Hacker News Reader

Here is the CAID spec:

https://web.archive.org/web/20210316035745/docs.trackingio.c...

That's very helpful and adds a lot of clarity.

You can tell from the code that the "exploit" here is abusing keychain sharing.

iOS has a feature where you can pack a surprising amount of generic data into keychain storage, intended for passwords or auth credentials.

iOS also lets app developers opt-in to shared credential storage, so that if you have multiple apps, the user only needs to login once. Here's a blog post on how to do it: https://evgenii.com/blog/sharing-keychain-in-ios/

A little-known quirk of the iOS keychain is that it persists across app installs. This is useful because if multiple apps share credentials in the keychain, you don't want uninstalling one app to log you out of other apps.

If an American company tried this (looking at you Branch.io), would it be banned by Apple? Maybe? That seems to be the controversy here.

Perhaps Apple needs to rethink its keychain sharing API and make the user opt-in to credential sharing.

Also a keychain management tool would be nice, so users can see what data apps are permanently storing on their devices (even if the app is uninstalled).

Credential sharing only works between apps registered to the same developer. So no, this does not allow an tracking ID usable by all apps.

And remember, any trick abused to create tracking IDs stands the risk of being detected and blocked by Apple in the next iOS update. It has been announced, it has happened, it will keep happening.

> Credential sharing only works between apps registered to the same developer.

That's right, but it does allow persisting an id through reinstalls of the same app, and sharing that id between apps of the same developer.

> So no, this does not allow an tracking ID usable by all apps.

It effectively does though. For example, imagine a mobile game company with 10 games. With this technique, you can track that user across app re-installs in each of those games.

Now imagine another game company doing the same trick. If both companies send up their independent tracking IDs to a central server along with any other info they can get about the user (email, screen name, IP, whatever), then you can strongly correlate users across multiple tracking IDs. The user has no way to reset these IDs even if they delete and reinstall the apps using them.

Apple tried removing the keychain persisting in an iOS beta a while back and there was a big outcry from developers as it broke their ability to detect and ban users across app reinstalls. Apple reverted that and responded by adding a new feature where developers could permanently track 2 boolean values for a device (per app) but I don’t know who has bothered to switch to that mechanism.

The story is that major Chinese companies and the state are working together to develop an alternative to Apple’s IDFA. While aggressively pushing back against companies in the U.S. tracking users, Apple seemingly doesn’t mind having a double standard for China.

It's a bigger choice than that for them, or for anyone. If the government requires pervasive tracking, it's either allow it or stop selling phones in China, the world's biggest market for cell phones. And given that economies of scale matter (for things like swallowing flat rate development costs for those nice SOCs they design), it's hard to say goodbye to half your market.

Samsung certainly won't take a principled stand on this and stop allowing app tracking. And in a competitive market, deciding to not sell cell phones in China means less development capital for designing the next generation of hardware. They'll start circling the drain and wind up like Motorola or HTC.

I'm not saying that they shouldn't be consistent - just that choosing to not sell in China will mean losing everything outside of China eventually.

> Apple seemingly doesn’t mind having a double standard for China.

That seems to be the case with many businesses. Nobody wants to lose that entire market just to stand on principle.

Google did and didn't stop existing as a company

Google opted out of the Chinese market because it violated their principles? They didn't try to make a censored Chinese version of Google?

A part of Google tried to do so and the majority of its employee (enough to scare its senior executives) fiercely rejected that attempt, so it gets overturned.

Is that true? A _majority_ of Google employees protested Dragonfly? Last I heard there was a petition with just ~1% of them on it.

China is also the place where most of Apple products are produced, this matters a lot as well...

Is that really the story? When the USG requires Apple to access something on the basis of legal intercept then Apple will comply, as they did with the FBI and that mass shooter guy: Apple granted the FBI access to the iCloud account, the FBI botched it and then wanted access to the data on the physical phone, which Apple couldn't provide due to not knowing the encryption key.

The only other "big stance on privacy" that Apple has is that, unlike their main competitor Google, they are not an advertisement business. So they have no real financial motivation to add tracking to their devices and software vs a Google were advertisement and user tracking are pretty big pillars of their financial income.

Infrastructure like that is trivial to hijack for surveillance once in place, which privacy wise makes Google devices and software by default the worse choice unless using specifically cleaned and hardened custom roms.

So while these two issues are related, legal intercept and privacy, they are not as easily conflated as you make it sound when you claim Apple is having "double standards" when they really are not "double standards" but simply abiding by local laws and regulations.

In the US, the analogy would be if apps had tracking SDKs in them, that fingerprinted users across apps, in order to better target them for advertisements, and then the US government can pick up that data and do whatever they'd like with it.

I've never really thought about it before, but it would be pretty easy for a three-letter agency to set up an online advertising company for this purpose.

They start their own airlines (Air America, JANET, etc.), so starting an adtech company should be a walk in the park.

But they don't even need to do that - they just approach an existing adtech company with a FISA warrant and get their data. If they started their own adtech company, eventually they would be out-ed and exposed. But with a FISA warrant, it's mostly business-as-usual for everyone.

> But they don't even need to do that - they just approach an existing adtech company with a FISA warrant and get their data.

Depending on who they approach, they won't even need a FISA warrant because in the US information voluntarily given to third parties has "no reasonable expectation of privacy" [0]

[0] https://en.wikipedia.org/wiki/Third-party_doctrine

There are some precedents, such as:

https://www.vice.com/en/article/epdkze/muslim-apps-location-...

> I've never really thought about it before, but it would be pretty easy for a three-letter agency to set up an online advertising company for this purpose.

There's no need to set one up when you can break into many/all the existing advertising companies; remember "SSL added and removed here :^)" written on an NSA slide, referring to Google's clear-text internal data-center traffic? Also, the NSA spent a fuck-ton of money on compute to factor enough primes to trivially break 20-40%[1] of SSL traffic of the day...in real time.

1. This was about 6 years ago, I can't remember exact percentage, but it was definitely at least 20%, IIRC, the attack was on the key-exchange step

> Creative Artists Agency

This is wrong. Creative Artists Agency is a talent agency, based in the US, with the same abbreviation.

This reminds me of how Linkedin and many others used to upload entire phonebooks to unecrypted endpoints, making it simple for US agencies to analyze social networks of foreigners with impunity.

Did they really stop doing that?

Ha, good question. Generally, everyone switched to HTTPS. But that doesn't protect against situations like with Yahoo, where the agencies were tapped-in after the SSL termination. I guess it's not a stretch to assume it's still going on.

From what I understand, this CAID will be an effective replacement of Apple's IDFA. It will allow partner advertising groups to tag iPhone users directly without relying on any of Apple's identifiers.