iOS 18 cracks down on apps asking for full address book access | Hacker News Reader

iOS 18 cracks down on apps asking for full address book access

techcrunch.com

97 pointsmfiguiere40 comments

I love these crackdowns and increasingly granular permissions. They did a similar thing for photos a while back.

I wish they’d crack down on advertisements in notifications. Sleazy players like Uber will spam you with ads, so you’re forced to choose between receiving ads or missing out on actually important notifications.

There’s nothing better than getting buzzed for an advertisement which you can conveniently view on your lock screen!

I think they used to have a rule about this but then their own apps started to violate it, so they loosened restrictions. What I'd really love to see is notification categories so you can choose which to accept.

Android has notification categories, but I think those end up getting abused too.

I'm sure enforcement around it would be difficult but I'd imagine most major apps would fall in line if only because the risk of losing their notification entitlement would be too great.

What do you mean with enforcement? Literally delisting the app if it doesn't correctly classify their notifications?

Because as they said: android has multiple channels, but the app owners quickly realized that if they classified their notifications, the unwanted channels such as "news"/advertising get disabled. So they bundle it into the same channel you don't really want to disable again.

For example a taxi service that gives you discounts etc on the same channel as the notification that the driver is almost there.

I really don't see a solution to this problem, because the consumer almost always wants some notifications, so disabling all from apples side wouldn't really work either (as customers would be negatively impacted).

It'd be great if Apple found a solution, but I can't think of one that has any chance of succeeding. Maybe their new Apple Intelligence feature... We don't know enough about it's capabilities yet, but it could potentially act as a filter, with the potential for false negatives/positives. But that should hopefully be okay for something like notifications

I moved my primary phone from Android to iOS and this is hands down the thing I miss the most. I ended up silencing a lot of apps wholesale, mostly rideshares, as a result.

I think they still have this rule, but simply reduced enforcement (classic authoritarian move).

I reckon Apple Intelligence will end up solving this problem - have it classify notifications and then give you control. That way, you're not reliant on ongoing good behaviour from developers.

I'm not sure AI can do that reasonably well. Notification "Foo is available for sale now" - is that an ad? From the Uber app, yes. From the app explicitly used for tracking bargains, no. From the supermarket app, maybe, depends if I subscribed to that thing. There's a lot of context that automation will not understand.

I'm pretty sure the SLM model can track which ones you interact with.

The current iOS version already does this to a degree: if you use profiles. It notices if you often interact with an application during X profile and asks if you want to add it to that profile's allowed apps.

They already have (had?) a rule against spam notifications. They never enforced it (there's no way for a user to complain/flag notifications as spam) and their own apps breach it nowadays.

There's no reason to believe they would want to offer this feature, even though it is indeed trivial for an LLM or even a basic regex filter.

This would probably be a good use case for “ai”, to filter out notifications that are clearly ads.

Can’t wait for the “AIO” (Apple Intelligence Optimization) engineers at Uber to find how to make notification ads surface higher.

You don't need AI to filter out adverts. Apple can literally just say no adverts in notifications or you app is getting delisted.

Actually Apple Intelligence will have such a feature, IIRC ML will be used to determine and surface only the important notifications to the top of your lockscreen.

I'm one of those types who only uses Uber every two or three years, so I just disable notifications for it. If a ride is coming, I'll just check my phone loads.

To be fair, actual ads can be disabled in most of these apps. Uber has a setting for this, I had it disabled all this time and don't ever recall a single ad.

The next problem however is the "feedback" plague. Every company nowadays spams you about it. It's not technically an ad, but wastes just as much of your time/attention and is completely pointless when they can instead just default all feedback to "good" unless the user explicitly says otherwise.

Yeah, I don’t care if it’s an advertisement or not, my attention is a finite and scarce resource. I won’t allow it to be stolen by an app just because it suits them.

Doordash is on my chopping block to replace completely at the moment, because it had spam notifications that were not categorized and no way to turn them off. That’s a “vote with your wallet” deal for me.

Same with AdBlock, I got tired of seeing AdBlock tabs pop up all the time, and no clear way to disable them, so uBlock has been a recent switch for me. At least there I can’t be too bothered, because they were also admittedly not getting anything from me.

Cyclical. It'll slide the other direction for developers and we'll (as users) come right back around to lose even more utility

Apple, Google, etc are in the middle of this Trojan horse dynamic. They want the notifications to be.. literally anything that gets your attention.

You, presumably, want them to be actionable. This 'crack down' stuff that isn't complete control and proper categorization... is performative service, little more.

This is managed so arbitrarily on either ecosystem that I live like it's 2001 and do everything on my desktop

I have always disliked any app that wants access to my contacts.

While the rest of my friends do not repsect my privacy I do respect theirs.

I use a seperate database that isolates my contacts so that no apps can have access.

On android I use OpenContacts which does the same thing.

OpenContacts:

A different database for contacts to keep them private only to you.

We should not be sharing our contact information online.

It only takes one or one business to expose them. Combine that with the LinkedIn breach or another which also requests your contacts.

One of my recent phone lookups for a dying friend had me, other family, and their friends numbers included along with previous phone numbers. I found my exotic 999 number I had for a short time.

None of my friends change their phone numbers and I am working to keep a 25 year old number by doing a two step switch because I have no idea how many places that have the number as a backup for codes and some family can’t seem to switch to using our mobile numbers.

This is great but it feels like closing the barn door after the horses have already left. All the big social networks already know your address book! Would have loved this from the very beginning of the App Store.

It will take ~5 years for the social media landscape to rotate again. The next "generation" will be protected at least.

I never said 'yes' to any of those prompts.

If you did, why?

I think I got swindled into it by not paying attention when trying to look up a friend!

They use underhanded tactics such as showing a pixel-perfect recreation of the address book permission dialog with only the "accept" button functional, and upon clicking that the real one pops up - most people would think it was just a glitch and click again on the real one (even though technically the "decline" button is now functional too).

More than just “growth hacking” apps.. if someone gets access to your contacts they can generally identify who you are just from this information alone.

Data brokers have been harvesting this information for years.

This is a huge step forward for data privacy.

Even just cynically, it doesn't even work:

> in many cases, that hack does not drive sustainable growth in the long term

It's rarely about growth per se. Inferring someone's social graph and reidentifying them based on that would allow you to link them to their other accounts/shadow profiles and better target ads for them and their friends.

Simple example, let's say the social platform knows you're into football. It has no information on whether your friends are into it, but if they see that you are mutual contacts they can try show football-related ads to your friends too and potentially get a boost in ad performance.

Kind of. But they could have done this many moons ago. They didn’t.

In no way am I going to be duped that Apple suddenly give a damn about anything other than protecting their investment.

I would love to be able to block network access for certain apps.

Mainstream Android used to have this, but the feature was dropped because it could be used to block ads.

Some Android distributions like eOS have re-enabled the switch.

You can at least block certain apps from using mobile data

Ironically, iPhones for the China market actually allow you to restrict not just cellular data but also Wi-Fi.

It would seem to me that eventually Apple will have some kind of 'identity proxy' that apps will need to talk to in order to have an app send to a real contact. It can be overridden explicitly when needed by the end user but the default would be a sort of unique UID that changes over time. Think private relay/URL's but for identity.

> Think private relay/URL's but for identity.

More like Hide my Email [0].

[0] https://support.apple.com/en-us/105078

Again, this is only possible because big ad (eg Facebook) MUST follow AppStore rules to have access to customers. This is why I love the Apple walled garden.

In this case not because contacts are an OS API and always have been since before the iPhone. They could do the same on Mac OS if they wanted.

This has nothing to do with the App Store. The API access is being gated by the user granting permission, rather than some reviewer looking at the app and deciding it violates a policy.

Letting users lock and unlock doors is completely different from a walled garden.

I am surprised this happened later than limited photo sharing did.

Reply on news.ycombinator.com