Slashdot Mirror
Apple Privacy Concerns Go To Court
An anonymous reader writes "From the article: 'Apple is being sued for allegedly letting mobile apps on the iPhone and iPad send personal information to ad networks without the consent of users.' Some of the apps listed are on the Android Market as well, but there is no mention of a similar problem for Google. One wonders if Apple could be persuaded to strip access to the unique phone identifiers from apps."
A followup article with an industry lawyer suggests that this lawsuit could be the first of many as users push back against privacy intrusions by app developers and ad networks.
It's about time someone got tired of it.
that is why there is no issue with google.
It CLEARLY states what is or isn't being done.
Apple won't do this any time soon. They are very demanding when it comes to backwards compatibility, and even if they kept the API but gave a dummy identifier, this would break many apps. The most I can see happening is that Apple may put a clause in their guidelines. But they did that already, and got criticised for it. It's possible that they could generate a different permanent dummy identifier on a per-app basis, but this would still break several uses for the UDID.
Referring to the UDID as "personal information" strikes me as being quite inaccurate. It uniquely identifies a device, not a person. You cannot use the UDID to get any actual personal information unless the user gives that information. The only way to get personal information without the user's consent when you only have a UDID is for developers to collude; if a user gives personal information to one app that records it along with their UDID, then the developer of that app shares that information with another developer who only has the UDID, obviously that will work. But the same arguments mostly apply to things like IP addresses as well, and those aren't usually considered to be personal information.
Bogtha Bogtha Bogtha
The odd posts are where Slashdot stores your private information that they sell to advertisers. Users only see the even posts. You have to be an advertiser to see the odd ones as well.
that is why there is no issue with google.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
most of the posts on /. are odd.
There's no reason why iOS have to send the genuine UDIDs to the app developer. If the app requests a UDID for the device, iOS should generate a key that is unique for that device AND THAT DEVELOPER.
Why? What benefit does that give you? You would get EXACTLY THE SAME DATA you collect today, using the UDID. It would be exactly of the same use to track the user; i.e. virtually none.
Seriously, what can you do with a UDID you couldn't do with the MAC address from the phone. Should we ban those as well? How about we just ban network connections altogether?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I am just sick of essentially being double charged by advertisers. I have to pay for data access on my device, then I am paying for the data transfer that the advertisers use and with wide open throttle, they will use a lot. That to me is NOT ok
I do not play in the middle of the road
Is it really Apple's problem that 3rd parties do this? Is it Apple's fault because ultimately they certify the apps? Or are they suing Apple specifically for the apps Apple has produced, and then suing 3rd parties if that is successful? The UDID exists, but no 3rd party is obligated to use that information and many don't. The article is light on details.
Because slashdot is a great big phoney!
... then why do so many android apps require internet access, and other information, even though they are just a simple game?, note pad, etc ...
Apps may report non-personal info that is used only by the app developer. For example is the device a phone or tablet, what version of the OS is being used, what 3D chip? Things that a developer may find useful in order to guide further development.
Even a calculator might want to "phone" non-personal info home. I have a calculator, Perpenso Calc for iPhone and iPad. It offers scientific, statistics, hex and bill/tip functionality. An update will soon add business/finance functionality. I have *thought about* adding code that records the number of operations performed in each of these area and reporting back to a server. This info would be transmitted in annotated plain text so that anyone watching packets can verify for themselves that no personally identifiable information is being sent and that the data is as advertised. On the sever side the data would be anonymously logged, no IP addresses or anything else. The purpose of all this would be to see which calculator functionality (scientific, hex or business) is more heavily used, and to guide further development using the feedback.
Again, I have *not* done this. Its just a thought. However I think this offers an example of a non-malevolent reason for virtually any app to establish a network connection. I am eager to hear community opinions, I encourage folks to post a response. Thanks in advance.
And that is despite nokia ignoring it nearly to the point of deliberately sabotaging it, at the same time dragging their feet and mucking up its successor phone/platform. Its not that I trust them either, I'm sure some of their management is salivating about building up an "app empire" of their own to milk data from.
I can install and run any PROGRAM* I want to do just about anything the hardware is capable of. There are some limits due to closed drivers and such, but the community is still managing to work its way around some of those. The biggest closed driver offender is the battery management but usb host mode is mostly working in spite of it. There are also some limits that are more about the lack of driver completeness rather than being closed, the wlan chip is a good example of this.
I have full control over the PROGRAM* due to being root when needed, if it is particularly insidious it can be denied access to files/programs/networks/domains/etc or even lied to believe it is "online" when in fact it is safely jailed in a neat little sandbox.
Its also quite nice to be able to run a browser with ad filtering, script blocking, user agent modification and whatever else needed for control freak websites, those are becoming really popular with developers now and really annoying. :)
I can load the "full desktop version" of many sites much faster than someone next to me on the same network can load the dumbed down "mobile version", its amazing how much bandwidth can be saved and spurious dns queries avoided for the 50 different ad/tracking domains. I even still (mostly) eat my flash cake too! I can selectively run most embedded flash videos and avoid the rest of them, the burnt crust
* "app" is a iMarketing crapware buzzword. Though it does match being a bastardized incomplete version of the word application, much like the half-arsed garbage that fills the "huge library of apps" often touted by the two main platforms. Its sad they expect people to pay for some of that absolute trash AND bend over to the spyware as well.
Why the hell is Slashdot linking to some cnet blog instead of the actual article? Is it because "anonymous reader" is a cnet shill?
http://www.businessweek.com/news/2010-12-30/apple-sued-over-applications-giving-information-to-advertisers.html
* "app" is a iMarketing crapware buzzword. Though it does match being a bastardized incomplete version of the word application, much like the half-arsed garbage that fills the "huge library of apps" often touted by the two main platforms. Its sad they expect people to pay for some of that absolute trash AND bend over to the spyware as well.
+1
You can't get the mac address of the phone over an HTTP request.
Doesn't matter. You are advocating a way for a system to obsfucate the UDID of the phone, when the developer can write code to get the MAC address of the phone and send that if they like.
But even then it still doesn't matter, because the Developer-unique UDID you are proposing means that multiple applications from that same developer can all send the same UDID to servers the developer runs. Which is exactly the same as the current situation, servers the developer runs all get the UDID. Since the developer cannot see servers the developer cannot run, it doesn't matter that the UDID is the same between developers.
Again, lay out EXACTLY what problem your system prevents. Or indeed any problem the current system even has - because there is none. There is simply no way to tie a UDID back to a person. In fact I far prefer application developers send this information to a server over collecting a username, because the UDID is totally anonymous.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I didn't look to see that you were not the OP, sorry... but it doesn't change the point that MAC over HTTP is irrelevant.
"There is more worth loving than we have strength to love." - Brian Jay Stanley