They restrict access to most of the things listed above, giving randomised fakes where necessary. The advertising ID they do let apps access is unique to a publisher so they can't be tied together with behaviour from apps by other publishers, and it's trivially disabled/resettable by the end user (Settings > Privacy > Advertising > Limit Ad Tracking / Reset Advertising Identifier…). They improve things every year, e.g. Safari's intelligent tracking prevention.
I'm not really sure how you can arrive at the conclusion that Apple are holding back; they seem clearly committed to improving privacy as demonstrated by their continuous work in the area.
They still let apps give you a unique identifier through shared containers, those will only be deleted if you delete all apps that can access it. There is also some other container (I forgot the name) which will never be deleted unless you get a new device and don't restore any backups. You can see this kind of behaviour when you delete Instagram and they automatically fill out your username the next time you install it.
With Facebook owning WhatsApp, they are already able to give each iOS device a unique identifier. What is Apple going to do about it? Remove WhatsApp from the App Store?
I believe the other container you're talking about is the keychain. You can store small amounts of data in there (typically secure auth info) and it will persist even after app deletion. This is hardware encrypted by the Secure Enclave and can't be shared between publishers.
Apple have shown that they are willing to remove big social media apps from the App Store just a few weeks ago, with Tumblr.
Also, collecting information for use in WhatsApp and using it for a different purpose in Facebook is a DPA and GDPR violation:
https://www.theguardian.com/technology/2018/mar/14/whatsapp-...
There's the identifierForVendor [0] which is unique to the publisher. This is pretty safe to use however you see fit (within reason).
Then there's the advertisingIdentifier [1], which is not unique, but can easily be permanently zeroed out by the user. Apple also have some fairly stringent rules about how it can be used [2], not to mention further rules about not identifying people surreptitiously [3]:
> 5.1.2 Data Use and Sharing
> (iii) Apps should not attempt to surreptitiously build a user profile based on collected data and may not attempt, facilitate, or encourage others to identify anonymous users or reconstruct user profiles based on data collected from Apple-provided APIs or any data that you say has been collected in an “anonymized,” “aggregated,” or otherwise non-identifiable way.
They ask you to explicitly confirm that you're following the advertising identifier rules in particular every single time you submit to the App Store.
[0] https://developer.apple.com/documentation/uikit/uidevice/162...
[1] https://developer.apple.com/documentation/adsupport/asidenti...
[2] https://support.appsflyer.com/hc/en-us/articles/207032086-Ap...
[3] https://developer.apple.com/app-store/review/guidelines/#dat...
Given the Apple phone was successfully hacked in the FBI case, I'm not sure why HN seems to think they are the bastion of privacy.
Given the other anti-consumer and anti-developer practices at Apple, I wouldn't trust them to protect privacy(today, and in the future when their stock price takes a hit).
https://www.apple.com/business/site/docs/iOS_Security_Guide....
I'm not saying that Apple products are 100% impenetrable against nation states; I'm pointing out that Apple are clearly putting serious effort into protecting user privacy.
I'm not sure why this is such a foreign concept to so many people. This is something Apple can do that their competitors cannot due to their business models. It's becoming more and more of a concern to customers and the law in many places. Even if you assume Apple are 100% self-serving, this is obviously a valuable differentiator for them to capitalise on.
It's contradictory in fact, because data monetizing companies prefer to control data not leak it, to keep the data's price high.
Well put. I’ve tried to explain to people that I prefer Apple’s upfrontness that they are there to sell me a device and it’s software for money. Unlike Android systems where I feel the lead is intentionally buried by telling me how “free” the software is.
(More speculatively, the community is now working on replacing AOSP altogether with the usual Linux desktop stack, via PostmarketOS. Not usable right now, but it's progressing rather quickly, and may well be practically useful later in 2019.)
So you're telling me that 2019 is the year of the Linux desktop... on mobile?
Do you go audit every line of source code in the apps and OS you install? Do you then verify that the binary blobs you're installing were built from the same source? Do you somehow audit the source for the firmware on your device and verify that that is the firmware installed on your device? What about the hardware, do you audit it?
Even worse, this 11 year old bug in the Linux kernel?
https://www.theregister.co.uk/2017/02/23/linux_kernel_gets_p...
Which issues specifically?
When the revenue stream of the creator of Android fundamentally depends on being able to tie devices to identity and behaviour, it's highly unlikely this is going to happen. They can't also keep it only for themselves and block for others or they'll get unfair trade practices action on their backs.
Thr fact that Apple which could do this without significant adverse monetary impact but has chosen not to do so suggests they want to keep the possibility of re-entering the advertising business (or at least portray so to their shareholders)