Hacker News Reader

Question: In the example given, you supply a salt and a domain when coming up with your UDID.

Isn't the salt of another app really easy to decompile and figure out?

After that, a competing app could find out if you've used the device ID already, which actually seems less secure than the original UDID apple provided.

The last thing I want is for apps I install to phone home with a list of other apps I have installed!

View on HN

If any of your apps has registered a custom URL scheme, and many do, any other app on your phone can easily check to see whether it's installed. That's by design.

Back when I was keeping up, it was also possible to read the mobile installation cache and get access to all of your installed applications, which is what some 'app recommender' applications did. That was an exploit which violated App Store policies - no idea if it still works.

Ah, that makes sense, thanks.

Reply on news.ycombinator.com