Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Mozilla Firefox Privacy Apple IT Technology

Mozilla Wants Apple To Change Users' iPhone Advertiser ID Every Month (zdnet.com) 101

Posted by msmash from the how-about-that dept.
Mozilla has launched a petition today to get Apple to rotate the IDFA unique identifier of iOS users every month. From a report: The purpose of this request is to prevent online advertisers from creating profiles that contain too much information about iOS users. IDFA stands for "IDentifier For Advertisers" and is a per-device unique ID. Apps running on a device can request access to this ID and relay the number to advertising SDKs/partners they use to show ads to their users. As experts from Singular, a mobile marketing firm explain, "IDFAs take the place of cookies in mobile advertising delivered to iOS devices because cookies are problematic in the mobile world." IDFAs are different from UDIDs, which stand for "unique device identifiers," which are permanent and unchangeable device identifiers. Apple added support for IDFAs specifically to replace UDIDs, which many apps were collecting for all sorts of shady reasons, enabling pervasive tracking of iOS users.
This discussion has been archived. No new comments can be posted.

Mozilla Wants Apple To Change Users' iPhone Advertiser ID Every Month More

Mozilla Wants Apple To Change Users' iPhone Advertiser ID Every Month

Comments Filter:

  • Now go after Microsoft (Score:1)

    by Anonymous Coward

    They do the same thing.

  • Reasonable And Good Idea (Score:4, Insightful)

    by omfglearntoplay ( 1163771 ) on Tuesday April 16, 2019 @09:12AM (#58444164)

    I think this is a very reasonable thing to do. Now that we have the government looking hard at all this data collection, now is the time for Apple to step up and do something like this to help out the end user.

    • Re: (Score:2)

      by AmiMoJo ( 196126 )

      Maybe it would be better to connect the function call to a random number generator.

      Then again that might encourage advertisers to look for other ways of fingerprinting the device.

      That's the reason that Apple argued in favour of making the HTML5 pingback function mandatory and impossible to disable. Yes Google got the flak for it but Apple made the same argument [webkit.org]. If it's removed then advertisers will just find some other way to do it, making things worse.

      • Re: (Score:1)

        by AHuxley ( 892839 )
        Why would any internet user want to accept tracking by a computer company, ad company?

        • Why would any internet user want to accept tracking by a computer company, ad company?

          Because the viewer finds ads less inconvenient than having to key in a credit card number and pay $5 for a month's subscription to view one document on a website that put up a paywall once privacy-respecting ads became no longer viable. Ads based on each viewer's inferred interests pay three times as much as ads based solely on the document's context.

          • Because the viewer finds ads less inconvenient than having to key in a credit card number and pay $5 for a month's subscription to view one document on a website that put up a paywall once privacy-respecting ads became no longer viable. Ads based on each viewer's inferred interests pay three times as much as ads based solely on the document's context.

            Well, then make it Opt-In for everyone.

            I'd prefer sites to ask me if they can active these 'features" in order to make ad supported delivery of content.

            I ca

            • Well, then make it Opt-In for everyone.

              "This article is available to subscribers. For a free day pass, opt in to all tracking providers."

              Tracking would default off. The article would display once the viewer makes a choice to pay or be tracked. Close the tab, click the next search result, and the next website would also offer the viewer a choice to pay or be tracked.

          • >>Why would any internet user want to accept tracking
            >...once privacy-respecting ads became no longer viable...

            If the ads are tracking you, they are NOT respecting your privacy.

            • Re: (Score:2)

              by tepples ( 727027 )

              Exactly. When ads that respect your privacy became no longer economically viable, the industry switched from ads that respect your privacy to ads that track you.

        • Re: (Score:3)

          by AmiMoJo ( 196126 )

          Ask all the people who don't install an ad blocker I guess.

          For companies like Apple and Google the issue is that if they do start a war with advertisers, it will get nasty very quickly. Say they decide to remove HTML5 pingback and disable Javascript entirely, the advertisers will just change the links to go via a redirect page that logs the referer. Block the referer and they will encode it in the URL, block that and they will use cookies, block those and by that point everyone will be miserable because mos

      • Better to constantly rotate existing IDs than to randomly generate new ones. If you reuse existing ones and change them randomly, it pollutes data sets in ways that are harder for the companies that maintain them to detect. People are creatures of habit, so it likely wouldn't take very long to tie a pattern of behavior to an existing profile with a high degree of certainty.

        At the end of the day if the user has full control over their device (which they don't with Apple), there isn't anything that adverti

        • At the end of the day if the user has full control over their device (which they don't with Apple), there isn't anything that advertisers can attempt to do that the user can't thwart in some way.

          Add in a VPN or some other service that obfuscates your IP / location and there's not a lot that they can do.

          True in theory.

          Devilishly difficult to implement in practice, because what you are proposing is the elimination of all side channel information leakage from the browser to the web host. And all those tiny bit

          • Devilishly difficult to implement in practice, because what you are proposing is the elimination of all side channel information leakage from the browser to the web host.

            I don't think anyone reasonable is not proposing to eliminate all side-channels. 90% of the time, making this observation amounts to scope creep. What sensible people actually propose is to eliminate the fat side channels that are so plump and juicy that anyone who comes along could exploit them with incidental nonchalance.

            What you are aimi

            • oops (Score:2)

              by epine ( 68316 )

              "not" in the opening sentence was somehow left over from my immoderate first attempt. No good deed goes unpunished. My bad.

            • What sensible people actually propose is to eliminate the fat side channels that are so plump and juicy that anyone who comes along could exploit them with incidental nonchalance.

              Would you believe there are people at Firefox/Chrome/Safari/Edge that are doing this right now? :-)

              What's more, remember that each such side channel is additive. So you don't need to find a particular fat one in order to whittle at privacy.

              The threads can not be eliminated. But the weaver can be forced to possess 300 different lo

            • Re: (Score:2)

              by epine ( 68316 )

              It now occurs to me to add that anyone in possession of 1001 unscrupulous tools has his own nearly insuperable side-channel management issues, should he not want to advertise his arsenal of assholery far and wide.

              Little Red Riding Hood: Oh Granny, what a dark hoodie you've got!

              Little Red Riding Hood: Oh Granny, what a lot of 2FA dongles are sticking out through the hole in your hoodie pouch!

        • Re: (Score:2)

          by hawk ( 1151 )

          >Better to constantly rotate existing IDs than to randomly generate new ones.

          Long ago, in the days when Junkbuster was enough, it had a "cookie jar" feature.

          I don't know if it was ever completed, but the point was to trade tracking cookies on servers . . . at the time, I simply had a folder with the cookie file name (".cookies"? It's been a while), so they failed anyway.

          hawk

    • I think this is a very reasonable thing to do.

      Reasonable to you maybe. Not very reasonable to Apple. See below for why.

      Now that we have the government looking hard at all this data collection

      Which government are you talking about because it sure as hell isn't the US government. Maybe they are in Europe somewhere.

      now is the time for Apple to step up and do something like this to help out the end user.

      A nice sentiment but I strongly doubt Apple will actually do anything useful in this regard. Google derives the vast majority of their revenue from advertising so if Apple really wanted to stick it to Google, hurting their advertising revenue would be the way to do it. Thing is though that Apple and Google are

      • Your theory breaks down (Score:4, Informative)

        by SuperKendall ( 25149 ) on Tuesday April 16, 2019 @11:01AM (#58444736)

        A nice sentiment but I strongly doubt Apple will actually do anything useful in this regard.

        They already did.

        The iPhone used to offer a unique device ID that never changed, and was the same across all apps.

        But Apple realized that was being misused for tracking, so they changed the system (at a time Google was paying them to include Google as the search engine) so that advertisers could just get an advertising ID, that can in theory change any time.

        In fact the thing that really scratches your theory - any IOS user can reset the advertising ID manually any time they like, via the Reset Advertising Identifier feature under Settings->Privacy->Advertising.

        That was introduced in iOS6...

        • Re: (Score:2, Informative)

          by viperidaenz ( 2515578 )

          An ID that can be changed at will isn't much different from a fixed one.
          Any app that has access to the ID and another form of state can track the change. So basically every single app installed on your phone when you make the change, or any app that requires some kind of user log-in.

          Your new IDFA will just be added to the same ad profile as your old one was. It's nothing but a false sense of power given to the user.

        • The iPhone used to offer a unique device ID that never changed, and was the same across all apps. But Apple realized that was being misused for tracking, ...

          It's stupid for another reason. People sell their iPhones. The UDID stayed the same if you sold your phone, it was literally the device that was tracked. And tracking isn't only used for advertisements, but things like games keeping track of high scores. So if you buy a new phone and sell your old one, someone else suddenly hss all your high scores.

          Whatever you think about tracking, the actual device is not what you want to track.

        • Pointless though, advertisers will store the UDID in a cookie and thus will be able to reassociate the new UDID with the old one when the user resets it.

  • Seems pointless (Score:5, Informative)

    by Altus ( 1034 ) on Tuesday April 16, 2019 @09:22AM (#58444220) Homepage

    If apple does this people will simply save the ID locally and when the app launches and the ID that the system gives you doesn't match the one you have saved you make a call to record the new ID and bingo you have a running, relatively up to date ID tied to a history of different IDs as the same devic.

    • Re: (Score:3)

      by garcia ( 6573 )

      I work in the industry building customer-level cross-device marketing attribution models. This is a complete non-factor for most companies, just like ITP changes, it is a mere annoyance more than anything.

      We are able to get 100% match to customers through digital only interactions and >60% match across any number of devices to customers who interact with digital channels but only buy through brick and mortar, without any crazy shit/third parties/etc.

      So, while this is a great soundbite, it's ultimately no

  • Or... (Score:5, Interesting)

    by Nkwe ( 604125 ) on Tuesday April 16, 2019 @09:42AM (#58444286)
    We could just not save advertiser IDs at all.
  • For a company that forced paid-for extension installations and ads into their browser to sustain themselves they don't really have room to attack others.
    Take the board out of your eye before complaining about the splinter in others.

  • I don't want an advertiser ID AT ALL (Score:1)

    by Anonymous Coward

    Just saying, why not get rid of this antifeature entirely?

    Apple claims to be user-first, right?

    • Re: (Score:1)

      by Tom ( 5839674 )

      Apple has to make money. I believe 'User First' is more like 'Investor First'

      Google is built on Advertising dollars, so to expect Apple to avoid those dollars is just crazy.

      Apple market evaluation has little to do with how much money they make, and has more to do with investor confidence. Apple's core products are selling less, and eventually that will lead to lower incomes from core products. That leads to lower investor confidence.

      Apple is looking to diversify and build services. Part of that will definit

Slashdot Top Deals

Top Ten Things Overheard At The ANSI C Draft Committee Meetings: (10) Sorry, but that's too useful.

Close