Slashdot Mirror

← Back to Stories (view on slashdot.org)

Mozilla Wants Apple To Change Users' iPhone Advertiser ID Every Month (zdnet.com)

Posted by msmash on from the how-about-that dept.

Mozilla has launched a petition today to get Apple to rotate the IDFA unique identifier of iOS users every month. From a report: The purpose of this request is to prevent online advertisers from creating profiles that contain too much information about iOS users. IDFA stands for "IDentifier For Advertisers" and is a per-device unique ID. Apps running on a device can request access to this ID and relay the number to advertising SDKs/partners they use to show ads to their users. As experts from Singular, a mobile marketing firm explain, "IDFAs take the place of cookies in mobile advertising delivered to iOS devices because cookies are problematic in the mobile world." IDFAs are different from UDIDs, which stand for "unique device identifiers," which are permanent and unchangeable device identifiers. Apple added support for IDFAs specifically to replace UDIDs, which many apps were collecting for all sorts of shady reasons, enabling pervasive tracking of iOS users.

49 of 101 comments (clear)

  1. Now go after Microsoft by Anonymous Coward · · Score: 1

    They do the same thing.

    1. Re:Now go after Microsoft by Red_Forman · · Score: 2

      And then go after Google and Facebook, and watch them laugh at your demands.

    2. Re:Now go after Microsoft by KiloByte · · Score: 2

      Microsoft at least does IDKFA -- with apple, the K are entirely Apple's, not shared for you. (Hint: you're doomed. A cookie (of the non-tracking kind) to anyone who gets the reference.)

      --
      The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
    3. Re:Now go after Microsoft by viperidaenz · · Score: 2

      Who does IDDQD then?

  2. Reasonable And Good Idea by omfglearntoplay · · Score: 3, Insightful

    I think this is a very reasonable thing to do. Now that we have the government looking hard at all this data collection, now is the time for Apple to step up and do something like this to help out the end user.

    1. Re:Reasonable And Good Idea by AmiMoJo · · Score: 1

      Maybe it would be better to connect the function call to a random number generator.

      Then again that might encourage advertisers to look for other ways of fingerprinting the device.

      That's the reason that Apple argued in favour of making the HTML5 pingback function mandatory and impossible to disable. Yes Google got the flak for it but Apple made the same argument. If it's removed then advertisers will just find some other way to do it, making things worse.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    2. Re:Reasonable And Good Idea by AHuxley · · Score: 1

      Why would any internet user want to accept tracking by a computer company, ad company?

      --
      Domestic spying is now "Benign Information Gathering"
    3. Re:Reasonable And Good Idea by alvinrod · · Score: 2

      Better to constantly rotate existing IDs than to randomly generate new ones. If you reuse existing ones and change them randomly, it pollutes data sets in ways that are harder for the companies that maintain them to detect. People are creatures of habit, so it likely wouldn't take very long to tie a pattern of behavior to an existing profile with a high degree of certainty.

      At the end of the day if the user has full control over their device (which they don't with Apple), there isn't anything that advertisers can attempt to do that the user can't thwart in some way. Add in a VPN or some other service that obfuscates your IP / location and there's not a lot that they can do.

    4. Re:Reasonable And Good Idea by Wrath0fb0b · · Score: 2

      At the end of the day if the user has full control over their device (which they don't with Apple), there isn't anything that advertisers can attempt to do that the user can't thwart in some way.

      Add in a VPN or some other service that obfuscates your IP / location and there's not a lot that they can do.

      True in theory.

      Devilishly difficult to implement in practice, because what you are proposing is the elimination of all side channel information leakage from the browser to the web host. And all those tiny bits of information that can add up (user-agents, DOM support) to a pretty good identifier. Check out the EFF's Panopticlick site, which details all the tiny information leakages and sums them up.

      Add to that canvas fingerprinting and other skullduggery, and even with full control over a device, it's an uphill battle to thwart all the ways an advertiser can assign you a unique stable identifier.

    5. Re:Reasonable And Good Idea by AmiMoJo · · Score: 2

      Ask all the people who don't install an ad blocker I guess.

      For companies like Apple and Google the issue is that if they do start a war with advertisers, it will get nasty very quickly. Say they decide to remove HTML5 pingback and disable Javascript entirely, the advertisers will just change the links to go via a redirect page that logs the referer. Block the referer and they will encode it in the URL, block that and they will use cookies, block those and by that point everyone will be miserable because most of the web is broken and they can't buy shit from Amazon any more.

      The fundamental problem is that users want content for free, but they don't want to be tracked which is how a lot of that content is funded. Apple and Google are trying to balance those desires by keeping the tracking to a "reasonable" level.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    6. Re:Reasonable And Good Idea by hawk · · Score: 1

      >Better to constantly rotate existing IDs than to randomly generate new ones.

      Long ago, in the days when Junkbuster was enough, it had a "cookie jar" feature.

      I don't know if it was ever completed, but the point was to trade tracking cookies on servers . . . at the time, I simply had a folder with the cookie file name (".cookies"? It's been a while), so they failed anyway.

      hawk

  3. Re:Or take matters into you own hands... by Red_Forman · · Score: 3, Funny

    Advertisers are the problem, so you want to get rid of Apple.

    You're a dumbass.

  4. Seems pointless by Altus · · Score: 4, Informative

    If apple does this people will simply save the ID locally and when the app launches and the ID that the system gives you doesn't match the one you have saved you make a call to record the new ID and bingo you have a running, relatively up to date ID tied to a history of different IDs as the same devic.

    --

    "In America, first you get the sugar, then you get the power, then you get the women..." -H. Simpson

    1. Re:Seems pointless by Altus · · Score: 1

      How so? You are certainly allowed to report your IDFA back to the server or it would serve no purpose at all. You are also allowed to report back the ID you get back that is App/phone specific (that is, unique per app, per phone). That alone is enough to create a long running list of IDs associated with a phone on your server. Any of this could be done with fairly innocuous calls that would never raise any eyebrows at all.

      --

      "In America, first you get the sugar, then you get the power, then you get the women..." -H. Simpson

    2. Re:Seems pointless by garcia · · Score: 2

      I work in the industry building customer-level cross-device marketing attribution models. This is a complete non-factor for most companies, just like ITP changes, it is a mere annoyance more than anything.

      We are able to get 100% match to customers through digital only interactions and >60% match across any number of devices to customers who interact with digital channels but only buy through brick and mortar, without any crazy shit/third parties/etc.

      So, while this is a great soundbite, it's ultimately not doing much but bring more attention to the public about how their data are being used to target them to buy more.

    3. Re:Seems pointless by Altus · · Score: 1

      They do not let you change the ID, it is provided by an API as is the one that is per app/per phone. Nothing in auto rotating this would make it materially harder to track users across multiple apps. Its just more effort.

      --

      "In America, first you get the sugar, then you get the power, then you get the women..." -H. Simpson

    4. Re:Seems pointless by cjmnews · · Score: 1

      You are right, Altus is wrong.

      --
      You can lose something that is loose, so tighten the loose item so you don't lose it.
    5. Re:Seems pointless by Altus · · Score: 1

      Maybe you can read up on what that switch actually means

      https://possiblemobile.com/201...

      --

      "In America, first you get the sugar, then you get the power, then you get the women..." -H. Simpson

  5. Re:Or take matters into you own hands... by Penguinisto · · Score: 5, Insightful

    ... and get rid of your Apple products for life.

    ...and go straight to Android, where they -

    Oh, wait.

    Yeah, nevermind.

    Perhaps going back to an old school flip-phone isn't such a bad idea anymore?

    --
    Quo usque tandem abutere, Nimbus, patientia nostra?
  6. Re:Or take matters into you own hands... by fred6666 · · Score: 1

    At least on Android you can run Firefox. Without any hacks.
    Browsers on iOS are merely skins for Safari.

  7. Or... by Nkwe · · Score: 4, Interesting

    We could just not save advertiser IDs at all.

  8. Re:Or take matters into you own hands... by tepples · · Score: 1

    Without adding some way for publishers and advertisers to identify whether a user has already seen a particular ad, Apple would have bled developers to Android even faster.

  9. Re:Or take matters into you own hands... by FictionPimp · · Score: 2

    I'm happy to, but first can you show me a android phone that I can buy with all the google integrations removed? I consider google a bigger threat than apple to my privacy and I do not want to use any service related to them.

  10. Would you prefer a paywall? by tepples · · Score: 2

    Why would any internet user want to accept tracking by a computer company, ad company?

    Because the viewer finds ads less inconvenient than having to key in a credit card number and pay $5 for a month's subscription to view one document on a website that put up a paywall once privacy-respecting ads became no longer viable. Ads based on each viewer's inferred interests pay three times as much as ads based solely on the document's context.

    1. Re:Would you prefer a paywall? by cayenne8 · · Score: 1

      Because the viewer finds ads less inconvenient than having to key in a credit card number and pay $5 for a month's subscription to view one document on a website that put up a paywall once privacy-respecting ads became no longer viable. Ads based on each viewer's inferred interests pay three times as much as ads based solely on the document's context.

      Well, then make it Opt-In for everyone.

      I'd prefer sites to ask me if they can active these 'features" in order to make ad supported delivery of content.

      I can then decide if the content is worth it to me or not....for me, I'd say 99.999999% of the time it is not worth it and I"ll go on my way to other things to read, etc.

      Tracking should NOT be on by default, it should be opt in only.

      It is the user's data, it should be the users choice if it is to be shared or not.

      --
      Light travels faster than sound. This is why some people appear bright until you hear them speak.........
    2. Re:Would you prefer a paywall? by Immerman · · Score: 1

      >>Why would any internet user want to accept tracking
      >...once privacy-respecting ads became no longer viable...

      If the ads are tracking you, they are NOT respecting your privacy.

      --
      --- Most topics have many sides worth arguing, allow me to take one opposite you.
    3. Re:Would you prefer a paywall? by tepples · · Score: 1

      Exactly. When ads that respect your privacy became no longer economically viable, the industry switched from ads that respect your privacy to ads that track you.

    4. Re:Would you prefer a paywall? by tepples · · Score: 1

      I agree that tracking need not exist. But one of the following must exist: A. payment, B. tracking, or C. lowering production values to those of a hobbyist in his free time.

  11. Hypocrites by the_skywise · · Score: 1

    For a company that forced paid-for extension installations and ads into their browser to sustain themselves they don't really have room to attack others.
    Take the board out of your eye before complaining about the splinter in others.

  12. Apple isn't going to bother by sjbe · · Score: 2

    I think this is a very reasonable thing to do.

    Reasonable to you maybe. Not very reasonable to Apple. See below for why.

    Now that we have the government looking hard at all this data collection

    Which government are you talking about because it sure as hell isn't the US government. Maybe they are in Europe somewhere.

    now is the time for Apple to step up and do something like this to help out the end user.

    A nice sentiment but I strongly doubt Apple will actually do anything useful in this regard. Google derives the vast majority of their revenue from advertising so if Apple really wanted to stick it to Google, hurting their advertising revenue would be the way to do it. Thing is though that Apple and Google are sort of partners and Google pays Apple a reported $9 billion to be the default search engine so it's unlikely Apple cut off that revenue stream except as some sort of nuclear option.

  13. Your theory breaks down by SuperKendall · · Score: 3, Informative

    A nice sentiment but I strongly doubt Apple will actually do anything useful in this regard.

    They already did.

    The iPhone used to offer a unique device ID that never changed, and was the same across all apps.

    But Apple realized that was being misused for tracking, so they changed the system (at a time Google was paying them to include Google as the search engine) so that advertisers could just get an advertising ID, that can in theory change any time.

    In fact the thing that really scratches your theory - any IOS user can reset the advertising ID manually any time they like, via the Reset Advertising Identifier feature under Settings->Privacy->Advertising.

    That was introduced in iOS6...

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:Your theory breaks down by viperidaenz · · Score: 1, Informative

      An ID that can be changed at will isn't much different from a fixed one.
      Any app that has access to the ID and another form of state can track the change. So basically every single app installed on your phone when you make the change, or any app that requires some kind of user log-in.

      Your new IDFA will just be added to the same ad profile as your old one was. It's nothing but a false sense of power given to the user.

    2. Re:Your theory breaks down by gnasher719 · · Score: 1

      The iPhone used to offer a unique device ID that never changed, and was the same across all apps. But Apple realized that was being misused for tracking, ...

      It's stupid for another reason. People sell their iPhones. The UDID stayed the same if you sold your phone, it was literally the device that was tracked. And tracking isn't only used for advertisements, but things like games keeping track of high scores. So if you buy a new phone and sell your old one, someone else suddenly hss all your high scores.

      Whatever you think about tracking, the actual device is not what you want to track.

    3. Re:Your theory breaks down by kiwioddBall · · Score: 1

      Pointless though, advertisers will store the UDID in a cookie and thus will be able to reassociate the new UDID with the old one when the user resets it.

    4. Re:Your theory breaks down by kiwioddBall · · Score: 1

      and when I mistakenly said UDID I mean IDFA.

  14. Re:Or take matters into you own hands... by rahvin112 · · Score: 1

    There are plenty of Android phones you can buy with unlocked roms (Like Google's own pixel phones) that makes it trivial to install a clean ROM with no google integration.

    You could even pay someone to do it for you if you are terrified of flashing a ROM image.

  15. Only an annoyance - other ways to fingerprint devs by JoeyRox · · Score: 1

    Such as the Augur device fingerprinting library.

  16. iPhone owners spend more by tepples · · Score: 2

    The iPhone currently commands 13.2% of global smartphone market share, vs. 86.8% android market share.

    Though the iPhone has a smaller user base, iOS users tend to have more money per user than Android users. Users of iOS spend more not only on paid apps and in-app purchases but also on physical products. (Source: "Survey: iPhone owners spend more, have higher incomes than Android users" by Robert Williams)

    And "global" reach matters little to an advertiser based in the United States who seeks to reach only viewers in the United States.

  17. I don't want an advertiser ID AT ALL by Anonymous Coward · · Score: 1

    Just saying, why not get rid of this antifeature entirely?

    Apple claims to be user-first, right?

    1. Re:I don't want an advertiser ID AT ALL by mr_lemonade4796 · · Score: 1

      Apple has to make money. I believe 'User First' is more like 'Investor First'

      Google is built on Advertising dollars, so to expect Apple to avoid those dollars is just crazy.

      Apple market evaluation has little to do with how much money they make, and has more to do with investor confidence. Apple's core products are selling less, and eventually that will lead to lower incomes from core products. That leads to lower investor confidence.

      Apple is looking to diversify and build services. Part of that will definitely be more tracking and more advertising.

      Apple needs to replace sagging iPhone sales with Services. It is their only way forward.

          -T-

  18. Credit card processor gets the lion's share by tepples · · Score: 1

    surely, you would prefer paying pennies for articles

    A 36 cent charge for an article means 31 cents would go to the credit card processor and a nickel to the publisher. How would you propose to improve the efficiency of micropayments?

    1. Re:Credit card processor gets the lion's share by viperidaenz · · Score: 1

      That's why you pay with bitcoin!
      Then the publisher gets the full 30c

      You get slapped with a $5 fee and have to wait 15 minutes while it clears, but don't worry about the details.

  19. Choice to pay or be tracked by tepples · · Score: 1

    Well, then make it Opt-In for everyone.

    "This article is available to subscribers. For a free day pass, opt in to all tracking providers."

    Tracking would default off. The article would display once the viewer makes a choice to pay or be tracked. Close the tab, click the next search result, and the next website would also offer the viewer a choice to pay or be tracked.

  20. s/incidental nonchalance/flagrante regalia by epine · · Score: 1

    Devilishly difficult to implement in practice, because what you are proposing is the elimination of all side channel information leakage from the browser to the web host.

    I don't think anyone reasonable is not proposing to eliminate all side-channels. 90% of the time, making this observation amounts to scope creep. What sensible people actually propose is to eliminate the fat side channels that are so plump and juicy that anyone who comes along could exploit them with incidental nonchalance.

    What you are aiming to do is minimize the fat channels, and leave only the thin channels, so that anyone who is entirely serious about exploiting this kind of information keeps a well-thumbed copy of Sun Tzu's The Art of Side Channel on his bedside table.

    It's almost impossible to pull of the innocent "who, me?" routine when thick editions of Side Channel Monthly are cascading onto your unkempt desk out of your unkempt in-basket, while you pour over unboxing your spanky new ACME Side Channel 9000 with 1938 festive das Blinkenlights.

    Once the multitudinous side channels become sufficiently thin, the jackbooted thug of maximum entropy analysis is forced to weave all the delicate threads back together again in full flagrante regalia. The threads can not be eliminated. But the weaver can be forced to possess 300 different lock picks, each and every one sourced from the Ruhr valley.

    1. Re:s/incidental nonchalance/flagrante regalia by Wrath0fb0b · · Score: 1

      What sensible people actually propose is to eliminate the fat side channels that are so plump and juicy that anyone who comes along could exploit them with incidental nonchalance.

      Would you believe there are people at Firefox/Chrome/Safari/Edge that are doing this right now? :-)

      What's more, remember that each such side channel is additive. So you don't need to find a particular fat one in order to whittle at privacy.

      The threads can not be eliminated. But the weaver can be forced to possess 300 different lock picks, each and every one sourced from the Ruhr valley.

      Of course, what you mean is that one person has to figure out and publish a paper, then the rest of the plebs just do an npm install.

    2. Re:s/incidental nonchalance/flagrante regalia by epine · · Score: 1

      It now occurs to me to add that anyone in possession of 1001 unscrupulous tools has his own nearly insuperable side-channel management issues, should he not want to advertise his arsenal of assholery far and wide.

      Little Red Riding Hood: Oh Granny, what a dark hoodie you've got!

      Little Red Riding Hood: Oh Granny, what a lot of 2FA dongles are sticking out through the hole in your hoodie pouch!

  21. oops by epine · · Score: 1

    "not" in the opening sentence was somehow left over from my immoderate first attempt. No good deed goes unpunished. My bad.

  22. Re:Or take matters into you own hands... by thegarbz · · Score: 1

    Advertisers are the problem, so you want to get rid of Apple.

    You're a dumbass.

    Actually he's my spirit animal. Coming up with more reasons to get rid of Apple is great pass time. For one all you *definitely paid for shills* who dare to say Apple isn't a problem (how much did the evil mega corp pay you to say that?) is another reason to get rid of Apple.

    There's kids starving in Africa. We should just dissolve Apple and buy each of them a nice t-bone steak.

  23. Re:Seems pointless - actually you can reset it now by cjmnews · · Score: 1

    I reset mine at least 5 times a day. A game I play uses the ID to identify me to ads they play so I get in free game stuff.
    If I don't reset it, the ads don't play, because I already got my free stuff that day.
    If I reset it, I can see another set of ads, which play while I am doing something else, and get more free in game stuff.

    Settings->Privacy->Advertising there is a Reset Advertising Identifier button to do this.

    --
    You can lose something that is loose, so tighten the loose item so you don't lose it.