Hacker News Reader

Comment by helsinkiandrew | Hacker News Reader

I'm not sure that an Apple targeted ad platform would be seen as very different from Facebook's targeted ad platform by consumers. It's true that Apple have a better track record of keeping data private, and there's been no Cambridge Analytics style atrocities. But providing tracking ads of any kind (whether bundled by cohorts or what ever privacy enabling methodology could be added) could tarnish their reputation.

Just because a business can destroy another huge companies business model it doesn't mean that replicating it is a good idea.

View on HN

> Just because a business can destroy another huge companies business model it doesn't mean that replicating it is a good idea.

That's the big takeaway here. As far as I can tell, Apple really stands to gain nothing by blocking trackers when it's one of the smallest concerns I have with regards to modern digital privacy. Snowden didn't warn people about ads, he warned people about massive surveillance campaigns operating just out of view of the public.

The largest modern privacy concern is being dependent on any one private party. Relinquishing all control of your data, software and hardware to the largest company in the world is a security concern. Whether it's a sacrifice you're willing to make or not is a different story.

"The largest modern privacy concern is being dependent on any one private party."

How does that follow at all? It doesn't.

Further, Snowden pointed out government abuse surreptitiously gathering user data. In the wake of that the government has a much, much harder time doing so covertly, so in many cases they engage in the same data broker activities that everyone else does. They don't have tap underseas cables anymore -- they can just buy the data wholesale from a wide variety of sources.

> Snowden didn't warn people about ads, he warned people about massive surveillance campaigns operating just out of view of the public.

Snowden's areas of expertise wasn't ads. He warned about that which he had direct experience of - he didn't warn about global warming either.

Have we collectively forgotten about: https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_phot...

> Apple claimed in a press release that access was gained via spear phishing attacks.

Ah, because American celebrities spend so much of their time clicking through junk mail and seeing where it goes. Makes plenty of sense.

Spear phishing, by design, is intended to not look like junk mail. Maybe it's designed to look like it came from an agent? Maybe like it was from someone they had hired to take care of their pets, or kids? If you're constantly busy (and it is my understanding that many celebrities are busy, at a bare minimum), and you don't want to think too hard about a particular thing, then a spear phishing attack could quite easily hit you, if your guard isn't up, and you don't consider technology to be a battelground.

Sounds like a security oversight on Apple's behalf then. iCloud should have 2FA enabled by default if it's so easy to trick the subconscious user into handing over credentials. Furthermore, it's already been confirmed that iCloud had multiple exploits allowing for brute-force and injection attacks[0] at the same time that the hacks happened, so it's definitely more feasible that an unpatched, full-disclosure exploit was abused instead of a couple hundred interns all clicking on the same spam email at the same time.

[0] https://www.ibtimes.co.uk/icloud-accounts-risk-brute-force-a...

You might want to read up on the history: this is a key part of why Apple needed up the default experience because hectoring users about using strong passwords, not sharing them, etc. hasn’t worked. A lot of what we take for granted now was contentious at the time and it’s taken years to improve the balance in a user-friendly manner — and pointing out that they acted on problems years ago seems more like a positive than supporting whatever point you think you’re making.

Considering the celebrities involved, I find this entirely likely.

Heck, corporate CEOs get nailed by spearfishing. There was an article on HN just a couple of years ago showing that even many CIOs can't tell a real e-mail from a fake one.

Or CISOs, or analysts. Technically proficient users are _more_ likely to spot a problem but nobody is immune — it’s just a question of how much someone wants to spend targeting you.

There isn’t a second set of technology used by American celebrities. Smartphones are used by just about everyone and email is part of that.

Spearfishing looks like legitimate emails to most people which is why it works.

Of all the good reasons to criticize Apple, you picked the most bogus one. Congratulations, that's an achievement. :D

You severely overestimate celebrities' technical prowess -- and underestimate their naivete. They live in their own bubble of trust and laughs and fun and parties; and if somebody crafts a message that looks to be from their agent or a friend celebrity they absolutely WILL click on it and will give their data willingly.

None of us has the entire picture of course, but after knowing a few local celebrities 10+ years ago, I can definitely believe they are that gullible so as to make a spear-phishing attack successful.

And, let’s be clear, this is true for almost everyone — even most HN commenters. Companies have spent years training people to expect email from bizarre domains, with random attachments or HTML links which point to gibberish tracking URLs, etc. Spam filters have gotten better but by far the best protection move has been widespread U2F/FIDO deployment.

It sounds like they're just like everyone else then: in which case, even more users were vulnerable, and Apple has even more incentive to secure their system. Is there anything I'm missing here?

Nothing, except for the fact that people hate managing passwords with a passion and take the risk for their accounts willingly (I've had the heated table discussions to prove it). For them it's all about the tradeoff between "how much energy must I invest?" and "how much do I care if I lose this account?".

Most of the people I knew only enabled 2FA on their Gmail because they really couldn't afford to lose it. Everything else they were very meh about. They even had 000000 as their online banking PIN... <facepalm>

Password managers only started gaining prominence after biometric authentication allowed you to access your passwords with your finger or face.

So yeah, celebrities are users like all others -- if not slightly worse even.

I am pretty sure every corp like Apple, Google, Facebook, Microsoft et. al. would love to enforce maximum security but they also have to be very careful not to alienate their users. One good example is Google who will pester you for 2FA and recovery codes but never truly force you; they prefer to ban your account for suspicious activity instead (happened to one guy I knew some 3-4 years ago because his drunk friends tried to breach his Gmail account from several different phones).

So I get it, you don't like Apple, but as I have snarkily remarked above: it's for the wrong reasons. (I don't like them either but it's for completely other reasons.)

Maybe if you’re referring to regular phishing sure, but spear phishing is specifically designed so it won’t go to your junk email and will look like something made for them personally, there won’t be any spelling mistakes, it will have been sent from a likely email source, it will most likely contain some personal information. The right phish at the right time could catch just about anyone out.

There’s a great talk at Black Hat about how Stripe trains staff against these sorts of phishing campaigns and these are highly technical people and they still click the links. https://youtu.be/Z20XNp-luNA

Forgotten about the time celebrities got their passwords compromised by social engineering attacks, something there's no reasonable way for Apple to prevent?

No, but why on earth would it be relevant?

Have you forgotten that more Google accounts were phished than iCloud accounts in Celebgate?

>According to court filings, Collins stole photos, videos and sometimes entire iPhone backups from at least 50 iCloud accounts and 72 Gmail accounts.

https://www.washingtonpost.com/news/the-intersect/wp/2016/03...

I don't remember reading any articles about leaked Google accounts. Media is really distorting the reality when it covers every little misstep by Apple, and ignore much larger issues when it happens to other companies.

I disagree. Apple has a more diversified portfolio of business — they don’t need to go down the rabbit hole as deep as Google or Facebook to get value.

Think of early Google… they made billions off of keyword advertising before they integrated things like mapping and created a surveillance network. I think a lot of that was driven by walled gardens like Facebook killing the open web.

My guess is that Apple could leverage their relationship with customers and trust in them to sell a premium ad product with coarser targeting or for certain categories. They could do ad placement in apps, for example, or combine ad placement with one click purchasing.

Why does Apple need to get into ads at all? They seem plenty profitable already without abusing their users.

Because the current system/platforms of ads in existence is in anthesis to apples stance on privacy.

Why replace ads when they could just kill them?

They’ve already increased the flagship phone cost like 250%

Wall St demands earnings growth.

I think you're right, it's hard to argue they'll do anything near the full extraction playbook that FB/Goog runs because of that diversification, and depending on where the ads are placed, it may not risk the brand much.

My guess is app installs will be their target, for several reasons:

1. A lot of the most expensive/lucrative ads are for apps

2. Apple has better data on this - ad networks had to guess at what apps you had and how to attribute, while the iPhone knows with certainty. [1]

3. Apple already sells these ads in the App Store itself, so it stands to reason putting these ads in apps is just another step.

4. With IDFA gone, a lot of popular apps (that they want in the app store) are losing revenue and will be looking for alternate ways to support themselves. Better for the ecosystem that devs are compensated.

Apple doesn't need to give ads the Apple treatment in the way they do hardware products; they can do the more 'good enough' TV & Music treatment of leveraging their position to get some low hanging fruit. It'll pay for itself pretty quickly and provide a nice revenue stream.

The more strategic value this brings is it gets them a few steps closer to building their own search engine, providing a revenue carrot should they decide to (or need to) break with Google. Creating a search engine isn't exactly in Apple's wheelhouse, but they are shifting toward services and software more and more, it fits well with their privacy-oriented strategy, and Google does still leave a lot to be desired in UX and results. With Apple's very different incentive/revenue structure, there's many decisions they could make differently.

[1] Android used to support grabbing the user's app list but that was shut off a few years back.

If they have an advertising network set up and realize they can extract more value out of it, will they choose not to just because they don't "need to"?

It is not about Apple selling Ads per se, it is about Apple trash talking tracking Ads while they are also selling tracking ads themselves.

There is a different in tracking and mass data, cross site/ domain data gathering . Now it seems Apple has successfully lump these two together.

What does any of this stuff mean? The obvious opportunity is to redefine what a “good ad” is!

Not to mention that Apple has already tried running their own targeted ads business once and failed.

At some point income from hardware and app sales will stop to grow at the rate that Apple considers adequate. Maybe 30% cut from app store will be lowered as part of some future lawsuit settlement, maybe new cheap phone with decent hw/OS will become available, who knows, but something will happen eventually. At that point Apple can watch the income and share price go down or they can monetize the vast personal data they collected from their customers that no other company has access to. What do you think will happen?

They should and likely will sell glasses or cars or whatever new gadgets people ((will be made to) think they) need. :)

Google failed with glasses. And cars is slightly out of the picture, they don't have any expertise on that front. Apple does one job and does it very well. Commoditize quality hardware options with top-notch user experience.

The worst (best?) part is that apple already sells targeted ads - and they're getting away with it without major backlash.

> It's true that Apple have a better track record of keeping data private, and there's been no Cambridge Analytics style atrocities

You seem to be completely unaware of the multitude of data breaches and leaks that Apple has faced, some they've even tried to actively cover up. Apple has a very obvious track record of disregarding their customers interests in favour of trying to protect their PR. Why notify customers and address data breaches when you can cover it up and pretend to be the champions of customer privacy when announcing anti-competitive policies that gives Apple monopolies?

I hate Facebook a lot but I am willing to bet they are terrible largely because of their business model and not some internal factors. Apple could start out better in that space but I don't see how they'd avoid getting corrupted by the $$$...

Reply on news.ycombinator.com