Apple's 'incredibly private' Safari is not so private in Europe

Re:Apple's 'incredibly private' Safari is not so private in ... by pulisse on Wednesday May 01, 2024 @03:01PM (#40227756)

I'm not seeing what the "catastrophic" issue is. A site can include a link to install an app from a third-party marketplace and, when the user affirmatively acts to proceed with the install, that marketplace can see which site the install request came from.

That's it?

[ Parent | on HN ]

Re:Apple's 'incredibly private' Safari is not so private in ... by masfuerte on Wednesday May 01, 2024 @03:50PM (#40228464)

Where do you get "affirmatively acts to proceed with the install"? The original advisory suggests that any website can fire off these marketplace requests in response to any user action.

[ Parent | on HN ]

Re:Apple's 'incredibly private' Safari is not so private in ... by pulisse on Wednesday May 01, 2024 @04:16PM (#40228789)

Not "any user action". The user has to click the link. The fact that a link can be styled to look like anything isn't very damning.

[ Parent | on HN ]

Re:Apple's 'incredibly private' Safari is not so private in ... by masfuerte on Wednesday May 01, 2024 @04:41PM (#40229116)

According to the advisory the user can click on a button and the event handler issues the request. There isn't a link. The user has no indication of what's going to happen beyond whatever the page chooses to tell them.

[ Parent | on HN ]

Re:Apple's 'incredibly private' Safari is not so private in ... by hehdhdjehehegwv on Wednesday May 01, 2024 @03:13PM (#40227919)

It looks like they basically created an immutable identifier that gets exposed. Sort of like a persistent third party cookie, but with fewer access controls as it isn’t domain bound.

That’s just my read of the article, I haven’t reviewed the code myself.

However, I will say that the way SV companies tend to operate is they refuse to do any compliance work until forced by circumstance, then they have to do a rush job and a bunch of stuff gets fucked up that would have been fine if they planned ahead based on statutory requirement.

So from a human/corporate behavior perspective this is exactly what I’d expect.

Likewise, Apple in particular has a holier than thou attitude, especially in regards to privacy, so I think there’s a bit of them being blinded by their own arrogance in this case.

[ Parent | on HN ]

Re:Apple's 'incredibly private' Safari is not so private in ... by eastbound on Wednesday May 01, 2024 @03:53PM (#40228508)

Sweet, UE can now legitimately take 4% of Apple’s global income for uniquely identifying all users on Earth, having undeletable cookies and not having the cookie banter and thus, breaking GDPR.

[ Parent | on HN ]

Re:Apple's 'incredibly private' Safari is not so private in ... by ykonstant on Wednesday May 01, 2024 @04:12PM (#40228739)

>the cookie banter

brilliant

[ Parent | on HN ]

Re:Apple's 'incredibly private' Safari is not so private in ... by hehdhdjehehegwv on Wednesday May 01, 2024 @04:38PM (#40229067)

Having worked in this sector for a very long time I just don’t think GDPR is an effective regulatory tool. Primarily because Ireland is a regulatory/tax haven for American companies and they have to enforce GDPR…and they refuse to.

Whereas DMA was written to totally avoid that problem; so I think a DMA action is WAY more likely as the Irish can’t block it.

[ Parent | on HN ]

Re:Apple's 'incredibly private' Safari is not so private in ... by moi2388 on Thursday May 02, 2024 @02:30AM (#40233290)

EU* and it’s up to 10% of global revenue.

[ Parent | on HN ]

Re:Apple's 'incredibly private' Safari is not so private in ... by hehdhdjehehegwv on Thursday May 02, 2024 @03:39PM (#40240573)

GDPR is 4% and technically EEA rather than EU. DMA is 10%.

[ Parent | on HN ]