Hacker News Reader

Comment by kreetx | Hacker News Reader

Is this a cross-app identifier for non logged-in users? I.e if you log in to an app then that provides the tracking identifier (email).

View on HN

Yes. IDFA's full form is "The Identifier for Advertisers" which is generated by OS itself. Think of it like a proxy of IMEI number itself (back in the old days IMEI itself was used instead of this).

All of the Apps get the same ID and that's how your "persona" graph is constructed.

Sidenote: One of the bets people are making with this change is that now free apps will start forcing you to signup (via email/mobile number) which will be used to construct this "persona" graph again because who has time to create new emails for these purposes.

Well, your phone has the time to create new emails for these purposes with the Sign In With Apple feature[1]. You don't have to remember your email nor your password because iOS can create a secure one and save it on your phone. More secure than people using the same email and password across multiple apps imo.

[1] https://developer.apple.com/sign-in-with-apple/

I wonder if Apple saw this coming and created Sign in with Apple in anticipation. Seems like a very smart play now.

You wonder if Apple saw a change in their own policy coming? Yes, I think they may have...

I mean that they also saw the reaction to that change coming, ie. they realised if they got rid of the advertising ID, it would make apps force you to log in. I'd be impressed if that was deliberate, but it could have been.

What about phone numbers? Can't even make a Twitter or Google account without coughing up a phone number.

+1 Even after sign-ing up it requires me to authenticate every now and then (may be because I am using only twitter web).

My 10 year old gmail account has no associated phone number. Maybe it's valuable now. It's the only thing I use at all that is a Google product, and I'm always near deleting the entire account but it's just so convenient (Read, I've been lazy)

Somebody commented below in the same parent comments that it's not a full proof thing.

You don't have to offer Sign in with Apple if you have your own login system. Ref: https://developer.apple.com/app-store/review/guidelines/#sig...

This is only applicable if the Apps provide this as an option right?

But notably you can’t use any SSO providers. So if you want to use SSO you must support login with apple.

Ah yes. Good point.

Interesting workaround. I imagine this could in turn lead to more pressure on these same apps to implement Sign In with Apple - as a user, its email privacy feature becomes more interesting in this scenario.

> more pressure on these same apps to implement Sign In with Apple Afair this is actually a requirement: if you have email/facebook sign in option, you need to implement Sign In with Apple as well

Not quite. If you offer 3rd party logins you must also offer SIWA, but if you only have email/password you don’t have to.

https://developer.apple.com/app-store/review/guidelines/#sig...

I use email aliases to sign up to services for this reason exactly. There is no way to link the aliases, and so tracking is limited to the registered site only. The Log In with Apple solves this more elegantly

Sign In with Apple is not a panacea. UPS on-boarded me a couple of weeks after my initial registration, and the two services I’ve used it for (UPS and Etsy so far) have received my name from the initial registration process (a radio button selection and a bioauth).

I wouldn’t treat it as a privacy feature, I would treat it as a convenience feature. When I needed some extra mask straps, I installed Etsy, didn’t previously have an account. So I used Sign In with Apple to register, picked out some mask straps, and Apple Pay to pay. The whole process only took as long as it took for me to make a selection and two biometric authentications, but some of my information had to be exchanged in order to make that transaction possible.

Also I can login to UPS and Etsy without a password.

Regarding your side note. Apple is also, more and more, requiring you allow the login with Apple button. This would effectively shield most of the data off if you want.

My familiarity with it is superficial and only as an iPhone user, it is not an API I have ever concerned myself with, so first, I might be wrong about this next part but second, my understanding is that it provides almost nothing about you except a number or a string. I’ve never delved into Apple’s docs to find out because the “how they do it” has always been less important to me than the “how do I turn this off”.

If you go into Settings on iOS 13/iPadOS 13 and into the Privacy pane, all the way at the bottom you should see two tabs, one labeled “Analytics & Improvements” which is for information Apple collects for the device, Siri and iCloud, and another “Advertising”.

It’s in that second one that you can toggle “Limit Ad Tracking”, off by default today, on by default in iOS 14, at least that’s the plan and is the case in reports from people using the beta releases. Right below this toggle is a button labeled “Reset Advertising Identifier” which does exactly what it says. This is the “IDFA” that is the subject of discussion and will be the same value returned to Apps that request to use it. If you reset it, that will break continuity with your previous identifier, at least in theory.

Oops!

Deary me. Reading comprehension fail.

> The setting is off by default in iOS 14 and toggling it will from the default will turn it on.

Limiting tracking will be off by default? Are you sure you're not the one inverting things?

Reply on news.ycombinator.com