Hacker News Reader

Comment by SllX | Hacker News Reader

Just a friendly reminder of the facts on the ground that the change that great folks at El Reg are reporting on and the folks at Facebook in their blog post are posting about is a toggle in iOS 14, which while there in previous operating system releases as an opt-out toggle, will be an opt-in sort of toggle. iOS will now ask for explicit permission on behalf of Apps to let them track you using an identifier Apple made available to developers like Facebook (“IDFA” aka “Identifier for Advertisers”) rather than relying on the implicit permission of an opt-out toggle.

This does not kill all forms of tracking, nor does it eliminate IDFA as an an option, but it does make it more obvious to iPhone/iPad users what exactly is going on behind the curtains with this tracking tool and let them make an informed and explicit choice about whether they want any part of that.

View on HN

So do they still run but are limited like when ios gives the false location data? or can facebook apps just refuse to operate until they are given the required permissions? E.g. the way android apps just demand permisions for everything making the security benefit of permissions largely pointless.

Programmatically? Certainly. As a matter of App Store policy? Facebook shouldn’t count on it, even if that were allowed by the rules as written today (which I don’t think it is, but Apple has pretty much covered all of their bases as far as arbitrarily changing policy on the fly goes).

> the way android apps just demand permisions for everything making the security benefit of permissions largely pointless.

That hasn't been the case for a pretty long time. Now the permissions are quite granular and you can accept and refuse specific one at any time. It's actually quite tiresome to go through 4-5 permissions popup on some apps, but it makes sense so it's okay.

The apps is informed of that decision, so yeah it can decide to not works without it. I suggest you to not use an app that require stuff that you don't want to allow.

Though it's bizarre to me what permissions require a pop-up and which don't. You think all you've granted is, say, looking at files, then you check the actual granular list and there's a dozen different ones including internet access.

Making full network access a mandatory always-on permission was a huge security mistake IMO. Every app can port scan your network, and probably some do as part of fingerprinting (some websites do at least, and I assume apps are more brazen).

It's not mandatory, it's just incredibly common. There's also an untoggleable permission to allow viewing network access by other apps.

>> the way android apps just demand permisions for everything making the security benefit of permissions largely pointless.

> That hasn't been the case for a pretty long time. Now the permissions are quite granular and you can accept and refuse specific one at any time.

This is technically a correct answer, but I've seen the bad habit of asking for many permissions (and sometimes refusing to work without) being more common on Android. An example is a bank's app that will refuse to launch (or I mean, provide any meaningful information/experience) unless location permission is given (this is when giving the permission means an "always allow") and unless it's connected to a cellular data network (not WiFi). On iOS, the app is better behaved and will work with some useful functionality when certain permissions are denied.

This could be due to an overly aggressive anti-fraud library/service like ThreatMetrix (I don't know if they do these things, they're just the only example I know).

If they refuse to run without permissions that make sense to me then they get tossed. You don't need my location for me to play a solo platformer.

Is this a cross-app identifier for non logged-in users? I.e if you log in to an app then that provides the tracking identifier (email).

Yes. IDFA's full form is "The Identifier for Advertisers" which is generated by OS itself. Think of it like a proxy of IMEI number itself (back in the old days IMEI itself was used instead of this).

All of the Apps get the same ID and that's how your "persona" graph is constructed.

Sidenote: One of the bets people are making with this change is that now free apps will start forcing you to signup (via email/mobile number) which will be used to construct this "persona" graph again because who has time to create new emails for these purposes.

Well, your phone has the time to create new emails for these purposes with the Sign In With Apple feature[1]. You don't have to remember your email nor your password because iOS can create a secure one and save it on your phone. More secure than people using the same email and password across multiple apps imo.

[1] https://developer.apple.com/sign-in-with-apple/

I wonder if Apple saw this coming and created Sign in with Apple in anticipation. Seems like a very smart play now.

You wonder if Apple saw a change in their own policy coming? Yes, I think they may have...

I mean that they also saw the reaction to that change coming, ie. they realised if they got rid of the advertising ID, it would make apps force you to log in. I'd be impressed if that was deliberate, but it could have been.

What about phone numbers? Can't even make a Twitter or Google account without coughing up a phone number.

+1 Even after sign-ing up it requires me to authenticate every now and then (may be because I am using only twitter web).

My 10 year old gmail account has no associated phone number. Maybe it's valuable now. It's the only thing I use at all that is a Google product, and I'm always near deleting the entire account but it's just so convenient (Read, I've been lazy)

Somebody commented below in the same parent comments that it's not a full proof thing.

You don't have to offer Sign in with Apple if you have your own login system. Ref: https://developer.apple.com/app-store/review/guidelines/#sig...

This is only applicable if the Apps provide this as an option right?

But notably you can’t use any SSO providers. So if you want to use SSO you must support login with apple.

Ah yes. Good point.

Interesting workaround. I imagine this could in turn lead to more pressure on these same apps to implement Sign In with Apple - as a user, its email privacy feature becomes more interesting in this scenario.

> more pressure on these same apps to implement Sign In with Apple Afair this is actually a requirement: if you have email/facebook sign in option, you need to implement Sign In with Apple as well

Not quite. If you offer 3rd party logins you must also offer SIWA, but if you only have email/password you don’t have to.

https://developer.apple.com/app-store/review/guidelines/#sig...

I use email aliases to sign up to services for this reason exactly. There is no way to link the aliases, and so tracking is limited to the registered site only. The Log In with Apple solves this more elegantly

Sign In with Apple is not a panacea. UPS on-boarded me a couple of weeks after my initial registration, and the two services I’ve used it for (UPS and Etsy so far) have received my name from the initial registration process (a radio button selection and a bioauth).

I wouldn’t treat it as a privacy feature, I would treat it as a convenience feature. When I needed some extra mask straps, I installed Etsy, didn’t previously have an account. So I used Sign In with Apple to register, picked out some mask straps, and Apple Pay to pay. The whole process only took as long as it took for me to make a selection and two biometric authentications, but some of my information had to be exchanged in order to make that transaction possible.

Also I can login to UPS and Etsy without a password.

Regarding your side note. Apple is also, more and more, requiring you allow the login with Apple button. This would effectively shield most of the data off if you want.

My familiarity with it is superficial and only as an iPhone user, it is not an API I have ever concerned myself with, so first, I might be wrong about this next part but second, my understanding is that it provides almost nothing about you except a number or a string. I’ve never delved into Apple’s docs to find out because the “how they do it” has always been less important to me than the “how do I turn this off”.

If you go into Settings on iOS 13/iPadOS 13 and into the Privacy pane, all the way at the bottom you should see two tabs, one labeled “Analytics & Improvements” which is for information Apple collects for the device, Siri and iCloud, and another “Advertising”.

It’s in that second one that you can toggle “Limit Ad Tracking”, off by default today, on by default in iOS 14, at least that’s the plan and is the case in reports from people using the beta releases. Right below this toggle is a button labeled “Reset Advertising Identifier” which does exactly what it says. This is the “IDFA” that is the subject of discussion and will be the same value returned to Apps that request to use it. If you reset it, that will break continuity with your previous identifier, at least in theory.

Oops!

Deary me. Reading comprehension fail.

> The setting is off by default in iOS 14 and toggling it will from the default will turn it on.

Limiting tracking will be off by default? Are you sure you're not the one inverting things?

This does not kill all forms of tracking

What mechanism remains for tracking a user across apps?

Anything that doesn’t rely on IDFA, e.g. your Google account in Google’s Apps.

But I was thinking more about tracking within apps that isn’t concerned with tracking across apps or even tracking for advertising purposes, hence, “does not kill all forms of tracking”.

IP addr

Prob more a combination of IP address, user agent, iPhone model, plus prob some other device fingerprinting identifiers these ad trackers found

While Apple are limiting access to IDFA for apps that don't ask for permission to track i.e. it will be all zeros they are also changing App Store policy. Specifically you are not allowed to track users using identifiers such as user ids, fingeprint ids etc if they have said that they don't want to be tracked. Sure Apple doens't have technical control over this but we know that they are willing to wield the ban hammer.

It'll be really interesting to see this play out. The experiment with the "Do Not Track"[0] header on the web failed becaused it was largely ignored by everyone. With Apple's tight control over the App Store you simply cannot ignore the rules because Apple can outright ban you for it.

0: https://en.wikipedia.org/wiki/Do_Not_Track

I doubt Apple would ban an app as valuable as Facebook.

They just banned Fortnite

Fortnite is small pataters compared to facebook.

That might be true, and may involve backchannel negotiations. But Apple didn't hesitate to revoke Facebook's developer certificate (for internal apps) and make Facebook employees scramble for a day or so because of the "VPN" app tracking fiasco early in 2019. [1]

[1]: https://www.theguardian.com/technology/2019/jan/30/facebook-...

Facebook's announcement recommends Facebook social login or uploading hashes of user data: https://developers.facebook.com/docs/app-events/advanced-mat...

I always wondered if that advertising ID is GDPR compliant, given that the setting is currently opt-out, instead of opt-in. Even if it is low entropy.

I don’t think it would be, however the party considered in breach would be the app developers and not Apple.

Consent should be opt-in and granular (a user might wish to opt-in for one app but opt-out for another one) so every app should’ve already implemented their own toggle (like iOS 14 would force them to) instead of just using it in the background and pointing users to the system-wide setting if they want to opt-out (which isn’t ideal if the user wants to remain opted-in for some apps only).

> the party considered in breach would be the app developers

Given that this feature is entirely made by Apple, that's not a reasonable conclusion.

Isn't it down to the app developers though whether they allow the ID to be used to serve ads in their app (whether or not in practice there's a mechanism to do that, it's the app developer that's essentially choosing to use it by implementing ad networks and SDKs that use it, not Apple forcing it on them).

Your browser (probably) allows the use of cookies; however a website which doesn't ask the user for appropriate permission is still in breach of the law.

It’s not Apple doing the tracking. The knife manufacturer is not reaponsible if you stab someone.

IANAL. Not sure about that. IDFA is essentially a tracking cookie.

First of all under GDPR, tracking can be for a legitimate interest, and thus it might not require opt-in. For example security, or even first-party analytics, with the purpose of optimizing the content, can be legitimate interests. However this cookie is meant for advertising, and user profiling for marketing purposes doesn't pass the test for legitimate interest.

The other problem, for Apple, might be the revised E-Privacy Directive. You can't set such tracking cookies without informing users. Such cookies must be opt-in, whether you use them or not.

AFAIK Apple is simply complying with the law, whereas Facebook is effectively arguing for unlawful tracking, because that's just who they are.

My understanding is, that it's a random and unique identifier, and therfore very high entropy. Pooling that data allows FB to identify you in different apps that use the SDK, even if they don't have any other identifying info.

And a friendly reminder that if you're on iOS you can go into Settings, search for "advert" and limit ad tracking if you managed to miss that setting before.

Well Facebook make their money from advertising, marketing is advertising so it seems like Apple are taking cues from some laws and customer demand. https://www.gov.uk/marketing-advertising-law/direct-marketin...

I was going to protest what sounded like a silly taunt of "great folks at El Reg". Then I went and read the article.

Holy mackerel, compared to this, the folks at Fox and MSNBC are paragons of neutrality. This may be the worst example of journalism I've ever seen. I'm looking all over for something that says "opinion" or "editorial", but no...

The Register basically emulates british tabloids.

With celebrity nicknames for companies and all!

I was sincere, I love The Register! But there was an actual taunt in that sentence that was much more subtle. Notice what I didn’t say after talking about the “great folks at El Reg”.

Have you ever read The Register? Its been this way as long as I can remember (1999?). I consider it more of a cheeky, poking-fun style rather than it being inflammatory. They've always created an air of not taking IT/Technology too seriously.

Take this job listing for example: https://www.theregister.com/Page/devoops.html

1. DevOops.html

2. Titled: "Vultures seeking penguin-tamer"

I feel like the fact that The Register has been the Internet home of the Bastard Operator From Hell stories (https://en.wikipedia.org/wiki/Bastard_Operator_From_Hell) since 2000 really sums up its attitude. It is tech news by and for BOFHs.

It always has been.

Neutrality in journalism was an artifact of the business model when consumers had far fewer choices of newspaper/channel (ie only < 5 local papers, 3 network channels), using neutrality as a strategy to avoid turning off potential consumers. The point of journalism is not neutrality; it's the communication of facts relevant to the audience.

This article communicated multiple facts/relevant quotes to me that I was not aware of before (eg iOS14 changing a default setting to improve user privacy, and the extremely revealing quotes from the FB Audience Network bloc [0]) and put them in a context relevant to the audience that values privacy. I don't see how this is an example of bad journalism.

[0] https://www.facebook.com/audiencenetwork/news-and-insights/p...

Because everyone is biased due to the data they are exposed to as they live through lifes experiences. Even Judges are biased, so you would be advised to seek parole after lunch if I was you. https://www.theguardian.com/law/2011/apr/11/judges-lenient-b... Besides The Register has always been that way, I dont see them preaching violence despite its efficiency, they are just telling the world how they and others see the IT world. As they say, biting the hand that feeds them.

“IDFA” is too similar to “IDKFA”... or “IDGAF”.

I’m sure there’s a joke in there...

IDFA is a cheatcode of its own (ID Full Ammo).

It pops up a big scary per-app dialog (https://mobiledevmemo.com/wp-content/uploads/2020/06/image-1...) that the app wants to “track you across apps and websites owned by other companies”.

I just wish people understood how much they’re being manipulated by Apple’s marketing here. Credit to them: they’re the best in the world —- if Tim Cook decided to sell cigarettes, he’d have most of us on two packs a day and believing it’s good for us by Christmas.

Apple is a giant corporation, they’re not your friend. They can be total jerks when it suits them. They happen to have failed at their own advertising network and had the brilliant idea to spin this as if they “care” about your “privacy”. It is a convenience of the moment to sell more devices like the iPad Pro I’m typing this on.

The level of rhetoric has reached foaming-at-the-mouth proportions, and we can no longer have a rational discussion that acknowledges the nuances. Even the word “tracking” is so loaded with evil connotations and indistinguishable in most people’s minds from the ever-cited, rarely existent “selling my personal information” that few can see beyond the word to make a conscious choice about what level of tracking is acceptable. (NONE! I can already hear the shouting.)

IDFA is a random identifier that’s been used for attribution and audience targeting (for which Apple provided it). Digital advertising has a fairly unique property, which is that it’s possible (at least sometimes) to connect the dots between “I paid for an ad for my product” and “someone bought the product”. If you’re spending money on advertising and offered the choice between casting it into the void and hoping your sales pick up, versus only paying for successful “conversions”, that second option is going to be pretty attractive.

I saw an ad on Facebook for a food delivery service. I signed up and have been enjoying their products and benefitting from fewer grocery trips. I’m ok with that. And I’m ok if there was a little anonymous tag that allowed Facebook to get paid for the service they provided to the company. I’m less ok if they collect information on how much red meat I’m buying and sell it to my insurance company, but that’s not what we’re talking about here and I pretty wound up when people assume that all “tracking” is the same.

I disagree.

1) Marketing alone is not why you have an iPad Pro. All other tablets kinda suck compared to it. It's at least 5 years ahead of anything else in hardware and the software is probably further than that.

2) Facebook also not your friend. Corporations can't be friends.

3) Why would anyone _want_ to be tracked if they can avoid it?

4) From a business' POV, sure tracking is useful, but as a consumer, I don't care. I would rather not be tracked - in this instance I think it's nearly even possible to say Apple are being my friend, working for my interests. Also IDFA was introduced as a more private device ID, I doubt they expected it to be exploited this way and are now fixing it.

5) The reason FB cares about this tracking isn't for tracking installs of other apps, it's about their ability (or not) to build up a comprehensive identity of who you, what you do, where you go and what you like, from all the apps and websites you've ever visited.

5 continued. Facebook is slurping every bit they can get by trick and treat. They bring business to other app developers and businesses who in turn hand over customer data and , while not insignificant, a small amount of money for advertising, or nothing for just the free services. A lot of people never leave Facebook, or Insta. It's a part of their identity. A huge part of peoples lives are on Facebook and Facebook will not relinquish a bit or back down from their methods without existential threats to their business.

> 3) Why would anyone _want_ to be tracked if they can avoid it?

People get value in return. Free to use product and ads about stuff they’re interested in. For some it’s not enough of value proposition, but for others consider it fair value exchange.

I still wouldn't categorise that as wanting to be tracked, just begrudgingly accepting it.

I'd also say that's a better argument for google, where them knowing some stuff about me probably does give better search results - but facebook just want to give me better adverts, which is of marginal (approaching zero) benefit to me.

Nothing wrong with making the value proposition/tradeoff an upfront and obvious decision. Might even encourage competition from tools that have a different proposition.

There’s two options in that dialog box: 1. Allow Tracking 2. Ask App Not to Track.

People that see it that way can choose option 1 when presented with the choice.

If the users are making a choice, then opting in would not be a problem. It’s informed consent, so they are aware of what they are giving away for the service, right? Nothing like companies helping themselves without the users even knowing the monetary value of what they are giving away.

In other words: if your demand is legitimate, you have no reason to whine about opt in.

I anticipated comments like yours in-thread which is why I posted my initial commentary.

I have no romantic attachments to Apple in particular, after all they were the SOBs that provided IDFAs and set the initial policy, which is why this was a “friendly reminder” on what this policy going forward is and what it isn’t. What appears to you to be a “scary dialogue box” appears to me to be an adequate and accurate description of what IDFAs are used for and why Apple provided IDFAs in the first place. Tracking users and across apps and websites from different companies is IDFAs working as intended.

Now you can be as cynical or romantic about why Apple is doing this now as you want, to me it’s a half-step towards correcting a mistake they initially made, and to others it is clearly something else, but let’s not kid ourselves into believing that just because Apple stripped the paint off of an advertiser’s favorite toy that this is somehow going to be the death knell of user tracking and the app-based advertising industry is doomed on iPhones and iPads. Facebook and Google are big boys, they may not like this new change, but they’ll learn to adapt around it because adapting to new situations and facts on the ground is just another cost of doing business. Business plans aren’t set in stone since time immemorial, sometimes they need alterations to remain relevant and operable.

Regarding your last point, I feel the same way about the 30% Apple tax.

It’s off-topic, but so do I.

Mind I wouldn’t care if I could install apps (native, not PWAs) through Safari distributed through a means that cuts Apple out of the loop and download them right to my home screen, or in future versions, my App Library.

> just wish people understood how much they’re being manipulated by Apple’s marketing here. Credit to them: they’re the best in the world —- if Tim Cook decided to sell cigarettes, he’d have most of us on two packs a day and believing it’s good for us by Christmas.

This is such a hoary old argument usually made by those who believe a product value is only measured by the cost of the hardware components comprising it, not how it was packaged or how it works or the experience it’s custom software enables.

Of course in this case, if your job is selling snake oil, you think everyone’s job is selling snake oil.

Reply on news.ycombinator.com