Apple saves you from prying eyes with new iOS8 anonymizing trick

Every smart phone is constantly broadcasting its identity through Wifi and it's extremely easy to track people that way. Main street shops for instance are already using it to identify customers even outside the shop.

The identifier is the 'unique' Mac-address which your phone broadcasts. Apple will now stop this by generating a random (spoof) Mac-address for each request by a non trusted wifi station.(1)

Result: no database, no identification, at least some privacy back when outdoors. Let's hope others (Google I'm looking at you!) will follow suit.

kudos to +Frederic Jacobs https://twitter.com/FredericJacobs/status/475601665836744704?_ga=1.144086837.1052920292.1402327892

(1) my assumption about the implementation.

(2) Found an image that illustrates the concept very well. It also shows alternative ways of identification: Bluetooth is only one of the many ways unfortunately. All kinds of fingerprinting are possible. #Tech

 
This entry was posted in Tech Posts. Bookmark the permalink.

82 Responses to Apple saves you from prying eyes with new iOS8 anonymizing trick

  1. I bet there's an app for that on Google Play. I agree, however, that built in would be great.

  2. Max Huijgen says:

    Yes +Eve A there is: Pry-Fi but that will leave the 99% vulnerable.

  3. Kudos to Apple, though I think we still don't have the full story as they have been playing up we are here to protect your privacy since last week's keynote. I use an app called tasker that will automatically switch off my wifi when I am not at work or home and enable it when I am there. or you could simply use an app like this but it requires root https://play.google.com/store/apps/details?id=eu.chainfire.pryfi .

  4. Simply an extension of their mesh network for ads.

  5. Paul Wooding says:

    I have this already on my Android.

    It's in settings/wifi/on-off

  6. I guess the only reason the stop is that there are other identifiers that can do the same trick.
    (and there always will be enough people that have wifi or bluetooth turned on.)

  7. Max Huijgen says:

    Sure +Paul Wooding but that means crippling your device. Why would one have to do that?

  8. Max Huijgen says:

    You mean Apple stops it because there are other ways? +Paul Schoonhoven
    They have been active against device-profiling.

  9. Eli Fennell says:

    Apple Stops Marketers From Spying on You, Spies on You Themselves Instead to Sell iAds

    There, I just wrote the headline. This isn't benevolence, this is Apple trying to cut out the competition while they track you everywhere you go and iBeacons beam their marketing messages right at your devices.

  10. I don't see turning off wifi as crippling your device, you use it when you need it. Also Apple is ensuring that they are the only persons you share your data with, so if your ok with Apple having that information and trusting them cool.

  11. andy gowrley says:

    I think you mean they are pushing bluetooth Ibeacons (Look how after any iOS updates bluetooth is defaulted to on even if previously it was off.) So WiFI location as used by Google and others to be reduced in potency.
    Multinationals are not doing things for the good of people.

  12. Paul Wooding says:

    It's another excellent example of how how Apple take something, convince people there is a problem, and then dress up their offering as a wonderful "must have" solution only available from them.

    It's a non issue for the majority of phone users. And those that think they are being tracked are already employing better solutions.

  13. Max Huijgen says:

    +Marlon Thompson but once you need it, you are registered by the crooks marketeers. You can only check your email at home this way.

    Don't understand the sentence about Apple being the only one?

  14. Paul Wooding says:

    +Max Huijgen I don't agree that turning off wifi and connecting to the mobile data network instead is "crippling".

    And there are not many free wifi networks provided by shops anyway.

    It's potentially power saving too.

  15. Eli Fennell says:

    +Max Huijgen What he means is this in no way stops Apple from knowing all the information this supposedly denies "marketers". And, oh yeah, Apple is also an advertising company now! What an amazing koinky-dink this "feature" means they'll have easily the most complete database of information about you to sell advertisers, wouldn't you say?

  16. Max Huijgen says:

    +Eli Fennell very sensational and you do love your conspiracies but iBeacons broadcast to you and if you don't respond nothing happens. Your smart phone Wifi works the other way.

  17. Noel Beale says:

    +Paul Wooding said it best, just turn it off… sigh…

    I NEVER leave my WiFi on once I leave my house. It not only saves battery, but keeps my device safer from all sorts of things that go out over WiFi. Heck, Android even has an app that turns my WiFi on and off automatically when I leave my house.

  18. +Eli Fennell iBeacon, that's what I was trying to think of earlier.

  19. Eli Fennell says:

    +Max Huijgen Doesn't matter, because Apple's tracking you anyways, and that's not a conspiracy theory, in fact it's the reason why iOS devices all have designated ad tracking ID's just like Android does.

    But I've noticed you like to be very selective these days in your suspicions. Google implements end-to-end encryption, and you see "smokescreen for evil-ness". Apple, an ad tracker, denies other ad trackers the ability to track you but tracks you themselves anyways, and you see "Benevolent Apple saves privacy!"

  20. Max Huijgen says:

    +andy gowrley iBeacons are like point of sales televisions. They show you ads local to the products. They can't track your device UNLESS you install an app that responds to the beacon.

  21. Except, again, Apple already does it.

  22. Eli Fennell says:

    +Max Huijgen You seem to be missing the point that iBeacons don't need to track you, Apple already does that through your unique Apple advertising ID. Since the same company controls both, it doesn't take a genius to figure out that's irrelevant if one does the tracking and one just targets you.

  23. Max Huijgen says:

    And how – technically – does Apple know you are close to the shop? +Eli Fennell UNLESS you install an app that talks back?

  24. Thanks +Eli Fennell I was writing a long response but you have covered most of what I wanted to say.

  25. Eli Fennell says:

    +Max Huijgen Your phone already talks back to Apple ALL THE TIME.

    Don't be so naive. How did you think iAds worked, or why did you think iOS users all have ad tracking ID's?

    Strikes me you may be deliberately pretending ignorance on this one to uphold a point that contradicts in the most obvious way points you have previously made involving other companies.

  26. Max Huijgen says:

    And I can control it (if I happened to be an Apple user which I'm not) and even disable that trackingID without ruining my smart phone experience like you do when you disable Wifi.

    When the value of
    advertisingTrackingEnabled is NO,
    the advertising identifier is not permitted
    to be used to collect data for or serve
    targeted advertising

  27. Eli Fennell says:

    +Max Huijgen How would I "ruin" my experience by turning off WiFi?

    Besides, I've been able to obscure my location from WiFi for years on Android. It's actually quite easy. But once again Apple does something we've been able to do on Android for years, and people act like they invented it.

  28. Eli Fennell says:

    +Max Huijgen P.S. – Can control it and WILL control it are different worlds. Especially given the greater dislike by iOS users for "tinkering", it's fair to wager most people WON'T disable Apple's ability to track them.

  29. +Max Huijgen why do you keep saying ruining your smartphone experience by taking off Wifi? I only use Wifi at work and at home, If I happen (God forbid) to use the cess pool that is a public WiFi I use a VPN app on my phone to protect myself. Turning off your WiFi is not a bad thing

  30. Eli Fennell says:

    +Marlon Thompson Indeed, and I can turn it on and off easy with the Power Control widget. Which, suffice to say, no equivalent for exists on iOS.

  31. Jonah Miller says:

    Wow! This is smart of Apple. This is the kind of feature that can drive security geeks away from android and businesses away from Blackberry.

  32. +Max Huijgen, even with advertisingTrackingEnabled = no, Apple has sufficient information (mac address, appleid, location, IMEI/IMSI) to provide at least semi-targeted ads through iBeacons.
    I see this "we value your privacy and protect it" IOS 8 trick as effectively Apple setting things up to cut down the competition in favour of their own ad services.

  33. +Rohan Blake I am for turning off the Wifi, check my responses, its Max who says it ruins your smartphone experience

  34. Eli Fennell says:

    +Olivier Poulet Apple cut out the competition to favor themselves? The heck you say! 😛

  35. Max Huijgen says:

    Might be different at your locations +Scott Wilson +Marlon Thompson but f.i. in the Netherlands people use Wifi almost all the time. F.i. through the use of FON and similar trusted hotspots.

    If you're very privacy sensitive and don't need Wifi away from home or work you can of course disable it, but it's not the 99% use case.

  36. So then +Max Huijgen you should say it cripples your experience but not for the others who use LTE and trust me its not 1%

  37. Max Huijgen says:

    Why can't you disable location services? +Scott Wilson Do you own an iphone?

  38. Max Huijgen says:

    +Eli Fennell whats up with the conspiracies. I would vain ignorance now while being critical at other times?
    If you would check my post history you'll notice me and Apple are not happy campers.

    However if they provide a sensible solution to an existing privacy problem I will applaud them.
    I'm not a blind fan of any operating system or company.

  39. This is nothing more than Apple trying to lock down the tracking data / ad revenue for their own devices and try to force everyone to use their tech instead of cross-platform / competitor technologies. IT has nothing to do with "Protecting their customers".

  40. Max Huijgen says:

    Helpful that you own an iPhone +Scott Wilson Can you check 'Services. Frequent Locations and see if you no longer can disable the “Improve Maps” and “Frequent Locations” options.

  41. Eli Fennell says:

    +Max Huijgen Conspiracy theories like, "Google only released email encryption to hide their true agenda to violate your privacy with impunity"? Like you complaining that Google still "reads" regularly-encrypted Gmails, but having no apparent problem with Apple still tracking your supposedly "private/obscured" location history?

    You may not be best buds with Apple, but you're clearly struggling to explain how two companies doing equivalent things can be in the one case condemned and in the other praised.

  42. Per Siden says:

    The only reason to leave wifi enabled when you leave home or work is to get more responsive and accurate locations. I sometimes need that, but I have never felt comfortable with how it leaves me more vulnerable.

    I would definitely like to see this implemented as a standard on Android as well.

  43. Max Huijgen says:

    But I'm pretty sure you could disable it just the way I describe it in iOS although I can't be sure about iOS 8 beta of course. +Scott Wilson

  44. Max Huijgen says:

    I just checked: this has been my first post ever positive about Apple and privacy.
    But I did post on that subject: always highly critical as there just was nothing good to report.

  45. Eli Fennell says:

    +Scott Wilson I wouldn't trust them at all, personally. Luckily I don't need to since I'm not an Apple user.

  46. Max Huijgen says:

    +Scott Wilson let's stay to technical arguments and not hearsay from 'scandals' from the days of iOS4.
    I have written before about the change in tracking technology https://plus.google.com/u/4/112352920206354603958/posts/4FY7nKKM5Wn

  47. Max Huijgen says:

    I find the whole 'trust' argument uninteresting except if it's backed up by technical steps.
    I don't trust any corporation with my data.

  48. John A. says:

    Wow. I wouldn't be surprised if apple is advertising this to only replace it iBeacon. Get you locked in to apple more and try and keep the money away from competitors. No thanks. I'll keep my wifi, pry-fi and my NFC which is much more secure from prying and in transactions because it works only a few cm away. Booyah!

  49. Max Huijgen says:

    The link you provided +Scott Wilson is a perfect illustration of how Google harasses me daily to re-enable location services and Google Now. Very, very similar

  50. Netz Hog says:

    It's just a race to control data. Don't get too excited, it's merely propriety in another dress.

  51. Well. Generating a new MAC for every request looks a little too much. I think it'd be more reasonable to generate a new mac roe every new access point and re-generate it every time it gets in/out of range. Also it is worth mentioning that MAC is not the only identifier – there also is a host name.

  52. great move by apple. can't see google following suit given how they make their money

  53. Eli Fennell says:

    +William Martin To follow suit, all Google would have to do is block everyone but themselves from tracking you. Wouldn't hurt them at all, heck they might even try that if it wouldn't look so blatantly self-serving.

  54. Max Huijgen says:

    +Scott Wilson Why do you claim to have an iPhone 5s while you posted yesterday that I'm mostly just trolling. That, and I'd get an iPhone tomorrow if they stopped sucking ?

    Did they stop sucking today? And if you have one, can you check that privacy setting on iOS8beta as I can't find other people to do it. Non disclosure probably.

  55. Max Huijgen says:

    Ok,, no problem, but can you check it tomorrow? And can you check it on your ipad running the latest iOS 7.x

  56. +Eli Fennell fair point, but whatever the reasons i couldn't see google doing it any time soon. personally i don't wory much about being tracked anyway, tailored ads don't annoy me, means i get adverts for gadgets instead of tampons

  57. Max Huijgen says:

    This could confuse readers: to be clear Cisco or any other network company using beacons has completely nothing to do with iBeacons by Apple.
    Completely different tech, completely different purposes. Resemblance is just the general word 'beacon'.

  58. Max Huijgen says:

    Of course not +Scott Wilson its a BTLE profile. This discussion is drifting into a pro/ contra Apple thing while I just applauded iOS for implementing an important privacy concern.

  59. Max Huijgen says:

    But let me rephrase the whole discussion. No longer being visible while walking around with your smart phone is good or bad.

    Just plus this if you think it would be good if leaving your wifi on shouldn't be a reason for shops to start tracking your visits whatever your settings. This should be a default…

  60. Max Huijgen says:

    Option a) it's bad: Apple shouldn't obscure our Mac-addresses to shop owners. Keep it the way it's on Android and let them know we are near their shops.

  61. Max Huijgen says:

    Option b) it's good. Every step towards more privacy is welcome. Maybe future smart guys find ways around it, but I do like my privacy.

  62. Max Huijgen says:

    You're the one using an iPad +Scott Wilson 😉 I'm free of iDevices…

  63. Max Huijgen says:

    I have a young daughter with an iPhone and I'm the goto guy for support. We all have our jinxes +Scott Wilson

  64. unknwn C says:

    Everyone- You know you can be tracked with amazing accuracy by wifi?
    Public- …

    Apple- We have this shiny thing!! It happens to come with this side feature!
    Public- GIMMENOW

  65. Mario Sotelo says:

    Only they want to market to you. Not everyone else. Then things might actually be fair.

  66. Mario Sotelo says:

    Here is a solution, don't use other's Wifi

  67. Will Good says:

    Or…you could save some battery and turn your WiFi and Bluetooth off.

  68. unknwn C says:

    You know what? +1 this comment if you've never heard of location tracking with Wifi until Apple announced it.
    How screwed are we?

  69. Max Huijgen says:

    If only these articles had some – technical – depth, but they don't. They just state whatever sells page views and go on. +Marlon Thompson

  70. +Max Huijgen Search Engine Land is one of the most (if not the most) credible sources on the internet for information on advertising technology. Danny Sullivan who is the owner of the site does not just do things for page views and I expect him to continue to follow up on this. And the article basically supports you point of view that it will put a dent on tracking, however their are still offline on site methods. It also points out that users do tend to opt in to share their location when it benefits them , which supports the argument that this could push the use of apple's ibeacon program to marketers.

  71. Max Huijgen says:

    I read it before I commented +Marlon Thompson and if there is a follow up I will read. For now it's just a statement 'companies xx can still track you'

  72. Max Huijgen says:

    +Mario Sotelo why not use the Wifi of Starbuck, MacDonals, or the FON network. There is a security risk but your home network isn't resistant to tampering as well. Lots of people depend on available Wifi.

  73. Max Huijgen says:

    I only checked Euclid, mentioned by +Danny Sullivan as one of the companies still able to track you and they say:
    Euclid senses smartphones' anonymous Wi-Fi signals
    Smartphones send out short "pings" as they search for Wi-Fi networks nearby. These pings include the phone's MAC address (a unique string of letters and numbers), signal strength, and other non-personally identifiable information.

    With a different MAC on every ping this will no longer work. I can't see how they can still track you based on their open information. +Marlon Thompson

  74. Yes +Max Huijgen they won't have a unique identifier for you specifically to be retargeted if you walk into the store again but the will still have some data that would still be useful just not as useful as before which supports your initial assumption and my first comment yesterday was congratulating apple but I wanted more info. Also when you suggest people use open WiFi of a Starbucks also tell them to use a VPN such as proxpn

  75. Max Huijgen says:

    Depending on the implementation by Apple of course, but I would assume Wifi trackers would even lose you while in the shop +Marlon Thompson

  76. Max Huijgen says:

    There are of course other technical means to fingerprint a specific phone f.i. by its precise radio characteristics, but it would be much more difficult, cost more and I don't know if it has ever been tried in 'the wild'

  77. The change in App Store policy described below only comforts me in thinking that this "privacy protection" is only Apple cutting down competition, and that they do have an alternate means of tracking you and your (relatively) precise location.

    http://www.engadget.com/2014/06/10/apple-banning-apps-social-sharing/?ncid=rss_truncated

    It looks more and more like Apple is setting things up for them to be the only advertising conduit to reach Apple users. E.g. a move to an even more walled garden, not towards more privacy for iDevice users.

  78. Max Huijgen says:

    Interesting article, but I don't share your conclusion +Olivier Poulet
    Trying to limit the pyramid schemes of promoting outside content and the numerous 'shares' which they trigger seems fine to me.

  79. Mario Sotelo says:

    I wonder if Apple will accept legal liability when hackers discover how to use this form of ARP spoofing to get into merchants, and other systems with their Iphones.

Leave a Reply

Your email address will not be published. Required fields are marked *