Hacker News Reader

Comment by webmobdev | Hacker News Reader

> but this is part of the reason I like that Apple makes (practically) all purchases run through them.

I vehemently disagree - in the name of "protecting privacy" Apple has been fooling users to believe that only Apple can be trusted with user data, and the biggest lie they sell is that they don't do anything with your data, unlike other corporates. From crippling Safari by allowing full cookies by default, and claiming to block trackers and browser fingerprinting (which a Google study itself has busted), to collecting user data in "anonymised" form Apple has been disingenuously mining its user's data with users given no choice.

View on HN

Very strange to call Apple out as being a liar and can't be trusted with user data because of Safari's cookie and tracker policy.

Because of all the browsers they have led the way in reducing the ability for advertisers to track you.

Can Apple be trusted tho?

"Apple dropped plan for encrypting backups after FBI complained"

https://news.ycombinator.com/item?id=22106536

> Because of all the browsers they have led the way in reducing the ability for advertisers to track you.

Certainly when compared to Chrome, but Firefox? Brave? Tor Browser? No. Which is why it's so unfortunate that you can't get a real third party browser for iOS.

Tor Browser is terrible for security, and I don’t think Firefox started doing tracking prevention before Safari did. I may have the timeline wrong though. As for Brave, well. They have a different business model but I’m not entirely clear on what their technological innovation is?

> Tor Browser is terrible for security

[citation needed]

The exit node can't do anything your ISP can't. Meanwhile you can choose the exit node, which you often can't for your ISP, which means you can choose one operated by someone you trust.

And even if you don't, what are they going to do to a TLS connection?

> and I don’t think Firefox started doing tracking prevention before Safari did

Tor Browser is based on Firefox, so the anti-fingerprinting work they do regularly gets merged back into Firefox proper. Moreover, Firefox has had some of the best anti-tracking addons since forever, but you can only have those if you actually have Firefox.

But Tor Browser is still more stringent about certain things, e.g. they always reset the window to a standard size when you open it so the page can't track you based on that, which Firefox itself doesn't do because it's kind of annoying to the user. Which is another reason why there is benefit in having multiple browsers -- they each have different trade offs.

> They have a different business model but I’m not entirely clear on what their technological innovation is?

They do a lot of good work on ad blocking, and are willing to be a lot more aggressive about it, since it aligns directly with their incentives.

>And even if you don't, what are they going to do to a TLS connection?

You misunderstand me. Tor Browser is based on Firefox ESR, which means it lags with security updates: https://medium.com/@thegrugq/tor-and-its-discontents-ef51648...

Tor itself is not what I was referring to, although it has its problems as well, mainly that it's extremely identifiable. Tor is not a good idea for most people to use full-time.

The rest of this doesn't really answer my question about Safari vs Firefox, and I'm pretty much uninterested in appeals to Tor Browser as something that should be universally adopted.

How is tor extremely identifiable? How does the dark net manage to stay up if it’s identifiable?

Not in the sense that you can de-anonymize people easily (though easier than you might think) but that it makes your traffic identifiable as Tor traffic, which can be worse than the anonymity benefits. VPNs (setup with WireGuard, possibly via Algo, though never a commercial provider) are a better choice for most users.

> You misunderstand me. Tor Browser is based on Firefox ESR, which means it lags with security updates: https://medium.com/@thegrugq/tor-and-its-discontents-ef51648...

The main point your link is making is that Tor Browser is purposely a monoculture to avoid fingerprinting and monocultures are bad for security because it gives attackers somewhere to concentrate their attacks. You're using this to argue in support of Safari as a monoculture on iOS?

Meanwhile, Tor Browser is based on Firefox ESR, but that doesn't mean they can't backport patches, which they regularly do.

> Tor itself is not what I was referring to, although it has its problems as well, mainly that it's extremely identifiable. Tor is not a good idea for most people to use full-time.

It's extremely identifiable as Tor, but that's exactly why most people should use it more of the time, so that it isn't regarded as suspicious when somebody has a more serious reason to.

You didn’t read the whole thing if that’s what you drew from it. Safari on iOS is used by everyone with an iPhone, Tor Browser is used (typically) by people with something to hide or a lot at stake, which makes it a singularly desirable target that is especially dangerous because it doesn’t receive security patches at the same speed as mainline Firefox. The monoculture is only part of the problem, the bigger part is using a browser with an inferior security model and leaving it hopelessly out of date. Using Tor with an up to date version of Chrome is much less hazardous to your health, and I really recommend that approach if you want to use Tor.

> It's extremely identifiable as Tor, but that's exactly why most people should use it more of the time, so that it isn't regarded as suspicious when somebody has a more serious reason to.

No. That’s just not going to happen, for a number of reasons, and hoping it does happen is not a strategy for helping the significant number of people who are already using it because they do have a serious reason to, and are consequently at risk because of how vulnerable their browser is.

Do you have evidence of anything being mined?

Apple’s careers page has job listings indicating they are using an industry standard data warehousing, ETL, star schema etc. user analytics stack for something. I don’t think any specific claims they made about privacy are false (they have many different products and services), but they are definitely doing some kind of data mining.

Apple does product analytics.

Whenever you install/update iOS/OSX they specifically ask you if you want to send anonymised data to Apple which details how you are using the OS. They couldn't be more upfront and clear about it.

And when I was working at Apple years ago they were using a very old and clunky SAP system for all of their customer purchases. It would be pretty common sense to ETL this to a data lake in order to do reports e.g. which apps are popular.

> in the name of "protecting privacy" Apple has been fooling users to believe that only Apple can be trusted with user data

Even if Apple can’t be trusted with my data, I’d rather that it lie with them.

> and the biggest lie

According to?

> From crippling Safari by allowing full cookies by default and claiming to block trackers and browser fingerprinting

It works, even if it’s not perfect and it’s certainly better than nothing or Chrome’s defaults.

> a Google study

/cough

> Even if Apple can’t be trusted with my data, I’d rather that it lie with them.

May I ask why? If hypothetically Apple isn't trustworthy with your data, why would you prefer them over any other company with a hypothetically similarly-bad level of trustworthiness?

Have you even seen what happens when X is reported for any other company versus when the same X is reported for Apple?

This sounds like privacy fear mongering What part of Apple’s business model would make them monetize user data through ads?

> What part of Apple’s business model would make them monetize user data through ads?

The same part that has Microsoft doing it -- they can make additional money from it regardless of whether the user is paying them already.

Which isn't to say that Apple is actually doing it, but if they're not, that's not why.

Reply on news.ycombinator.com