Hacker News Reader

Comment by JohnFen | Hacker News Reader

> The good news is that Apple claims that their system actually does provide strong privacy, and that it accomplishes this using clever cryptography.

But that does nothing to protect your privacy against Apple.

I already have to make sure that I disable WiFi and Bluetooth when I enter commercial establishments. Now I have to stop using Bluetooth whenever I leave my house?

View on HN

Why do you do that? All Apple devices generate randomized MAC addresses for networks that they haven't connected to, so they shouldn't be able to track you. In addition, no other actors will be able to gain useful information from the bluetooth pings, they simply forward the encrypted data to Apple. All they can tell is that an Apple device exists nearby, but not who owns it or if they've seen the same device before.

If you're talking about apps on your phone tracking you by looking at nearby wifi networks, then Apple also fixes that in iOS 13.

Did not know this. I figured all those wifi connections I get near stoplights were slurping up mac addresses to track people. I wonder if it generates a mac address every single time or just upon first interaction with a wifi network it doesn't know about?

Apparently the initial implementation (iOS 8) randomized it every time the screen sleeps or wakes. I wasn't able to find any recent documentation detailing the current behavior - probably similar?

Beginning at the top of page 41: https://www.apple.com/business/site/docs/iOS_Security_Guide....

``` iOS uses a randomized Media Access Control (MAC) address when conducting Wi-Fi scans while it isn’t associated with a Wi-Fi network. These scans could be performed in order to find and connect a preferred Wi-Fi network or to assist Location Services for apps that use geofences, such as location-based reminders or fixing a location in Apple Maps. Note that Wi-Fi scans that happen while trying to connect to a preferred Wi-Fi network aren’t randomized.

.... [continues with all the cases] ```

> Why do you do that?

The short answer is because it makes me feel better.

The long answer is that it prevents tracking my movements within a store. Stores appear to be increasingly installing and using such trackers, and I do not wish to be tracked.

Not being able to be identified personally, or to be identified as the same person who was there last week or that I also went into other stores isn't sufficient to me.

I'm not sure why this is downvoted.

WiFi can be used to track most people's phones because they'll have personally identifiable networks they're set to auto-connect to. Randomizing the Mac address is not enough to prevent tracking in that scenario.

Unless Apple has some way to guard against this that I've never heard of? But I don't think they do.

JohnFen's root comment is totally wrong (Apple is encrypting your location so even they can't read it), but on the WiFi side of things this seems spot on to me. Turn your WiFi off when you leave your house.

...Unless you have a private wifi AP you connect to. Then your device is individually identifiable and trackable.

In addition, I believe apps that use ibeacon technology can respond to specific ibeacons. But I think your phone can become a beacon.

I suspect (but am not certain) that if your phone is running app XYZ it can talk to other phones running XYZ through the XYZ registered beacons (if location services are on for app XYZ).

Also, just for an interesting example of where some of this stuff can go... The target app will change the price of an item if it finds you are in a store (search "target app price switch").

It gets worse: if you turn off wifi/bluetooth in control center, it only disconnects, keeping the radio active.

1: https://support.apple.com/en-us/HT208086

As it says on the page, this is to make sure a bunch of things still work (eg. you wouldn't really thing you need to keep Bluetooth enabled to use the pencil). Maybe the toast text "disconnecting nearby Wi-Fi until tomorrow" could be a little clearer.

From day one I’ve wanted a way to disable the automatic-reenabling feature.

Use airplane mode then enable each one individually?

You can use shortcuts to disable and enable things.

I use one labled ‘Car’ that turns off wifi, enables cellular data and BLT for the stereo and terminates after it ensures my (non-DNS) VPN is on. The other, ‘Home’ turns off cellular data and BLT, wifi on and again ensures my VPN is still active.

Also if you’ve got anything newer than a iPhone 6, you can 3D touch the settings icon to a pop-up menu to Bluetooth, Wi-Fi, Cellular Data and the Battery sub-menus. From there it’s an extra tap or two to disable stuff completely.

Formatting is likely terrible, I mobile-phoned this in..

> But that does nothing to protect your privacy against Apple.

Absolutely not true. This is E2EE. This is the whole point of the article.

If this "no privacy from Apple" widget is using separate low power or parasitic power circuitry, it is entirely possible for it to be running and operational in a switched off phone with a battery on 0% charge.

Buy a Nokia, perhaps?

Did you read the article? The author discussed exactly how they are able to hide sensitive data from Apple.

Reply on news.ycombinator.com