Apple's 'incredibly private' Safari is not so private in Europe Apple's grudging accommodation of European antitrust rules by allowing third-party app stores on iPhones has left users of its Safari browser exposed to potential web activity tracking. Developers Talal Haj Bakry and Tommy Mysk looked into the way Apple implemented the installation process for third-party software marketplaces …
Between jailbreaking and locked ecosystem and now this, the iNazi has amply demonstrated its thirst for control of everything.
And, as usual, when you're addicted, you don't think straight. Apple is addicted to control, and it has now undermined the security and privacy of its users.
Congratulations for giving me yet another reason to never buy your products.
"And, as usual, when you're addicted, you don't think straight. Apple is addicted to control, and it has now undermined the security and privacy of its users."
And, as usual, when you're addicted, you don't think straight. The EU is addicted to control, and it has now undermined the security and privacy of its users.
Fixed it for you. This would never have happened if the EU hadn't tried to 'fix' something that wasn't broken.
This is a smaller than average storm in a teacup. I don't know what the barrier to getting an alternative App store is, but considering that - unlke Apps - Apple actively don't want them to exist, I would expect the barrier is very, very high. Certificate pinning? Well, OK, but if your DNS has been hacked then you've got bigger issues. As for validation of JWT tokens, please, that's just silly. It's a public webserver, it's already getting thousands of malformed queries a day.
They say you have to click, so even if we imagine the worst case - you're in an environment where the DNS redirects an app-store URL to a malicious IP - you still need users to a) visit a site with this malicious app store link designed to track you, b) interact with it by clicking a button, and c) visit some other malicious site later and do the same so they can correlate. Could a rogue state do much with this? I don't think they could. I also don't understand the claim that Apple are able to track anything with this - there's no network connection to any Apple server in this chain. The only party that could track anything is the one hosting the App store.
Quite Interesting score: 3/10, because it's a new area to research for attacks. Threat score: 1/100.
^ This. The majority of people who bought Apple did so knowing exactly what they could expect; and made their buying decisions accordingly. The all-Apple ecosystem was a key benefit for many; including me.
For the EU to step in and retroactively harm or weaken this experience (assuming that is the case; the article doesn’t make it clear) is hubris of the first order and I hope it backfires on them.
I would like to amend my original post.
After watching the presentation, noting the network traffic it displayed and recklessly concluding the research was almost completely impractical as a method of tracking individuals, I realise this analysis forgot to add any pointed observations about the evils of large tech firms in general and Apple in particular. My knee made no jerking movements during this process, and I also neglected to use the phrase "holding it wrong". I now realise this was unacceptable and I promise to do better on any future comments.
To save typing, I refer you to a related yet relevant comment...
You're welcome.
Shangle... Reiki Shangle...
In the interests of balance, here's the opposing point of view: https://www.spacebar.news/p/stop-using-brave-browser
Note: I don't have any skin in this game. I simply have no interest in trying out any minority browser with a user base smaller than Firefox's 3%.
When your whole approach has been based on Apple approved apps via Apple store only then adding support for alternative marketplaces was always going to have a high chance of introducing bugs / security issues (especially when it was done in a bit of a rush).
I would have been far more surprised if there were no issues.
'Apple – which advertises Safari as "incredibly private" ' is, when one thinks of it, quite accurate: "incredible" says it all. We see this sort of misuse of words all the time; "incredible," commonly thought of as a good thing, really means "not credible;" "terrific" means "inducing terror" and so on. It's fascinating to see how such terms have been twisted so that their meaning has become positive instead of negative.
Hmmm... couldn't make the EDIT button work.
I first noticed this phenomenon when I was exposed to IBM's virtual storage and virtual machine technology in college. "Virtual" has pretty much fallen by the wayside in advertising now, but before then there were lots of advertisements that used the word, whose meaning was quite fuzzy to people, e.g. dishwashing soap commercials that said their product made glassware "virtually spotless." :-)
The EU set the requirements. “Allow third party App Stores”. So what would they have said if Apple replied “that’s difficult to do, meeting the requirements we are told to meet, and observing privacy at the same time”.
The App Store goes completely through Apple. So Apple can provide privacy very easily by not giving all the information it has to anyone. But it seems they have to make iPhones reply to alternative stores that Apple doesn’t know, and therefore to anyone claiming to be an alternative App Store.
I've read it twice but it's still not clear to me. Am I still at risk if I don't actively browse to or engage with 3rd party marketplaces? 3 scenarios that I can envisage:
1. Browses and downloads from 3rd Party marketplaces AT RISK
2. Navigates to a 3rd Party marketplace site, but doesn't download or install ???
3. Browses an unrelated website that contains a link to a 3rd party marketplace e.g. an ad, but doesn't click on it ???
Could I be tracked in scenarios 2 or 3?
The issue is that a site that claims to point to a third-party app store will send a unique user ID to that store, enabling you to be tracked around the web.
Realistically, this is only a big problem if somebody big (Meta/Amazon/Alphabet/Microsoft or one of the big data brokers) figures out a way to add this code to the site through a tag (most people who particularly care about privacy online will have this blocked by default anyway) as changing source code directly on site is a much higher barrier to implementation than adding to a container tag.
This will probably be fixed sometime relatively soon - as much as I don't like Apple, I think they're generally pretty good at sorting this kind of thing so it's unlikely that any of the big players will put a lot of resources into making this a cross-site tracking vector. That being said, this might a fundamental issue of how Apple are forced to act under EU law so will be forced to remain a vector long-term at which point it will be worth it for the big tracking providers to set up tracking here.
To answer your questions, specifically about cross-site tracking:
1. Potentially at risk if the 3rd party app store wants to monetize this cross-site tracking avenue.
2. Potentially at risk if the 3rd party app store wants to monetize this cross-site tracking avenue.
3. Potentially at risk if the 3rd party app store wants to monetize this cross-site tracking avenue.
4. (Navigates to any website that points to a 3rd party app store that wants to monetize this cross-site tracking avenue) -> At risk
Fundamentally, if Google add a call to a "third party marketplace" that they own in their Google Analytics tag, then they will have functionally full cross-site tracking on anybody not blocking Google Tags.
I've read it twice but it's still not clear to me. Am I still at risk if I don't actively browse to or engage with 3rd party marketplaces? 3 scenarios that I can envisage:
The good news is that if your in the UK then there is no alternative apple store
https://support.apple.com/en-gb/118110#countries-and-regions
If you go to a real 3rd party marketplace, you are safe. Or as safe as that stores security, and their willingness to preserve your privacy. Anyway, nothing that Apple can do.
The risk (no matter how big or small) comes from fake marketplaces. Just like receiving a phone call has zero risk, except that scammers can call you.
Apple's browser was never secure, nor is iOS.
Take note of how easily the US military, intelligence services and police retreive data from it, they only cry about it when they want laws made to make everything as easy for them to walk in and get the data from.
If it is from the US it is compromised. Flat out.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
