6 ms·

Damn. The "iPhone last setup or erased on ..." is really nasty. What can a user really do about that? I feel like this should be fudged somehow by the OS.

by regecks 3mo ago

matthewfcarlson 3mo ago
Is the threat model tracking across multiple apps to correlate what you're doing? In that case, a single app wouldn't show you the fudging.
- ramses0 3mo ago
```Based on a binomial/Poisson distribution and a baseline of 21 million U.S. device sales per release, a fingerprint relying on "seconds since setup" fails to uniquely identify individuals. In the high-density Early Adopter phase, you will share your exact setup second with an average of 1.01 other people (a total matching pool of ~2 people). Six months into the cycle, you will still share that second with an average of 0.68 other people.``` In the U.S., device setup time (to the second) very conservatively gets you clubbed into a single group of 100 individuals as an "advanced persistent threat" tracker. Even compressing activations to "80/20 during business hours" the math kindof maxes out at a pool of ~5 people, and assuming worst case "20x" of that still means you're still pretty darned identifiable. If you get ~6-8 more bits of entropy (eg: Device Type + Capacity is easily 2-3 bits, and Time Zone is probably another 2-3 bits) you're cooked!
- cute_boi 3mo ago
  Just using IP address, device storage, device name, and similar signals, we can identify a user. It isn’t difficult to correlate these data points. Apps like Facebook also force developers to use their SDKs for even small features.
  - ramses0 3mo ago
    Yeah, but IP address is "obviously" correlated with a distinct/persistent tranche of users. It's surprising that volume c_time is both more persistent as well as more unique than IP.
- withinboredom 3mo ago
  Reminds me of a meeting I was party to with the Safari team. We worked with them on some standards stuff at an old job. They claimed to have creepy-level tracking of users back then. We were discussing how to identify users for an A/B test across millions of sites and comparing what fingerprints we could both derive to most likely end up on the same user. If you use a closed source browser. That’s the kinda shit they do.
  - saagarjha 3mo ago
    Are you claiming the Safari team is fingerprinting their users?
  - st3fan 3mo ago
    I call BS on that story
  - snowe2010 3mo ago
    Safari isn’t closed source…
Gigachad 3mo ago
Seems like in general the iPhone was not designed to avoid fingerprinting from installed apps. Only protection would be avoid installing apps and use the web browser when possible.
- p-e-w 3mo ago
  The intended “protection” is the ToS, which requires apps to disclose what they are tracking and whether they perform cross-premise tracking.
  - paytonjjones 3mo ago
    Often it's not the app itself doing tracking or cross-premise tracking, but data is passed to installed third party SDKs that do.
  - Barbing 3mo ago
    Ah, that’s funny. Too bad those privacy nutrition labels are only honor system. They give that one completely up to businesses, then, to devs. They also thought they should let an app maker prohibit screen recording, which might promote development since it protects revenue of e.g. subtitling apps as one example. But end result is you even end up with a black screen when recording the iPhone Mirroring app from a Mac. Apple owes us a better balance here. iCloud Private Relay for all apps (why only Safari?! and Mail and HTTP) as a start, and plugging some of the privacy holes Loupe exposes. They don’t want us abusing free trials I suppose.
- cute_boi 3mo ago
  These days many things don't work on browser. Even reddit is very difficult as we get constant nagging.
  - potatoproduct 3mo ago
    old.reddit.com
    - 3mo ago
dylan604 3mo ago
Maybe I'm being really thick, but why is this information that the OS would make available to apps?
- UqWBcuFx6NV4r 3mo ago
  Maybe it’s derived
  - LoganDark 3mo ago
    It's probably the app checking the last modified timestamp on some filesystem location that's only touched during setup. Edit: It's not a last modified timestamp, it's a volume creation timestamp: https://github.com/mysk-research/loupe/blob/2262efd4456ecba802e1c69f6012859b92eec969/code/Loupe/Providers/StorageProvider.swift#L68-L76 https://github.com/mysk-research/loupe/blob/2262efd4456ecba8...
    - dylan604 3mo ago
      Again, why is this something that an app would need access? The next test under the creation timestamp value is a test for getting the UUID of the volume. Again, why is an app allowed to access the unique identifier? Apple knows this type of thing is precisely what deanonymizing people would drool over, so why is this accessible. What part of iOS would even need to know this for a legitimate purpose? Are these calls using private methods that Apple does not intend for use being abused for purpose? I'm not an iOS dev, so I have no familiarity with this.
      - fragmede 3mo ago
        To stop people from using apps they haven't paid for. As an honest person, if you want to use an app, you'd pay for it. Unfortunately, not everyone out there is honest, and there are various ways to get around having to pay for an app that costs money. Fingerprinting the device lets sellers of software find people who didn't pay for the software but are somehow using it.

Damn. The "iPhone last setup or erased on ..." is really nasty. What can a user really do about that? I feel like this should be fudged somehow by the OS.

by regecks 3mo ago

Damn. The "iPhone last setup or erased on ..." is really nasty. What can a user really do about that? I feel like this should be fudged somehow by the OS.

matthewfcarlson 3mo ago

Is the threat model tracking across multiple apps to correlate what you're doing? In that case, a single app wouldn't show you the fudging.

ramses0 3mo ago
```Based on a binomial/Poisson distribution and a baseline of 21 million U.S. device sales per release, a fingerprint relying on "seconds since setup" fails to uniquely identify individuals. In the high-density Early Adopter phase, you will share your exact setup second with an average of 1.01 other people (a total matching pool of ~2 people). Six months into the cycle, you will still share that second with an average of 0.68 other people.``` In the U.S., device setup time (to the second) very conservatively gets you clubbed into a single group of 100 individuals as an "advanced persistent threat" tracker. Even compressing activations to "80/20 during business hours" the math kindof maxes out at a pool of ~5 people, and assuming worst case "20x" of that still means you're still pretty darned identifiable. If you get ~6-8 more bits of entropy (eg: Device Type + Capacity is easily 2-3 bits, and Time Zone is probably another 2-3 bits) you're cooked!
- cute_boi 3mo ago
  Just using IP address, device storage, device name, and similar signals, we can identify a user. It isn’t difficult to correlate these data points. Apps like Facebook also force developers to use their SDKs for even small features.
  - ramses0 3mo ago
    Yeah, but IP address is "obviously" correlated with a distinct/persistent tranche of users. It's surprising that volume c_time is both more persistent as well as more unique than IP.
- withinboredom 3mo ago
  Reminds me of a meeting I was party to with the Safari team. We worked with them on some standards stuff at an old job. They claimed to have creepy-level tracking of users back then. We were discussing how to identify users for an A/B test across millions of sites and comparing what fingerprints we could both derive to most likely end up on the same user. If you use a closed source browser. That’s the kinda shit they do.
  - saagarjha 3mo ago
    Are you claiming the Safari team is fingerprinting their users?
  - st3fan 3mo ago
    I call BS on that story
  - snowe2010 3mo ago
    Safari isn’t closed source…

Gigachad 3mo ago

Seems like in general the iPhone was not designed to avoid fingerprinting from installed apps. Only protection would be avoid installing apps and use the web browser when possible.

p-e-w 3mo ago
The intended “protection” is the ToS, which requires apps to disclose what they are tracking and whether they perform cross-premise tracking.
- paytonjjones 3mo ago
  Often it's not the app itself doing tracking or cross-premise tracking, but data is passed to installed third party SDKs that do.
- Barbing 3mo ago
  Ah, that’s funny. Too bad those privacy nutrition labels are only honor system. They give that one completely up to businesses, then, to devs. They also thought they should let an app maker prohibit screen recording, which might promote development since it protects revenue of e.g. subtitling apps as one example. But end result is you even end up with a black screen when recording the iPhone Mirroring app from a Mac. Apple owes us a better balance here. iCloud Private Relay for all apps (why only Safari?! and Mail and HTTP) as a start, and plugging some of the privacy holes Loupe exposes. They don’t want us abusing free trials I suppose.
cute_boi 3mo ago
These days many things don't work on browser. Even reddit is very difficult as we get constant nagging.
- potatoproduct 3mo ago
  old.reddit.com
  - 3mo ago

dylan604 3mo ago

Maybe I'm being really thick, but why is this information that the OS would make available to apps?

UqWBcuFx6NV4r 3mo ago
Maybe it’s derived
- LoganDark 3mo ago
  It's probably the app checking the last modified timestamp on some filesystem location that's only touched during setup. Edit: It's not a last modified timestamp, it's a volume creation timestamp: https://github.com/mysk-research/loupe/blob/2262efd4456ecba802e1c69f6012859b92eec969/code/Loupe/Providers/StorageProvider.swift#L68-L76 https://github.com/mysk-research/loupe/blob/2262efd4456ecba8...
  - dylan604 3mo ago
    Again, why is this something that an app would need access? The next test under the creation timestamp value is a test for getting the UUID of the volume. Again, why is an app allowed to access the unique identifier? Apple knows this type of thing is precisely what deanonymizing people would drool over, so why is this accessible. What part of iOS would even need to know this for a legitimate purpose? Are these calls using private methods that Apple does not intend for use being abused for purpose? I'm not an iOS dev, so I have no familiarity with this.
    - fragmede 3mo ago
      To stop people from using apps they haven't paid for. As an honest person, if you want to use an app, you'd pay for it. Unfortunately, not everyone out there is honest, and there are various ways to get around having to pay for an app that costs money. Fingerprinting the device lets sellers of software find people who didn't pay for the software but are somehow using it.