9

As a follow-on to these questions:

What unique fingerprinting information can an iOS7 app collect?

What unique device fingerprinting information can an iOS8 app collect?

Apple has apparently removed the ability to see other running processes in iOS 9, and throttled (and otherwise limited) the ability to test URL schemes. See: https://developer.apple.com/videos/wwdc/2015/?id=703

What remaining device fingerprinting privacy / security vulnerabilities still exist as of iOS 9, particularly those that have no user controls to block them?

e.g., There is still no official confirmation that "integrated" apps (like Facebook or Twitter) are subject to the above limitations. Both Facebook and Twitter claim that their apps are able to access an app list to use to target ads. Twitter's privacy policy hasn't been updated to state that app graph is unavailable in iOS 9. Also note that this capability is often discussed as "installed and not simply running apps"; see link in this comment for example: What unique device fingerprinting information can an iOS8 app collect?

e.g., There have been apps in the app store that show system information like uptime, battery level, disk size and usage, memory size and usage. These could easily be used as elements of a fingerprinting algorithm in a malicious app or in 3rd-party code in an app.

e.g, as always there is basic system info available similar to what any web page can access: IP address, HTTP headers, etc.

Improve this question
5
  • Here's one I never expected: apps can apparently use iOS Keychain or iCloud Key-Value Store to save data persistently, even across app deletions and even across all apps from that vendor being deleted, with no user control: apple.stackexchange.com/questions/199371/… This essentially allows an app, once installed, to forever uniquely track that device (until the deice is completely wiped). This seems to me to be a very serious security and privacy vulnerability, not just for fingerprinting reasons.
    – pseudon
    Commented Aug 9, 2015 at 13:58
  • My previous comment also means it is very difficult (requires wiping the device, which is probably not intuitive to most people) to use a device with one account on a service, then later try to use it with a different account on the same service, without the potential for the two accounts to be correlated.
    – pseudon
    Commented Jan 31, 2016 at 1:03
  • Came across this paper tu-braunschweig.de/Medien-DB/sec/pubs/2016-pets.pdf which appears to apply to iOS 9 (it mentions several fingerprinting fixes as recent as iOS 8). They list 24 unprotected fingerprinting elements, of varying stability over time. Many have to do with enabled assistive features (e.g., Closed Captioning enabled? boolean). Many seem to catch more unusual circumstances, where most users would appear the same (e.g., Jailbreak? boolean).
    – pseudon
    Commented Sep 5, 2016 at 22:50
  • The element, Installed Apps (URL Schemes), was mostly addressed in iOS 9 through (I believe) throttling anfdapp review. The most comprehensive remaining elements seem to be: Installed Apps (Icon Cache), Top 50 Songs, and WiFi SSID. Does anyone know if these (or other strong fingerprinting features from the list) are still vulnerabilities in iOS 9?
    – pseudon
    Commented Sep 5, 2016 at 22:50
  • Top 50 songs AKA access to Media Library, does require user permission in iOS 9, which can be revoked in Settings > Privacy.
    – pseudon
    Commented Sep 15, 2016 at 17:13

1 Answer 1

Reset to default
1

https://panopticlick.eff.org

EFF released a tool to check the uniqueness of a browser through things like canvas etc.

curiously i had never actually run this on iOS, but i just tried it on a device running default browser settings, and it found my browser settings were unique among 175000 tested. apple does not allow non-apple browsers to be based on anything other than their webkit engine. lastly, i am under the impression that all apps have full access to the webkit browser.

there is also a little bit of non-technical info here: https://support.apple.com/en-us/HT205223

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .