are the apps in this regard? Are ios apps more standardized than android's?
You might miss not being able to set third-party apps as default for certain actions, but I think this is a valid trade-off for maintaining standards and share extensions are almost as good.
iOS apps on average are definitely faster, smoother and well-made in terms of visual beauty.
Dont forget that iOS has an almost universal left swipe gesture that doesn't require acknowledging the top left-back chevron
It also has an optional swipe down gesture at the very bottom of the screen to cut the screen size in half, useful for hitting the back button if you have to
Double-tap the home button for Reachability on iPhone 8 and older.
And using Facebook does not mean you're submissive to a higher authority. Most people use it because there's no choice if you want your circle of friends to survive long term.
There was dating services in meatspace long before OKC, Tinder and now FB. Much of the same data given to them was similar to what Facebook has. Do those services class as eugenics?
If you would really like to turn my innocent quip into an something more inflamatory, I'd say a lack of informed consent by users about the use of their data, obtained by surveillance, used to impose opportunity costs on their reproductive prospects, structured around the commercial and political agenda of a company who makes addictive products - would be a pretty awful thing to countenance indeed.
I'm sure the lawyers and bioethicists have got it all sorted out.
Matching people based on their survieled unintentional preferences instead of their stated intentional ones seems helpful, except I'd propose that the combination of opacity and power difference ethically deprives the subjects of their intent.
They may have volunteered for the opportunity, but they have not volunteered to be chosen for. The selection bias inherent in secret data is the expression of the intent of the administrator, not the intent of the subjects.
Taking this beyond a quip wades much deeper into thorny ethical issues than is really useful on HN, but I hope this has emphasized the value of letting sleeping dogs lie.
Sounds like domestication.
They should be proud of that, and it makes it seem like their privacy push is more than just a momentary marking-led move.
I just don't think that's enough to explain it. Apple was all-in on user privacy right for the beginning, back when their market cap was a small fraction of what it is now, when Wall Street was salivating over the huge profits to be made out of mining social graphs, and when Google was offering big money for access to user data. Instead Apple decided to put up the finger to Google, until then a close partner, and spent billions of dollars building Apple Maps.
There is absolutely no way Apple could possibly have expected a marginal marketing advantage, which was very minimal at first for many years, to compensate for the very lucrative immediate opportunities they gave up. The financial incentive argument just doesn't come close to adding up.
For ChromecastI believe it's either SSDP or mDNS, and I don't think they have a P2P casting option IIRC.
There is the completely valid use case of a scooter that isn’t able to send it’s location to the app yet is close by to you. So it can be found with Bluetooth.
That isn’t to say that the app is isn’t tracking where you go, it doesn’t need the Bluetooth connection to its scooters because you need to turn GPS on to find the scooters.
(I'm assuming that most phones have better reception than the cheap cellular modems inside scooters)
Actually, I have an android phone around here somewhere loaded up with a BLE inspector app, gonna see if they actually broadcast bluetooth :-p
"anti fraud"
Preferably they also block all 3rd party cookies, use an ad-blocker and occasionally delete all cookies and reset their Ad-Id.
Use facebook over tor.
Also check out Richard Stallman's recommendation on using facebook for organizations:
My current setup is Facebook.com notifications via Chrome [Android] browser and Messenger Lite. It is still spying on me but the impact is substantially diminished.
A far more damaging thing to these social networks would be mega-scale winnowing and chaffing: where OSes and devices basically start to lie through their teeth when apps come calling. I am more than willing to “let” Facebook think that I went to 500 places I’ve never been, and I am willing to let them think I am connected to hundreds of people that I don’t actually know. Let us, please, ruin their entire graph: take what truth they have obtained through questionable means, and pack it with garbage.
Of course, Facebook would also be smart enough to put a timestamp on what they already know so you can’t just give them new garbage. Let these devices give every app and website “old” fake details, as well. For example, let them pretend that three years ago I was at a certain location, or that I was in proximity to a certain person in the year 1999. I’m not so interested in protecting current details, as I am with protecting my entire history of details.
edit: spelling.
I usually don't want / remember to do that though, in these cases I skip "Oath family" articles. And I really dislike this popup, it links to 100+ privacy policies and some of them return 404 errors already.
Your headphone update app more reasonably will need that permission, as its doing more than audio output.
Similarly Dropcam had a setup mode via Bluetooth, Google Home as well.
iOS should be doing audio device discovery and notifying the apps that request it when a new device is found. Whether you plug some headphones or use bluetooth or airplay or ... shouldn't matter here.
Spotify Connect is likely why they need a permission request... but the question for me is why they need it on app startup and not a one-time request when starting the Connect pairing process. Good security procedures would have the app requesting as few permissions as possible, for the shortest amount of time.
But other than that Bluetooth access had legit use cases, like the app I use to control my Bluetooth bulb. There are plenty of devices and accessories that use Bluetooth to communicate with the iPhone, therefore Apple provides means to access Bluetooth.
This is useful if an app needs to know whether the phone is currently using a local network or a cellular modem to connect to the Internet, or to connect to local devices. Unfortunately Apple does not provide a basic API that provides this information without the SSID. (Although in early iOS 13 betas, there was a WiFi framework that might have provided such information. It was removed from later betas, however).
For Bluetooth, apps do not have access to BSSID nor peripheral MAC addresses from advertisements and connections. CoreBluetooth provisions a separate identifier (that is rotated) to prevent apps from gleaning much tracking info outside of the user's consent.
I have a pet paranoia that when apps have both Background App Refresh feature as well as Photos access - well when the phone's connected to WiFi and charging (both of which can be detected by the app) - what's to stop apps from happily uploading everything? I'd be really happy to hear from someone that this isn't actually possible tbh.
You will not miss any notifications if you disable Background App Refresh.
This also says so much about the culture at Facebook. They clearly don’t have any respect for their users, principles, or limits. I’d personally think twice about hiring someone from Facebook.
Does anyone know for a fact what Facebook is doing with Bluetooth permissions? Am I right in my understanding of how innocent usage for media playback can trigger this prompt?
It's a blanket excuse to say "security," but the only viable malware detection works by inventorying telemetry off-device, as on-device can be detected instrumented around by any advanced attacker.
Technically, that's true. The choice between “yes, always” and “yes, always” is as easy as it gets, while of course also being totally misleading in arrogating that users actually do have a choice.
> between “yes, always” and “yes, always”
because they deliberately left out a viable option of “yes, only when in use in the foreground” then I’d say the app developers are hostile and you should consider uninstalling the app.
But this isn’t really on Apple. It’s the developers, managers, stakeholders who deserve your ire.