Hacker News Reader

Comment by simonh | Hacker News Reader

There's no way for Apple to stop developers watching what users do in their app, if that app has any kind of server backend at all, and no way to stop developers taking that data and doing whatever they want with it. I mean how is Apple supposed to stop developers accessing data on the developer's own servers? So the only way to disincentivize this behaviour is with policies that ban it and the threat of expulsion from the App Store if you're caught.

I know some of these tracking APIs send data to third parties directly, but if that was banned all this traffic would just be re-routed through the app developer's back end so it would just sweep the problem under the carpet.

We can see from history with Facebook that shady dealings with data to third parties has been caught in the past, it's quite possible to get away with it but also we know that it also has a tendency to come to light.

Anyway, what's the alternative?

View on HN

> I know some of these tracking APIs send data to third parties directly, but if that was banned all this traffic would just be re-routed through the app developer's back end so it would just sweep the problem under the carpet.

I quit a job over this. I don't remember exactly which service it was we were using (mixpanel maybe?) and we found out some users where blocking access to service servers (either at router level or something else). The solution? make a proxy api endpoint that would just re-route the calls to the service.

I beg and begged, saying 'look, these are users that specifically blocked 'service', lets respect that and get our data from the users that haven't' (this was before the Apple privacy changes a couple years ago). I was steamrolled because they knew better than users. I handed my notice the moment the ticket landed in the board.

That’s awesome that you quit over that. Good on you.

I care deeply about this stuff, and I’ve read a couple of contemporary public studies - both corporate and state funded - that suggest that end-users really do care about this stuff too, and that abandonment due to poor privacy policies can be on the order of 40%. Forty percent!!

So I started my last business with this in mind: a pro-privacy fintech business. We were gonna be proud of our privacy policy and implement it using technical means.

But the moment the investors came along, I got stonewalled. They didn’t care about the research. They didn’t care about the users. They just had this belief that a user friendly privacy policy would somehow hurt the business and they refused to commit to what I saw as a key advantage of the product. Our privacy policy was a nightmare. We had almost nothing to give users.

I quit too, and to this day, I have no idea what could possibly be worse than 40% abandonment in a sales oriented fintech.

I feel like investors have too much influence in business decisions they don't quite understand. I understand that it's their money at risk, so they want the greatest return in the least time, but their excessive influence has soured many great things.

Maybe something like small stockholders would work, as they are not even allowed to vote in the direction the company takes, so their only influence is selling stock (voting with their wallet). It would certainly widen the door for fraud, but it's not like fraud in uncommon with the current system, and I'm tired of seeing how this tale keeps repeating in practically any area of commerce.

I agree. Investors are conservative, but changing the world isn’t.

More than conservative, they're voracious. Some investments fail, and others don't, and they want to extract maximum value of the latter without stopping to understand why did they work. Consequently, they slowly turn the latter into the former.

Yeah I 100% agree. None of the people involved in my last business have any interest in understanding how they fucked up. They blame me, because I kept pointing out that what they were doing was not going to work. It didn’t work - and somehow that’s now my fault!

> So the only way to disincentivize this behaviour is with policies that ban it and the threat of expulsion from the App Store if you're caught.

Then despite all of the anger against restrictive App Store policies and behaviors, the App Store is still insufficient to prevent intrusive user tracking.

> Anyway, what's the alternative?

OS-level protections that obfuscate on-device data in such a way that third party apps cannot collect the actual data. Or restricting developer access to that information in the first place.

What specific protection are you envisioning here? An OS that completely locks down access to user input is one that you can't write a useful application for in the first place. Once the OS has handed the program a string the user entered, or a button tap, it can't prevent the program from recording that.

Something like Apple’s user anonymizer patents

https://venturebeat.com/2012/06/20/new-patent-will-apple-clo...

Looks like they have a recent patent for obfuscating location data, too

https://patent.nweon.com/21429

Can you give me an example of a third part app that might need access to on-device data outside the app, but for which obfuscated data would be sufficient?

Let's say I have a calendar app and ask users for permission to access their address book, how would obfuscated address data be useful to the app? Of if I have a navigation app and need access to location data, how would you obfuscate that and still have it capable of navigation? I suspect you haven't thought this through.

Here, Apple has also invented something that has a use case (albeit an edge one) that is applicable: obfuscating visual data from a camera for the purposes of protecting confidential data (from guest users, presumably): "Obfuscating the display of information and removing the obfuscation using a filter"

https://www.patentlyapple.com/patently-apple/2012/01/apple-w...

https://patents.google.com/patent/US20110206285A1/en

And a follow-up: "gaze-dependent visual encryption"

https://appleinsider.com/articles/20/03/12/gaze-detection-ma...

And even more articles:

https://www.patentlyapple.com/patently-apple/2011/05/apple-w...

https://www.patentlyapple.com/patently-apple/2011/08/apple-i...

I know obfuscation is possible, that’s fine, but you’re not answering my question. How is that applicable in this case?

Can you give me an example of how obfuscation prevents an app, with access to data it needs to function, from sharing that data with the developers. Because as far as I can see it’s irrelevant to this issue.

Wait a second, TFA itself talks about how obfuscation can limit the service area of data that third party apps can phone home with.

> Trackers can’t send data that they don’t have access to, so the most direct technical fix is to limit or eliminate app access to information that is used to fingerprint devices. In iOS 15, apps are allowed unlimited access to device data that are totally irrelevant to their functionality. For example, why would any app need access to the exact second that the user last restarted their iPhone? And why does iOS give apps access to this data in such a high degree of precision? Data such as an iPhone’s remaining battery and screen brightness (both accurate to 15 decimals), or an iPad’s remaining free space (down to the byte), serve no legitimate, non-fingerprinting purpose for most apps. And for the rare app that might need this level of precision, App Review should approve the usage on a case-by-case basis.

Even without App Review, Apple could build into the API the explicit use of a permission requests system (extending beyond the current one), that itemizes all of the types of permissions a developer can ask (to complete specifics), add that to the existing section in the Info.plist, and expose that to the user when downloaded into a UX that goes into specific details about what the user is exposing. Better yet, to turn off features as granular as access to "what keyboards are on this device."

Apple could build GDPR into its system itself, while obfuscating the data it leaves out, as with some of the aforementioned links. So I see now obfuscation is only part of the puzzle, the rest is making the permissions system even more robust.

> the only way to disincentivize this behaviour is with policies that ban it and the threat of expulsion from the App Store if you're caught.

If the claim is that only App Store review is sufficient, then the App Store does not go far enough. The article states "Apple also needs to take a hard line against closed-source trackers — especially the ones that further encrypt the data they’re sending to third-party servers [...] the only way to ensure the tracker isn’t stealing any of this, is for the tracker to reveal their source code." Mandate that tracking APIs and libraries must either be open source, or make themselves open to App Store review. If not, then the App Store is just a fig leaf, a half-measure.

They already have heavily locked down permissions for various forms of on-device data outside third party apps. That was put in place years ago. This is mainly about in-app activity tracking and sharing that with third parties, not data outside the app. They are separate issues.

>all this traffic would just be re-routed through the app developer's back end

If it's any consolation, running a proxy at least increases the baseline cost of using 3P trackers. User telemetry and other data is small, but for popular apps that adds up and gets factored into the equation on whether or not to use 3P.

They could also report this behavior to the appropriate regulators and let them handle the enforcement. Maybe they'll take their time, but they will get there.

In the end this is not a technical problem but a juristical one.

Reply on news.ycombinator.com