🚨 New Findings:
🧵 1/6
Apple’s analytics data include an ID called “dsId”. We were able to verify that “dsId” is the “Directory Services Identifier”, an ID that uniquely identifies an iCloud account. Meaning, Apple’s analytics can personally identify you 👇
2/6
Apple states in their Device Analytics & Privacy statement that the collected data does not identify you personally. This is inaccurate. We also showed earlier that the #AppStore keeps sending detailed analytics to Apple even when sharing analytics is switched off.
3/6
Apple uses DSID to uniquely identify Apple ID accounts. DSID is associated with your name, email, and any data in your iCloud account. This is a screenshot of an API call to iCloud, and DSID it can be clearly seen alongside a user's personal data:
4/6
The analytics data that the App Store sends to Apple always contain an ID called "dsId". We weren't sure if this was the same as the DSID, the ID that uniquely identifies an iCloud account. We confirm that they're the same ID.
5/6
This means that your detailed behvior when browsing apps on the App Store is sent to Apple, and contains the ID needed to link the data to you. We showed the extensive details that the App Store sends to Apple in this video,and it is all linked to you:
6/6
It is worth noting that the DSID is also sent by other Apple apps for analytics purposes.

You just need to know three things:
1- The App Store sends detailed analytics about you to Apple
2- There's no way to stop it
3- Analytics data are directly linked to you

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Mysk 🇨🇦🇩🇪

Mysk 🇨🇦🇩🇪 Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @mysk_co

Nov 12
🧵
1/7
During our research on link previews, we discovered that Instagram servers execute #JS code in links sent in DM. We contacted Facebook security team. They said it was expected behavior, no issue. We published the work. @TeamYouTube took down the video and sent us a warning
2/7
We appealed @YouTubeCreators decision. We argued that the video we uploaded to @YouTube was the exact video that we shared with Facebook security team. They concluded it was harmless. We discussed the issue with Facebook in a long exchange to convince them it was critical
3/7
Facebook team was adamant that that issue was harmless and expected behavior. We shared with Facebook that we would publish the video. They didn't stop us. The video was viewed 3300 times before @TeamYouTube took it down and later rejected our appeal
Read 8 tweets
Nov 6
🧵
1/6

Apple's Data & Privacy statement starts with the calming phrase "Apple believes privacy is a fundamental human right" then goes on to describe how the platform aggressively collects your data. You must accept the statement or stop using your iPhone.
#CyberSecurity ImageImageImageImage
2/6
It is true that there are options to disable personalized ads, but as this videos shows, usage data is still collected and sent to Apple even when these options are disabled:

3/6
Before you conclude that Apple is tracking its users, you need to understand how Apple defines tracking. In short, as long as data collected to track you is not shared with 3rd parties, it's not considered tracking. No, Apple is not tracking you, just keeping an eye on you 👀 Image
Read 6 tweets
Nov 3
🧵
1/5
The recent changes that Apple has made to App Store ads should raise many #privacy concerns. It seems that the #AppStore app on iOS 14.6 sends every tap you make in the app to Apple.👇This data is sent in one request: (data usage & personalized ads are off)
#CyberSecurity
2/5
As the user browses the App Store app, detailed usage data is sent to Apple simultaneously. The data contains IDs to map the behavior to a profile (redacted in the video). Data shown in the video is 152KB. Here's a log of the requests while using the app for 10 minutes: Image
3/5
The strange thing is that Apple introduced strict measures in #iOS 14.5 to prevent developers from fingerprinting users. Image
Read 7 tweets
Oct 12
We confirm that iOS 16 does communicate with Apple services outside an active VPN tunnel. Worse, it leaks DNS requests. #Apple services that escape the VPN connection include Health, Maps, Wallet.
We used @ProtonVPN and #Wireshark. Details in the video:

#CyberSecurity #Privacy
You can easily monitor the network traffic of any device using this simple method. You don't need a custom router for that. You just need a Mac and #Wireshark, and enjoy ✌️
I know what you're asking yourself and the answer is YES. #Android communicates with #Google services outside an active VPN connection, even with the options "Always-on" and "Block Connections without VPN."
I used a #Pixel phone running #Android13, its IP is 192.168.2.14 👇
Read 5 tweets
Oct 19, 2021
We prepared this video to illustrate why access to the accelerometer should get a permission in iOS. Unrestricted access to accelerometer data can breach user privacy. We used Facebook as an example in the video.

#Cybersecurity #Privacy #iOS

It's amazing what algorithms can extract from accelerometer data:
- Detect if you're walking, sitting, cycling.. etc
- Count your steps
- Figure your heart rate
- Find your precise location
- Analyze sound vibrations of your phone speaker and infer what you're listening to
The iPhone is equipped with a very accurate accelerometer. It helps algorithms achieve their goals with high accuracy.
Good news: iOS only allows apps to access the accelerometer when apps are active in the foreground
Read 9 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(