Many of Apple’s privacy labels are false

I have to say this is disappointing to read. According to a Washington Post article, Apple’s big privacy product is built on a shaky foundation: the honor system. In tiny print on the detail page of each app label, Apple says, “This information has not been verified by Apple.”

Shame on the developers for lying, and double shame on Apple for not verifying.

I checked Apple’s new privacy ‘nutrition labels.’ Many were false.

You can trust Apple … right?

You go to your iPhone’s App Store to download a game. Under a new “App Privacy” label added last month, there’s a blue check mark, signaling that the app won’t share a lick of your data. It says: “Data not collected.”

Not necessarily. I downloaded a de-stressing app called the Satisfying Slime Simulator that gets the App Store’s highest-level label for privacy. It turned out to be the wrong kind of slimy, covertly sending information — including a way to track my iPhone — to Facebook, Google and other companies. Behind the scenes, apps can be data vampires, probing our phones to help target ads or sell information about us to data firms and even governments.

Google apps will stop certain tracking to avoid the iOS “Allow Tracking” prompt

With iOS 14, Apple is requiring app developers to tell users about and have them opt-in to tracking. Google today announced that “when Apple’s policy goes into effect, it will no longer use information (such as IDFA) that falls under ATT for the handful of our iOS apps that currently use it for advertising purposes. As such, we will not show the ATT prompt on those apps, in line with Apple’s guidance.”

I don’t use Google’s apps but for those of you who do this should be a welcome change.

Firefox 85 adds supercookie protection. What about Safari?

In technology news today Mozilla announced that it has added built-in protection from supercookies to Firefox 85. “Firefox now protects you from supercookies, a type of tracker that can stay hidden in your browser and track you online, even after you clear cookies,” Mozilla explains in a blog post. “By isolating supercookies, Firefox prevents them from tracking your web browsing from one site to the next.”

With Safari being my main browser and Firefox being secondary I wondered if Safari might have the same protection from supercookie tracking? To my surprise, it does and has since 2018.

“Quietly and without fanfare Apple has rolled out a change to its Safari browser that munches one of the web’s most advanced “super cookies” into crumbs.” Apple burns the HSTS super cookie WebKit blog: Protecting Against HSTS Abuse

Apple doubles down on iOS App Tracking Transparency

According to Craig Federighi, The aim of ATT is “to empower our users to decide when or if they want to allow an app to track them in a way that could be shared across other companies’ apps or websites”.

With Apple requiring developers to share privacy details needed for the new privacy labels on December 8 iOS App Tracking Transparency (ATT) has made its way into the news again thanks to the hysteria of adtech and with particular criticism coming from Facebook-owned WhatsApp.

Apple has used a speech to European lawmakers and privacy regulators to come out jabbing at what SVP Craig Federighi described as dramatic, “outlandish” and “false” claims being made by the adtech industry over a forthcoming change to iOS that will give users the ability to decline app tracking.

It’s good to see Apple standing strong on ATT to protect the privacy of its users.

If you’re interested, here’s a link to Craig Federighi’s speech.

UPDATE: iOS 14 has Zuckerberg/Facebook running scared

I’ve been working on an article about the iOS 14 privacy feature that has Facebook and other advertisers running scared. Facebook acknowledged that Apple’s upcoming iOS 14 could lead to a more than 50% drop in its Audience Network advertising business. (Doesn’t that just break your heart)

Today to my disappointment, Apple is holding off on introducing the default feature until early next year to allow developers more time to make the necessary changes to their apps. I guess this makes everything I’ve written all for naught. Oh, well.

By the way, did you know that you can manually limit targeted advertising and reset your identifier? If you do this an app will still be able to access your IDFA but it makes it much harder to build a profile on you. I reset my identifier once a month.

The advertising identifier on an Apple device does not identify you personally, but it can be used by advertisers to create a profile about you. If it’s never reset, that profile increases in detail, allowing advertisers to target ads to you based on your Internet activity.

My thoughts on Apple & Google’s COVID-19 contact tracing

From what I’ve read Apple and Google’s COVID-19 contact tracing seems like a good idea and one that I’ll most likely use. It appears to be the best technological solution to date for governmental authorities to partially lift the lockdown orders that are currently in place. That said I do have privacy concerns.

According to the Verge, this is how we’ll use the tracking tool. “Google and Apple are using Bluetooth LE signals for contact tracing. When two people are near each other, their phones can exchange an anonymous identification key, recording that they’ve had close contact. If one person is later diagnosed with COVID-19, they can share that information through an app. The system will notify other users they’ve been close to, so those people can self-quarantine if necessary. Ideally, this means you won’t have to reveal your name, location, or other personal data.”

Apple and Google stress that “user privacy and security is central to the design”. So here’s the best explanation as to how privacy will be protected that I’ve found.

Ars Technica

But while mobile-based contact tracing may be more effective, it also poses a serious threat to individual privacy, since it opens the door to central databases that track the movements and social interactions of potentially millions, and possibly billions, of people. The platform Apple and Google are developing uses an innovative cryptographic scheme that aims to allow the contact tracing to work as scale without posing a risk to the privacy of those who opt into the system.

Privacy advocates—with at least one notable exception—mostly gave the system a qualified approval, saying that while the scheme removed some of the most immediate threats, it may still be open to abuse.

“To their credit, Apple and Google have announced an approach that appears to mitigate the worst privacy and centralization risks, but there is still room for improvement,” Jennifer Granick, surveillance and cybersecurity counsel for the American Civil Liberties Union, wrote in a statement. “We will remain vigilant moving forward to make sure any contact tracing app remains voluntary and decentralized, and used only for public health purposes and only for the duration of this pandemic.”

Unlike traditional contact tracing, the phone platform doesn’t collect names, locations, or other identifying information. Instead, when two or more users opting into the system come into physical contact, their phones use BLE to swap anonymous identifier beacons. The identifiers—which in technical jargon are known as rolling proximity identifiers—change roughly every 15 minutes to prevent wireless tracking of a device.

As the users move about and come into proximity with others, their phones continue to exchange these anonymous identifiers. Periodically, the users’ devices will also download broadcast beacon identifiers of anyone who has tested positive for COVID-19 and has been in the same local region.

In the event someone reports to the system that she has tested positive, her phone will contact a central server and upload identifiers of all the users she has come into contact with over the last 14 days. The server then pushes a notification to the affected users.

My choice for a Safari 13 content blocker on Mac

With Safari 13 my favorite Mac ad and tracker blocker uBlock Origin, along with a few other extensions, no longer work. Because of this, I have switched to Firefox as my main browser. That said there will still be times when I will want to use Safari and will want an ad and tracker blocker.

I tried Ghostery Lite but I had two issues with it. It doesn’t block YouTube ads and I didn’t like the way it handles space left behind by blocked ads.

For now, I’ve settled on Wipr. Wipr blocks all ads, trackers, cryptocurrency miners, EU cookie and GDPR notices, and other annoyances. I also switched to Wipr for Safari on my iPhone and iPad in place of BlockBear. BlockerBear was working fine but for consistency, I switched to Wipr.

Day One encryption

I have been using Day One for going on three years now. One concern I’ve had is that journals by default are encrypted but with Day One holding the encryption key. This means that someone at Day One might be able to access my journals. Journals with Standard encryption are also exposed to a data breach or security glitch. This has caused me to limit what I write in them.

Now, after reading Shawn Blanc’s ”Best Journaling App for iPhone, iPad, and Mac” on The Sweet Setup I’ve taken his advice and enabled End-to-end encryption for all my journals.

Shawn Blanc:

End-to-end encryption is not turned on by default for providing the best type of security for your journal entries, as users must maintain their encryption key at all times to unlock journals if necessary. As Day One’s FAQ puts it:

When using end-to-end encryption, it is essential you save your encryption key in a secure location. If you lose your key, you will not be able to decrypt the journal data stored in the Day One Cloud. You’ll need to restore your data from an unencrypted locally-stored backup.

We recommend turning on end-to-end encryption whenever you create a new journal to ensure your data is always kept safe and secure. Save your encryption key in an app like 1Password or a locked note inside Notes.app and never lose the key.

Now no one has access to my journals without the encryption key. I keep it in 1Password.

What you need to know about the tech giants Amazon, Facebook, Google, Microsoft, and Apple

I just finished reading Kashmir Hill’s series of articles Life Without the Tech Giants. Here’s what I learned. It’s impossible to get along without them even if we’re boycotting their apps. Amazon, Facebook, Google, Microsoft, and Apple dominate the internet in ways I never realized.

This should be required reading for everyone who uses the internet. It is an education in the way the internet operates and how dependent it is on these five companies.

This is a story of how, over six weeks, I cut them out of my own life and tried to prevent them from knowing about me or monetizing me in any way—not just by putting my iPhone in a drawer for a week or only buying local, but by really, truly blocking these companies from accessing me and vice versa. I wanted to find out how hard it would be—or if I could even do it—given that these tech giants dominate the internet in so many invisible ways that it’s hard to even know them all.

To keep my devices from talking to the big five’s servers, and vice versa, Dhruv a technologist built a custom virtual private network, or VPN, for me, through which I sent all my internet traffic. He then used the VPN to block my devices from being able to use the IP addresses owned by Amazon, Google, Facebook, Microsoft, and/or Apple, depending on the week.

Week 1 Kashmir blocks Amazon
I Tried to Block Amazon From My Life. It Was Impossible

After reading this, news broke that Amazon purchased Eero the WiFi router that I personally use. This had made a lot of people unhappy. They don’t want Amazon sniffing all their internet traffic. I think Zack Whittaker’s TechCrunch article What Amazon’s purchase of Eero means for your privacy frames how we should think about this perfectly.

Everyone seems to forget Amazon’s massive cloud business. Most of the internet these days runs on Amazon Web Services, the company’s dedicated cloud unit that made up all of the company’s operating income in 2017. It’s a cash cow and an infrastructure giant, and its retail prowess is just part of the company’s business.

Think you can escape Amazon? Just look at what happened when Gizmodo’s Kashmir Hill tried to cut out Amazon from her life. She found it “impossible.” Why? Everything seems to rely on Amazon these days — from Spotify and Netflix’s back-end, popular consumer and government websites use it, and many other major apps and services rely on Amazon’s cloud. She ended up blocking 23 million IP addresses controlled by Amazon, and still struggled..

Week 2 Kashmir blocks Facebook
I Cut Facebook Out of My Life. Surprisingly, I Missed It

Week 3 Kashmir blocks Google
I Cut Google Out Of My Life. It Screwed Up Everything

Week 4 Kashmir blocks Microsoft
I Cut Microsoft Out of My Life—or So I Thought

Week 5 Kashmir blocks Apple
I Cut Apple Out of My Life. It Was Devastating

Week 6 Kashmir blocks all 5
I Cut the ‘Big Five’ Tech Giants From My Life. It Was Hell

Additional reading by technologist Dhruv Mehrotra the person who built Kashmir’s custom VPN.
Want to Really Block the Tech Giants? Here’s How