7

As a follow-on to these questions:

What unique fingerprinting information can an iOS7 app collect?

What unique device fingerprinting information can an iOS8 app collect?

What unique device fingerprinting information can an iOS9 app collect?

iOS 10 improvements:

  • Identifier for Advertising is now all zeroes if "Limit Ad Tracking" is enabled, presumably making it unnecessary to "Reset Advertising Identifier".

  • While Apple discourages device fingerprinting and data over-collection in general, and mentioned at WWDC that some APIs and properties that could be used for fingerprinting were deprecated, there were no specifics given in the talk.

Open Issues:

  • As always there is basic system info available similar to what any web page can access: IP address, HTTP headers, etc. Many of these are low entropy or can be changed by the user through various means, but it may be possible to combine enough for a reasonable identification. Or for reasonable enough correlation for cross-device tracking.

  • There is still no official confirmation that "integrated" apps (like Facebook or Twitter) are subject to the same limitations as other iOS apps, or whether they have privileged APIs.

  • There are apps in the app store that show system information like uptime, battery level, disk size and usage, memory size and usage, network usage, LAN IP address, etc. These have become more restricted over the past two major versions, but is there any review or other mechanism to keep access to these system elements out of typical app or app 3rd-party code?

  • Can someone confirm whether WiFi AP (B)SSID is still accessible?

  • HSTS fingerprinting

  • Accelerometer and gyroscope data

  • Use of persistent data stores by apps, or by apps across an app group, that survive app (or app group) deletion. Or persistent data stores that survive device erase and restore.

  • Other open issues?

In general, what remaining device fingerprinting privacy / security vulnerabilities still exist as of iOS 10, particularly those that have no user controls or actions that can thwart them?

  • Is there a similar question on iOS 11? I failed to find anything similar. – yurkennis Apr 12 '18 at 21:34
  • 1
    @yurkennis, just added: security.stackexchange.com/questions/183698/… – pseudon Apr 13 '18 at 23:17
  • And it's almost time for iOS 12 :-) And thanks for a great job you are doing in educating us on how much can be still used for fingerprinting! – yurkennis Jul 9 '18 at 11:53
-1

There are 2 methods that I know of that still work and will survive a device reset. Unfortunately they will only remain useful if Apple don't know about them and therefore you're unlikely to find them on any internet forum.

It can be done but it's not easy. If you want to do your own research in this area, focus on hardware. Some hardware is deliberately unique but difficult to reach from userland software, other hardware components have slight manufacturing differences which can be used for fingerprinting - good luck.

  • Any reason you can't be more specific here? Apple should be made aware of privacy vulnerabilities, just like security vulnerabilities. Do you know of these two methods being used in the field? – pseudon Apr 25 '17 at 20:48
  • As I said, if these methods were known to Apple they would surely close them down because of potential misuse for advertising. One of them is used in the wild, responsibly, solely for the purpose of fraud prevention. – Andrew Apr 26 '17 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.