6 ms·

Sincere question: what new steps would you recommend they take? The iOS location request prompt uses very clear language while allowing for granular access, an

Sincere question: what new steps would you recommend they take? The iOS location request prompt uses very clear language while allowing for granular access, and the granted permissions are easily reviewed in Settings. The App Store requires data usage disclosures, which are presented about as succinctly as possible. They could mandate that apps share absolutely no location data with any third party, but that would break all sorts of things (external mapping APIs, for example), and it’d basically be impossible to police. Are there mitigations they could provide that I’m missing?

NavinF 4y ago
One feature they could provide (but never will) is fake location data for apps that refuse to work without it. I remember way back when CyanogenMod was a thing even they refused to implement this.
- benjymo 4y ago
  AFAIK iOs Apps have to work without additional permissions, otherwise they get rejected.
  - NavinF 4y ago
    A lot of apps “need” it. Consider AR games for example
orlp 4y ago
> Are there mitigations they could provide that I’m missing? Apple could start by stopping their constant tracking and uploading of MAC addresses around Apple devices. That's right, even if your device has no telemetry whatsoever but has active WiFi / Bluetooth network scanning, Apple is still tracking you if someone close to you has an Apple device. https://www.scss.tcd.ie/doug.leith/apple_google.pdf https://www.scss.tcd.ie/doug.leith/apple_google.pdf > We investigate what data iOS on an iPhone shares with Apple and what data Google Android on a Pixel phone shares with Google. We find that even when minimally configured and the handset is idle both iOS and Google Android share data with Apple/Google on average every 4.5 mins. The phone IMEI, hardware serial number, SIM serial number and IMSI, handset phone number etc are shared with Apple and Google. Both iOS and Google Android transmit telemetry, despite the user explicitly opting out of this. When a SIM is inserted both iOS and Google Android send details to Apple/Google. iOS sends the MAC addresses of nearby devices, e.g. other handsets and the home gateway, to Apple together with their GPS location. Users have no opt out from this and currently there are few, if any, realistic options for preventing this data sharing.
Aaronn 4y ago
Any app can get a general sense of your location from your IP address (unless you are using a VPN) since Apple's Private Relay feature only works in Safari and Mail, not in third party apps. I would love the ability require apps to ask permission to access the internet, or even better, a way to limit connections to specific domains like Little Snitch can do on macOS. Many apps don't have a legitimate need to access the internet such as a photo editing app or a single player game. iOS shouldn't ask for internet permission by default but it would be great to have as part of Lockdown Mode or another higher security mode. https://www.apple.com/newsroom/2022/07/apple-expands-commitment-to-protect-users-from-mercenary-spyware/ https://www.apple.com/newsroom/2022/07/apple-expands-commitm...

NavinF 4y ago

One feature they could provide (but never will) is fake location data for apps that refuse to work without it. I remember way back when CyanogenMod was a thing even they refused to implement this.

benjymo 4y ago
AFAIK iOs Apps have to work without additional permissions, otherwise they get rejected.
- NavinF 4y ago
  A lot of apps “need” it. Consider AR games for example

orlp 4y ago

> Are there mitigations they could provide that I’m missing? Apple could start by stopping their constant tracking and uploading of MAC addresses around Apple devices. That's right, even if your device has no telemetry whatsoever but has active WiFi / Bluetooth network scanning, Apple is still tracking you if someone close to you has an Apple device. https://www.scss.tcd.ie/doug.leith/apple_google.pdf https://www.scss.tcd.ie/doug.leith/apple_google.pdf > We investigate what data iOS on an iPhone shares with Apple and what data Google Android on a Pixel phone shares with Google. We find that even when minimally configured and the handset is idle both iOS and Google Android share data with Apple/Google on average every 4.5 mins. The phone IMEI, hardware serial number, SIM serial number and IMSI, handset phone number etc are shared with Apple and Google. Both iOS and Google Android transmit telemetry, despite the user explicitly opting out of this. When a SIM is inserted both iOS and Google Android send details to Apple/Google. iOS sends the MAC addresses of nearby devices, e.g. other handsets and the home gateway, to Apple together with their GPS location. Users have no opt out from this and currently there are few, if any, realistic options for preventing this data sharing.

Aaronn 4y ago

Any app can get a general sense of your location from your IP address (unless you are using a VPN) since Apple's Private Relay feature only works in Safari and Mail, not in third party apps. I would love the ability require apps to ask permission to access the internet, or even better, a way to limit connections to specific domains like Little Snitch can do on macOS. Many apps don't have a legitimate need to access the internet such as a photo editing app or a single player game. iOS shouldn't ask for internet permission by default but it would be great to have as part of Lockdown Mode or another higher security mode. https://www.apple.com/newsroom/2022/07/apple-expands-commitment-to-protect-users-from-mercenary-spyware/ https://www.apple.com/newsroom/2022/07/apple-expands-commitm...