It could have been simply some data put in the keychain. That persists through app deletion.

It used to. They have largely changed that now - all data is deleted once the last app from a given vendor has been deleted (though it's not instant, and seems to apply weirdly on TestFlight + ad-hoc builds)

On the app I'm writing, keychain info remains.

I have a specific debug setting to wipe the keychain.

Sign in with Apple also generates a persistent ID with each app. That could be used to fingerprint the user, but not the device.

I think this behavior hasn’t changed: https://developer.apple.com/forums/thread/36442

Everything in this space is so muddled. Deleting the last app from a vendor should erase that data. On the other hand, if you restore your phone from another device, that should never require relogging into anything.

I used to go out of my way to take encrypted iTunes backups because it restored app state perfectly.

After some iOS release though, every app started doing "new phone, who dis" regardless of the restoration strategy, so I stopped wasting my time.

Yeah, last I checked, encrypted itunes backups would keep the "this device only" keychain data. Which would only work when restored to the same device - it needs the UID key from the secure enclave to decode. (I wrote code a few years ago to decrypt the rest of the keychain.)

At one point, google authenticator started marking its entries as "this device only". I don't know if they've backed off on that since then.

No, I tried to completely delete Tiktok. It's impossible.

I delete Facebook a few times and every time I installed the app the first screen I got prompted with was "Hello Josh, would you like to sign in with your stored details?" Not all data is scrubbed. This persisted to even today running on iOS 17 Public Beta.

Did you also delete Messenger, Instagram, Whatsapp and Threads?

Yes.

I have experienced the same thing. Even when Apple made changes in Keychain policy to try to combat fingerprinting, “I never got the memo.” That sounds nuts, but I’m in the same boat.

I’ve had a few apps I’ve redownloaded months later, the only one from the developer, and my auth state was preserved.

I keep hearing that the Keychain data should be deleted, but my iCloud Keychain is filled with long-dead data

It's most probably keychain.

Probably keychain, but maybe just iCloud?

This does not align with my experience. I see Uber automatically log me in on a fresh install after I've uninstalled the app for months.

Since you kept the same phone, that was probably DeviceCheck, which gives you 2 bits to store “fraud” related info.

https://developer.apple.com/documentation/devicecheck/access...

Why does Apple let your device work against your own interests? If an app developer wants your phone to detect you committing "fraud", that should be their problem.

I mean the same reason Apple uses your phone to scan for nearby AirTags.

This isn't a feature that is actually costing them sales but a lack of DRM/etc affects what apps will be in their store.

It certainly costs them some sales, but not enough for them to care about.

Why would Apple ever prioritize their customer's interests over their own? They've never once suggested that they would, and their customers prefer a hierarchical relationship. Apple is a company that whitelists which functions of a general purpose computer that their customers will be allowed to use.

That makes some people feel really secure, like the company is a loving parent, although companies don't love. They decide what is profitable and what is not.

That's a weird hill to die on.

Service providers need to ban people sometimes. This includes people who are savvy enough to know how to delete and reinstall an app to clear its settings. Never permanently banning anyone simply isn't a thing that's happening.

If Apple didn't provide DeviceCheck, or something similar to it, service providers would use some other means of deterring abuse. There's a couple directions they can go in, but they're all generally worse for users (e.g. using invasive tracking, requiring users to pay for service, etc). DeviceCheck is about the least invasive way I can imagine this being implemented.

Why do mail providers work against your interests by blocking outgoing spam? Because in aggregate it's beneficial to users if external parties can trust the more.

That's different because you block spammers' messages on your servers, without the cooperation of the spammers' computers.

Is that basically serving the same purpose as Android's SafetyNet attestation?

It’s a little different since it’s meant to basically be a persistent identity. App attest is the more comparable technology for SafetyNet.

> probably DeviceCheck, which gives you 2 bits to store “fraud” related flags

Does resetting your iPhone (Erase All Content and Settings) clear out data like that?

Does doing a restore from backup put that data back on your iPhone?

The linked article says the 2 bits are stored on Apple’s servers.

I.e. they could persist even if the device were bit-for-bit reset to factory state.

Keychain and DeviceCheck are likely how.

Apple needs to get their shit together with these two APIs.

There’s other ways. Like iCloud - you can store something on a private container and it will persist in the users Apple ID