Google, Meta 'break' Apple's device fingerprinting rules(theregister.com) |
Google, Meta 'break' Apple's device fingerprinting rules(theregister.com) |
And the meat seems... pretty bland. They caught a bunch of "plausibly fingerprinty"[1] tokens (that a reasonable interpretation of Apple policy would require being stored on the device) being sent unobfuscated in later requests.
That looks a lot more like a genuine mistake by developers than a real attempt to evade tracking controls to me.
[1] But... not very? Seems like they're mostly concerned with system uptime. And, sure, boot time can be a fingerprint, but by definition an ephemeral one. In combination with other techniques, sure, maybe there's a way to construct an user profile. But alone? Meh. And it seems like that's all the investigators found.
Can we please stop handing "assume good faith" to megacorps? That's something you grant to individuals, not to companies whose entire existence revolves around doing nefarious things like this. There are no genuine mistakes, there are exclusively bad faith actions that should be coupled with company-funded third party investigation and public disclosure to determine impact along with varying levels of prosecution wherever possible to act as both punishment and deterrent even if it turns out to be a genuine mistake.
I'm sure with a little effort it could easily be defeated, but for some purposes it's enough.
https://www.wired.com/story/texas-accuses-google-facebook-il...
The OP also mentions Facebook and Spotify also are violating rules, and to my knowledge they're not paying apple "billions", so this explanation doesn't pass the sniff test. The actual reason is probably far more banal: these apps command a huge user base, which would be very upset if apple banned these apps. As a result apple is letting such infractions slide because they don't want to upset users.
The EU already handed Google the browser market on a silver platter, under the guise of “competition”. How much farther would they go if Apple prevented a perceived competitor from abusing users?
Why, so that developers can have absolutely no rules against abusing their users?
If you’re important enough Apple will let you get away with murder compared to normal devs. Users don’t buy phones without FB, Instagram, Spotify, WhatsApp, Google apps, etc.
There is only one time I remember anything happening to a big app. Fortnite probably could have tracked people for years. But the they took away Apple’s cut and publicly stuck a thumb in Apple’s eye at the same time. So they got booted.
That's part of why Facebook felt rightfully indignant when Apple moved to kneecap attribution and acted like it had never heard of it
They have good looking products but the company itself is as rotten as their competition.
Side note: I wonder how much harm Apple is doing to it's brand with it's Pious Attitude and Arrogant Behaviour?
Even as a long time, but relatively small shareholder, I'm on the fence about Apple right now.
I cant see the iPhone failing to lay golden eggs anytime soon.
But the Apple Vision Pro feels like they took those golden eggs and gold platted a toilet seat.
Tim Cook runs a tight shop, but he's been riding the wave of iPhone growth and the engineering excellence that gave us Apple Silicon.
The overall Apple brand hasnt been doing so well IMHO, and it's the Brand that saved Apple back in the 90s!
You cant fake passion, and everytime we see Tim Cook on stage or presenting, I get the vibe he would rather be somewhere else!
My kids are coming up on Linux, and are never going to have the hallowed halls of 10.6 to look back on fondly.
It's sad, but every year I feel in a new way that we're merely strolling through a once-glorious cathedral built and abandoned by great engineers from a different era.
I felt this way at Google ~5 years ago, and left as soon as I could slip the golden handcuffs.
Lots of comments, but yet the downvotes! :-)
I guess I'm long past being on the internet for upvote points LOL
I think a more likely explanation is they know what would happen to their sales numbers if they kicked off Facebook and Spotify.
Developers can add an offset to the values before sending them off the device, and that might be what Apple wants them to do, but these companies have over a decade of pre-existing code that didn't do this. It's not surprising to me that there are things that haven't been updated yet given that Apple only made these requirements public fairly recently.
Something that reduces the granularity a lot, like "time since UTC 00:00:00 on the day of the last device boot", might work.
Things like the user gave permission for camera or microphone and is trying to use them but there's no data coming through. Or really most anything with Bluetooth. Or sometimes their mobile network is being weird.
That probably doesn't justify sending it off the device as a raw value, but Meta really likes driving UI from the server instead of letting the phone be smart. And they have a habit of pushing Apple's limits.
(Disclaimer: I worked for a subsidiary until the end of 2019)
It's the first thing that talk about in the docs https://developer.apple.com/documentation/foundation/nsproce...
- I find it easy to believe that some of the apps may not realize they're using the restricted APIs in an unapproved way.
- Alternately, some of the apps may not be using restricted APIs at all, and instead getting the same information with non-restricted APIs. Not clear if that's even against the rules. It certainly would be extremely sketchy if done as an intentional workaround, but it would be even easier to do accidentally. If you grepped the codebase for uses of the restricted APIs, you wouldn't necessarily find uses of these other APIs.