News for hackers. Stuff that matters.
Re:Spotify CEO renews attack on Apple after Musk's salvo by satvikpendem on Wednesday November 30, 2022 @08:19PM (#33810914)
> Your data is (mostly) safe from advertisers because that's not their business.

I beg to differ.

Apple is becoming an ad company despite privacy claims

https://proton.me/blog/apple-ad-company

https://news.ycombinator.com/item?id=33736259

Re:Spotify CEO renews attack on Apple after Musk's salvo by marricks on Wednesday November 30, 2022 @08:32PM (#33811043)
Both your links go to the same Proton article and the heart of it seems to be this:

> Apple monitors your every move in the App Store and its News and Stocks apps and then uses that data to sell ads targeting you in those same apps. To meet its growth forecasts, experts expect Apple to start selling ads in its Maps, Podcast, and Books apps, meaning it could replicate this model across more of its services. Much more of your activity could be monitored in the future.

Tracking every click in the App Store/News/Stocks is not great but it is in NO WAY similar to tracking every website I view and reading every email I send.

Re:Spotify CEO renews attack on Apple after Musk's salvo by satvikpendem on Wednesday November 30, 2022 @08:35PM (#33811070)
Why do you assume Apple doesn't also track every website and email you read (especially if you use the default Apple-made apps)? After all, they make the OS, they can track whatever they want.
Re:Spotify CEO renews attack on Apple after Musk's salvo by majormajor on Wednesday November 30, 2022 @08:42PM (#33811136)
Nobody's reported seeing that sort of network traffic sent off of iOS devices. It's trivially easy to spot it, and it's well documented, going to Google and others across the web, though.
Re:Spotify CEO renews attack on Apple after Musk's salvo by mortehu on Wednesday November 30, 2022 @09:16PM (#33811425)
On my iPhone, Safari browser history synchronization to iCloud was enabled by default.
Re:Spotify CEO renews attack on Apple after Musk's salvo by musicale on Wednesday November 30, 2022 @10:32PM (#33812003)
According to Apple, Safari history and bookmarks are end-to-end encrypted and Apple cannot read them:

https://support.apple.com/en-us/HT202303

Is there any evidence that Apple is lying, and is actually decrypting them and using them for advertising purposes, rather than for the "coherence" feature?

I don't actually want browsing sessions to be unified across devices, so I do wish that it was turned off by default. (Though being able to close tabs remotely is a sort of interesting capability.) However, it doesn't seem to be actual spyware used for advertising or tracking purposes.

Re:Spotify CEO renews attack on Apple after Musk's salvo by pyuser583 on Thursday December 01, 2022 @12:11AM (#33812596)
That’s not what your link says. The link says browsing history is end-to-end encrypted, but Bookmarks are not.
Re:Spotify CEO renews attack on Apple after Musk's salvo by acomjean on Wednesday November 30, 2022 @11:55PM (#33812504)
Safari on iOS is auto-completing stuff as you type. The option to search with google comes up if you get far enough.

And it’s not going to google first. If you type an address the “link” at the top is to Apple Maps. They seem to do a similar thing with place names. I’m not sure but one can be fairly certain they’re using the phones location to help….

Re:Spotify CEO renews attack on Apple after Musk's salvo by heavyset_go on Thursday December 01, 2022 @04:09AM (#33814019)
You will have no idea what is being carried via encrypted channels to Apple's opaque backend servers.
Re:Spotify CEO renews attack on Apple after Musk's salvo by manigandham on Thursday December 01, 2022 @06:16AM (#33814878)
> " It's trivially easy to spot"

Is it? How exactly are encrypted payloads to a secure, opaque and generic endpoint easy to distinguish?

Re:Spotify CEO renews attack on Apple after Musk's salvo by majormajor on Thursday December 01, 2022 @12:54PM (#33819878)
It's trivially easy to spot it going to Google/FB/whoever if you visit a page with a GA or FB or whatever pixel. That's part of the second sentence, not the first.

For spotting it going to Apple you'd have to do more fancy correlation over time and such, but you can find people out there who are researching this stuff... so that's who I'm waiting for to hear more from.

Re:Spotify CEO renews attack on Apple after Musk's salvo by chrononaut on Wednesday November 30, 2022 @11:05PM (#33812189)
Burden of proof fallacy
Re:Spotify CEO renews attack on Apple after Musk's salvo by piyush_soni on Thursday December 01, 2022 @04:50AM (#33814272)
People keep saying Google reads your emails (even when Google explicitly says otherwise), but have no proof, and trust Apple's words as the gospel of truth - how strange. It's almost as if it's fashionable to criticize them.

This's on Gmail's homepage:

"We never use your Gmail content for any ads purposes. Gmail uses industry-leading encryption for all messages you receive and send. We never use your Gmail content to personalize ads."

Re:Spotify CEO renews attack on Apple after Musk's salvo by roody15 on Thursday December 01, 2022 @09:23AM (#33816565)
Interesting.. I just saw an add in my Apple Maps yesterday and I was really confused at first. Had no idea they are considering moving in this direction and must already be testing it.

On a different note I attended an apple event for IT Government and Education in Chicago. Eye opening.. Apple's "privacy" stance is all just a horse and pony show for marketing. Unbelievable how open they were about tracking everything at the event.

Re:Spotify CEO renews attack on Apple after Musk's salvo by davidlumley on Wednesday November 30, 2022 @09:11PM (#33811372)
My understanding around how this works (and I might be wrong!) is that Apple tracks a variety of usage on device and your device itself knows which ad to serve, versus say Google or Facebook collating your data on their own servers.

I'd not be surprised to learn there was some level of phoning home though.

Re:Spotify CEO renews attack on Apple after Musk's salvo by fshbbdssbbgdd on Wednesday November 30, 2022 @10:08PM (#33811826)
There’s a common misconception that ad tracking is all about targeting ads. That’s part of it, but the truth is that tracking conversions is a more important differentiator for advertising platforms. A conversion is where the user clicks on the ad and then makes a purchase. The top digital ad companies (Apple, Google, Meta, Amazon) all charge for conversions. There is no way to charge for conversions without sending data about the user’s behavior off the device (which ads they saw, and which purchases they made).
Re:Spotify CEO renews attack on Apple after Musk's salvo by 7e on Wednesday November 30, 2022 @10:48PM (#33812093)
That’s not true. They could use differentially private on-device joins using anonymously downloaded ad data. Or they could securely aggregate the results. Or both.
Re:Spotify CEO renews attack on Apple after Musk's salvo by fshbbdssbbgdd on Thursday December 01, 2022 @12:00AM (#33812535)
Can you elaborate? I see an ad in the News app, then click on it and make a purchase from Clash of Clans in the App Store. Apple needs to charge Clash of Clans for the conversion. How do they do it?

Apple knows that I bought the app (they charged me for it).

In order to charge Clash of Clans for the conversion, my phone needs to connect to Apple and send them a record of the ad click. What if clicking on that ad and buying the app are the only thing I ever did on the phone? There’s nothing to aggregate locally, and Apple knows they got the conversion data from me.

Perhaps the claim is that my phone is going to send all these records to Apple, and Apple is just going to do the right thing and run programs that do the business without letting any of their people look at anything they aren’t supposed to look at (they could internally accomplish this by differential privacy, rigorous internal controls, etc). That’s the same claim Google and everyone else is going to make.

Re:Spotify CEO renews attack on Apple after Musk's salvo by 7e on Saturday December 03, 2022 @02:24AM (#33841480)
Re:Spotify CEO renews attack on Apple after Musk's salvo by manigandham on Thursday December 01, 2022 @06:17AM (#33814893)
That's not at all how adtech works. You cannot download all activity between ad supply (website/app/etc) and advertisers and every vendor in the middle onto your device for some joins.
Re:Spotify CEO renews attack on Apple after Musk's salvo by 7e on Saturday December 03, 2022 @02:29AM (#33841513)
You misunderstand, completely. A device needn't download all activity, or indeed download anything additional at all. It knows which ads it clicked on and it knows the conversion signal for each ad the user saw. It can thus easily count the user's conversions on the device, then privately aggregate the result with its peers using secure multi-party computation (or a secure enclave).

Even the ads can be anonymously downloaded using a shuffler/mixer, such that nobody knows which ads out of the universe of ads the device chose to target the user with.

Re:Spotify CEO renews attack on Apple after Musk's salvo by bb88 on Wednesday November 30, 2022 @09:51PM (#33811731)
I have no idea if this is true, but let's say it is.

The ad still has to come from a server, unless the phone downloads all possible ads the person might be interested in (which I doubt).

The transfer would at a minimum include the IP address of the phone.

Re:Spotify CEO renews attack on Apple after Musk's salvo by 7e on Wednesday November 30, 2022 @10:50PM (#33812101)
Use a shuffler.
Re:Spotify CEO renews attack on Apple after Musk's salvo by heavyset_go on Thursday December 01, 2022 @04:13AM (#33814042)
This is just has all of the negative privacy implications FLoC does[1], which is also something pushed by Google that was heavily criticized. I guess now that Apple is doing it, it's okay.

[1] https://en.wikipedia.org/wiki/Federated_Learning_of_Cohorts

Re:Spotify CEO renews attack on Apple after Musk's salvo by davidlumley on Thursday December 01, 2022 @04:47PM (#33823337)
Similar! The biggest difference in my mind is that any website using FLoC would be able to know what cohort I belonged to.

FLoC is definitely more anonymous than "davidlumley visited nytimes.com twice on December 1st 2022". However, that particular usage information was previously only available to nytimes.com, any ad/data vendor using third party tracking cookies that were present on nytimes.com at the time of my visit, and finally any company that purchased data from the ad/data vendor.

My FLoC was theoretically available to any website and had much of the same intent data that intent ad/data vendors were/are selling.

If my understanding of Apple's ad platform is correct, advertisers don't know which cohort the user davidlumley belongs to, or that their ads are being served to me because that's all handled on device.

Re:Spotify CEO renews attack on Apple after Musk's salvo by tremon on Thursday December 01, 2022 @04:58AM (#33814327)
is that Apple tracks a variety of usage on device and your device itself knows which ad to serve

This is a distinction without a difference. Do you regularly share your phone with other people, to the extent that "device data" can not be correlated back to you?