Thank you for the clarification!

You cannot provide a large list of unrelated applications since Apple rejects that during app review.

It does not need to be a large list though I think? You just need a small list that is very discriminative and adds enough additional entropy to uniquely identify you in combination with the other data leaked.

And this was heavily exploited by Facebook before Apple patched it

I just don’t think it’s an effective way of solving the problem.

And a data broker/aggregator can purchase such data from many (e.g. thousands) of apps and aggregate it, then sell it.

[0] https://old.reddit.com/r/ios/comments/aib10i/in_china_ios_al...

Problem is there's no way for users to actually know that. iOS has no "this app can't reach the internet" indicator, so the whole guarantee is invisible. I even had people assume the opposite — app reads your whole library, therefore it must be uploading it somewhere. Exactly backwards.

But yes, agreed it should be everywhere.

This is the Apple mindset. Make things easy. Do not make things complicated.

Fingerprinting is extensively used and can't be defeated without a decent hit to browsing experience. Mullvad and Tor browser are likely the best at anti-fingerprinting.

The only completely reliable way to avoid this tracking is by not visiting websites with fingerprinting. A tool that can help with this is LibRedirect which redirects you from sites like Twitter to privacy front ends like xcancel.

The extensive web tracking is detrimental to privacy, but it doesn't compel you to add additional PII like phone numbers, which is much worse than cross-site tracking for a surveillance capitalism threat model.

If internet access wasn't granted by default, a lot more apps would function without it.

Many other apps wouldn't exist at all, because their only reason to exist is to spy on users.

Even if it's not the most effective way to raise awareness, it does put pressure on developers to be explicit about the connectivity requirements with users. It would also be a great way to audit an app's local-first / offline-first claim without having to do a network packet capture.

Want telemetry? Send it through Apple and Google. Given Apple's late history and latest trends in Android development, I see them both favoring this approach.

Apple could refuse to publish them, then. Isn't that why we are forced to go through the App Store? Because Apple ensures every app there works in the best interest of the user?

I have not spent a lot of time thinking about why certain things like 50 apps install queries, boot volume timestamps, etc are provided to developers. But I think Apple will close these loopholes.

Also love the idea of outbound network connections being disabled by the user per app

> Loupe also builds for macOS. The Mac version is mostly complete, but a few things still need work before it's polished.

And nothing stops from using reset it every day.

I just flat out think this is bullshit

More APIs, less friction selling stuff, business presence right on the homescreen.

You could of course disable network access to Play Services, but at least for me that broke a bunch of apps or made them unreliable.

What AOSP ROMs need besides the network permission toggle is IPC scopes functionality, akin to storage scopes.

I got that feeling just seeing the title use "native" as a synonym of "not a website".

So your partner only needs to have had 1 single app from the list that sells user data to a data aggregator for this to work. They do not need to have installed some special app.

Here's a random Slate article about apps getting your data and selling it to aggregators/brokers, who sell it to third-parties (you, or I, could be one of those third parties).

> How Shady Companies Guess Your Religion, Sexual Orientation, and Mental Health And sell that data to the highest bidder.

https://slate.com/technology/2023/04/data-broker-inference-p...

https://en.wikipedia.org/wiki/Stalkerware

Any way to reset it as an end user? (Not enough awareness of the issue for search engines to find much.)

https://www.npr.org/sections/alltechconsidered/2014/09/15/34...

It’s crazy to me that people are being so skeptical of the idea. A lot of people share their logins freely with their spouses. I have never done it nor would I condone it, but it would be trivial for me to install spyware on the devices of many people I know, because they rightfully trust me. Not only do I know some of their device passwords¹, being “the computer guy” I could just outright ask for it or get them to input it anywhere while fixing some issue they have.

¹ And many more I have forgotten, because I make it a point to not record them, even mentally.

iPhone

They also added the sensors permission.

Non-multiplayer games, clock, camera, contacts, phone, text message, file explorer, keyboard, launcher, notes, document viewer/editor, image viewer, audio recorder...

Most of the apps on my phone do not need internet access.

I am against cars for the most part, but I can’t just get rid of my car. In this case, I can’t get rid of Slack (and other apps) because of work and unfortunately I do not work at a company that will buy me a work phone for work things.

Ultimately this has to start at a more root level. We need to claw back privacy.

Fighting devs being able to make money in this manner is not dissimilar to getting made a drug dealers. As long as users want their product, they will sell the product.

The only way to prevent malicious apps from affecting your privacy is to not install them or not give them network access.

(Yes, you can disable network access to Play Services, but it sometimes breaks things and the general point of IPC as a hole still stands.)

In the U.S., device setup time (to the second) very conservatively gets you clubbed into a single group of 100 individuals as an "advanced persistent threat" tracker. Even compressing activations to "80/20 during business hours" the math kindof maxes out at a pool of ~5 people, and assuming worst case "20x" of that still means you're still pretty darned identifiable.

If you get ~6-8 more bits of entropy (eg: Device Type + Capacity is easily 2-3 bits, and Time Zone is probably another 2-3 bits) you're cooked!

They give that one completely up to businesses, then, to devs. They also thought they should let an app maker prohibit screen recording, which might promote development since it protects revenue of e.g. subtitling apps as one example. But end result is you even end up with a black screen when recording the iPhone Mirroring app from a Mac.

Apple owes us a better balance here. iCloud Private Relay for all apps (why only Safari?! and Mail and HTTP) as a start, and plugging some of the privacy holes Loupe exposes. They don’t want us abusing free trials I suppose.

Folks brings up 'IPC' as if this is some chink in the armour in AOSP. It isn't. 'Apps' pretty much on most consumer OSes can 'IPC' their way with other co-operating apps to 'achieve' network access from behind a firewall, just the same.

> since many apps communicate with Play Services and as far as I understand (but I may be mistaken) Play Services does work that involves internet access on behalf of other apps

If the OS or its privileged component will fchown the socket to the origin app, think the INTERNET permission will be enforced as expected.

But if you can get actually get this data, maybe try to do this on yourself and write a blogpost about it. I highly doubt you’ll be able to.

To make it worse, Apple's naming undermines consciousness about this issue, since they have an option to block cross-app/site tracking (which IIRC blocks access to the advertising identifier), but called it "Allow Apps to Request to Track". A lot of people seem to hold the belief that disabling this option blocks all in-app trackers. It just blocks one way to correlate, but as this app shows, there are other ways to correlate (as well as correlating server-side using IP addresses, etc.).

On this topic, I somehow missed that Apple added a generic URL filtering API to macOS/iOS 26, which extends Safari filtering to the whole OS (well, as long as apps are using Apple's APIs). It's not perfect, but a nice addition to DNS-based blocking:

https://adguard.com/en/blog/apple-url-filter-system-wide-fil...

The author of Wipr added support to Wipr 2 as an extra in-app purchase:

https://kaylees.site/wipr2-whats-new.html#filtr

Aside from technical methods to address this, all this in-app tracking must be a violation of the GDPR, no? I can't imagine this all falls under legitimate interest.

Edit: It's not a last modified timestamp, it's a volume creation timestamp: https://github.com/mysk-research/loupe/blob/2262efd4456ecba8...

If Apple wanted to provide this willingly they would. That its only available in China due to government regulation tells you all you need to know.

That said, I'd love to have a new "Internet access" permission for apps, so users had the choice. Perhaps even separate "Allow iCloud" and "Allow Internet" but that's probably too granular for Apple's taste.

And yes, having the ability to deny any app network access on iOS would be great.

That said, I agree with the rest of your point - you’re not going to go to a developer and offer them $100 for this data on a person (and if you could, you’d still need to tell them which person, which if you could do you could just get the data yourself)

Probably, but we're gonna have to wait for the courts to weigh in for a definitive answer.

Same with the very popular pay-or-accept-tracking model. An Austrian court found it illegal, but we'll probably have to wait for a case to make it all the way to the ECJ.

If you use a closed source browser. That’s the kinda shit they do.

If you want something less disruptive for isolation, there's Private Space. What I like is that this can stop apps there from working in the background on stock Android as well.

I have no idea if this is what already happens, but I feel like it might be. (Why would each app have all these network connections when the system could just manage it instead?)

YouTube used to be separate domains for ads and then it got merged together so that you can’t block the ads network wide without blocking YouTube videos.

They were designed so multiple people could use one device.

Some people use them to separate identities or contain apps they view as bad. I'm not sure if the efficacy of this.

Grapheneos improves them significantly https://grapheneos.org/features#improved-user-profiles

https://grapheneos.org/features#improved-user-profiles