Apple Device Analytics Contain Identifying iCloud User Data, Claim Security Researchers (macrumors.com) 13
A new analysis has claimed that Apple's device analytics contain information that can directly link information about how a device is used, its performance, features, and more, directly to a specific user, despite Apple's claims otherwise. MacRumors reports: On Twitter, security researchers Tommy Mysk and Talal Haj Bakry have found that Apple's device analytics data includes an ID called "dsId," which stands for Directory Services Identifier. The analysis found that the dsId identifier is unique to every iCloud account and can be linked directly to a specific user, including their name, date of birth, email, and associated information stored on iCloud.
On Apple's device analytics and privacy legal page, the company says no information collected from a device for analytics purposes is traceable back to a specific user. "iPhone Analytics may include details about hardware and operating system specifications, performance statistics, and data about how you use your devices and applications. None of the collected information identifies you personally," the company claims. In one possible differentiator, Apple says that if a user agrees to send analytics information from multiple devices logged onto the same iCloud account, it may "correlate some usage data about Apple apps across those devices by syncing using end-to-end encryption." Even in doing so, however, Apple says the user remains unidentifiable to Apple. We've reached out to Apple for comment.
On Apple's device analytics and privacy legal page, the company says no information collected from a device for analytics purposes is traceable back to a specific user. "iPhone Analytics may include details about hardware and operating system specifications, performance statistics, and data about how you use your devices and applications. None of the collected information identifies you personally," the company claims. In one possible differentiator, Apple says that if a user agrees to send analytics information from multiple devices logged onto the same iCloud account, it may "correlate some usage data about Apple apps across those devices by syncing using end-to-end encryption." Even in doing so, however, Apple says the user remains unidentifiable to Apple. We've reached out to Apple for comment.
Now there's a shocker! (Score:2, Flamebait)
Apple is evil too - who knew? /sarc
It will be interesting to hear what the fanbois and other reflexive Apple defenders have to say about this.
Re: Now there's a shocker! (Score:3)
never attribute to malice that which is adequately explained by stupidity.
Well, to be fair... (Score:2, Insightful)
The device analytics & privacy statement does say "Personal data is not logged at all," so there's no names, address, phone numbers, locations nor birthdates getting logged.
It's just logging your personal i-Cloud account ID... /eyeroll
Both are correct (Score:3)
Re: (Score:2)
By association you are tagged and bagged and tracked.
But for analytics its just a DsId, which makes better sense if you call it a unique primary key. As soom as a JOIN takes place, there is no privacy.
Not strictly true. In the payment industry say, you can't avoid sending something sensitive over the wire, Apple might be doing some kind of validation on that ID first that requires it, I don't know, but when the data is stored you swap it with something else that could be cryptographically derived from the real ID. Apple seems to be using the real ID to link different devices to one entity.
That's how you have systems where a bank teller can't tell you what your credit card number is if their life depend
Their line of defence (Score:2)
It's faily easy to predict what their response will be. They will say that the data contained within the payload sent to the server does not contain any personal information because the dsId field contains jibber-jabber, and they will attempt to completely downplay the fact that it can still be correlated with other data sets and lead to the same result. In other words "we're not sending any PII in the traditional sense but don't try to tell us what we can do or not afterwards".
Re: (Score:1)
Re: (Score:2)
This article by the person who did the work is MUCH better than the summary in other media, and it's much more balanced. If I could upvote it, I would.