Remix.run Logo
inventor7777 7 hours ago

When Apple first released App Tracking Transparency, I immediately used it to block the trackers and I have not even thought about it since because it is so simple and useful.

What a contrast to modern websites which require all sorts of weird clicking gymnastics to disable similar tracking.

alt227 6 hours ago | parent | next [-]

Its amusing that Apple itself is one of the biggest ad companies that exists, fed entirely from their own users private data. Yet by simply pointing the finger away from themselves and helping their customers block other ad companies efforts, they seem to have gained complete trust of all their users and most dont even know how much Apple are making in ad revenue from their own data.

https://appleinsider.com/articles/22/11/14/apples-4b-ad-busi...

inventor7777 6 hours ago | parent | next [-]

Yes, that is very true. Unfortunately, without a true non-Apple or non-Google OS, the ATT toggle is likely about as good as you can get. And it does stop the apps themselves getting raw access to your data, which is not something to sniff at.

nozzlegear 6 hours ago | parent | prev | next [-]

I trust Apple with my private data. I don't trust Google with it, and I don't trust Joe Blow's Sketchy Ass Apps & Ads Service with it. Simple as.

microtonal 5 hours ago | parent | next [-]

Why do you trust Apple with your private data? Unless you enable ADP, iCloud backups are only encrypted at rest and not end-to-end. So, Apple, law enforcement, etc. can just read your iMessage or WhatsApp messages if needed. Did you enable ADP? Well good luck convincing everyone you communicate with to enable it as well, or their backups will still have all your chats without E2E encryption.

WhatsApp pulls a similar trick on Android. It's E2E encrypted, but by default backups (done to Google Drive) are not. I think most users never enable encrypted backups.

I wouldn't be surprised if there is a deal with law enforcement, where Apple and Meta can do and advertise E2E chats, but the defaults (which most users do not change) are such that law enforcement can still access them. But yeah, Apple and Google were part of PRISM too, so no big surprise I guess?

If you truly care about privacy, either completely disable iCloud backups or get a GrapheneOS phone. Also use Signal, because they exclude themselves from phone backups by default. So either chats are not backed up or they are backed up through Signal's own E2E backup service.

Footprint0521 5 hours ago | parent [-]

Use signal and disable notification previews… Apple saves even cleared notification text previews on device, which the feds just used in a recent case…

nickburns 6 hours ago | parent | prev [-]

Exactly. Amusing indeed.

5 hours ago | parent [-]
[deleted]
frumplestlatz 5 hours ago | parent | prev [-]

The article you cite refutes your claim, explicitly bringing up the lack of access to user data.

I frankly don’t care if the App Store has advertisements. I would care if my data is (1) available to Apple to read by virtue of not being e2e encrypted, and (2) used to train models and target those advertisements.

fsflover 3 hours ago | parent [-]

> I would care if my data is (1) available to Apple to read by virtue of not being e2e encrypted, and (2) used to train models and target those advertisements.

Here we go:

Apple fined $8.5M for illegally collecting iPhone owners' data for ads (gizmodo.com)

https://news.ycombinator.com/item?id=34299433

Keeping your data from Apple is harder than expected (aalto.fi)

https://news.ycombinator.com/item?id=39927657

Apple silently uploads your passwords and keeps them (lapcatsoftware.com)

https://news.ycombinator.com/item?id=42014588

Watchdog ponders why Apple doesn't apply its strict app tracking rules to itself (theregister.com)

https://news.ycombinator.com/item?id=43047952

Apple memory holed its broken promise for an OCSP opt-out (lapcatsoftware.com)

https://news.ycombinator.com/item?id=41184153

Google collects 20 times more telemetry from Android devices than Apple from iOS (therecord.media) [but Apple still collects a lot!]

https://news.ycombinator.com/item?id=26639261

microtonal 5 hours ago | parent | prev | next [-]

When Apple first released App Tracking Transparency, I immediately used it to block the trackers

There seems to be a common misconception that this blocks trackers, which is not the case. Use a DNS-based ad/tracker blocker and watch the logs and you'll see that many apps happily track you. As far as I understand, ATT blocks is cross-app/website tracking. If you deny, the app does not get access to the Identifier for Advertisers, meaning that tracking services cannot use a single identifier that is used across apps. While this initially had a large financial impact (see the article), trackers have probably developed other ways to correlate data from apps/websites now.

The real solution would be for Apple/Google to offer an option to completely disable in-app trackers and if an app would violate it, boot them from the App Store.

Of course, they would never do that because they make a lot of money from targeted advertising with their own ad networks, so either they would have to block themselves or get in hot water with regulators.

Put differently, Apple and Google are not your friend here.

inventor7777 33 minutes ago | parent [-]

Hmm yes I should have been more specific. I am aware that it does not block trackers...my Pi-hole logs are still full of sketchy/tracking domains.

I simply meant that the unique ID can't be used to track me anymore, at least across different third party application companies. I would edit my comment but it is too late now.

StilesCrisis 6 hours ago | parent | prev | next [-]

Ironically Google couldn't disable third-party cookies even if they wanted to; it's seen as anti-competitive to other tracking networks and was blocked by the courts.

inventor7777 6 hours ago | parent | next [-]

Really? Do you have a link? That sounds very interesting and very frustrating.

Regardless, because of such things I'm guessing the only ways to disable such tracking in the foreseeable future will still be 3rd party non-affiliated DNS/extensions or browsers such as Brave and Safari (to some extent).

cameronbrown 5 hours ago | parent [-]

https://www.gov.uk/cma-cases/investigation-into-googles-priv...

Disclosure: I worked on Privacy Sandbox.

troupo an hour ago | parent [-]

Ironically Google is the world's largest advertising and tracking company and literally does everything in their power to trick users into tracking and surveillance. https://x.com/dmitriid/status/1908951546869498085 and https://x.com/dmitriid/status/1664682689591377923

The problem wasn't "Google can't remove third-party cookies", he problem is "too much power in the hands of Google" and "conflicts of interest". From the link you posted below:

--- start quote ---

The investigation concerns Google’s proposals to remove third-party cookies (TPCs) on Chrome and replace TPCs functionality with a range of ‘Privacy Sandbox’ tools, while transferring key functionality to Chrome.

The CMA is particularly interested to hear any views on whether the proposed commitments are sufficient to address the CMA’s competition concerns regarding:

- unequal access to the functionality associated with user tracking

- self-preferencing Google’s own ad tech providers and owned and operated ad inventory

- imposition of unfair terms on Chrome’s web users

--- end quote ---

Spin off your surveillance tech, and there will be no problem. Oh wait...

2 hours ago | parent | prev [-]
[deleted]
ourmandave 7 hours ago | parent | prev | next [-]

We should pass laws that require the weird clicking gymnastics to opt-in to tracking.

Instead of the default opt-in hidden in the terms and conditions nobody reads.

HWR_14 6 hours ago | parent [-]

The EU did that and people still bitch about GDPR banners on websites.

pizzly 3 hours ago | parent | next [-]

The law had good intention but bad implementation. Also the law takes so long to change. Once it became obvious that companies would bypass it by having clicking gymnastics they needed to quickly update the law saying that it should only take one click to opt out.

fsflover 3 hours ago | parent [-]

What is wrong with its implementation? All the cookie banners aren't in the law; their basically malicious compliance.

_factor 6 hours ago | parent | prev | next [-]

They took what should have been a browser on/off switch and turned it into something almost worse.

troupo 4 hours ago | parent [-]

GDPR isn't about cookies, or any specific tech. It's a GENERAL Data Protection Regulation.

On top of that it literally defines opt-out as the default state

As for browsers, imagine if world's largest advertising and tracking company that incidentally builds world's dominant browser and dominates all web standards would implement this as a browser switch instead of inventing new ways of tricking you into surveillance? https://x.com/dmitriid/status/1908951546869498085 and https://x.com/dmitriid/status/1664682689591377923

alt227 5 hours ago | parent | prev [-]

GDPR didnt do it, lazy site owners that didnt want to read the legislation did.

Most sites dont even need those popups, but its easier to just shove one on your site than try to understand the specific situations which do need it.

kimixa 4 hours ago | parent [-]

Yeah, the banners/popups aren't required by gdpr, they're the "malicious compliance" solution site owners came up with because they don't want to comply with the limitations, and make it as difficult as possible for the user not to let them.

pacija 6 hours ago | parent | prev [-]

In my case firefox + arkenfox + ublock origin advanced mode require all sorts of weird clicking to enable similar tracking :)

unethical_ban 5 hours ago | parent [-]

I haven't looked at arkenfox. But I went to the cover your tracks tool by EFF yesterday and it was still able to uniquely fingerprint my computer, even with Firefox strict privacy and unlock origin.

I think unless you run stock mullvad/Tor browser, you're leaking who you are. Sad but true. I wish canvas and webgl fingerprinting were disabled/crippled by default.