Apple’s grudging accommodation of European antitrust rules by allowing third-party app stores on iPhones has left users of its Safari browser exposed to potential web activity tracking.
Developers Talal Haj Bakry and Tommy Mysk looked into the way Apple implemented the installation process for third-party software marketplaces on iOS with Safari, and concluded Cupertino’s approach is particularly shoddy.
What kind of Apple propaganda is this?
If you’d read the article, you’d have realized it’s specifically because of a bad implementation by Apple of their URI scheme for handling links.
They’re literally suggesting users use Brave over Safari because it isn’t susceptible to cross-site scripting in the same way.
They urge iOS users in Europe to use Brave rather than Safari because Brave’s implementation checks the origin of the website against the URL to prevent cross-site tracking.
This is anything but Apple propaganda. It’s literally calling Apple out on a huge failure of their own design.
My comment was in jest.
Then I retract my statement and hope you have a good day.
Let’s agree on that 🤝 and thanks for the explanation anyway 🫡
Apple – which advertises Safari as “incredibly private” – evidently has undermined privacy among European Union Safari users through a marketplace-kit: URI scheme that potentially allows approved third-party app stores to follow those users around the web.
I don’t see Apple deliberately sabotaging their platform to maliciously comply and blame the regulation for making users less safe. This was probably an error caused by quick development to comply within a set timeline that will be resolved in the future through software changes.
I’m not so sure. The DMA says they have to allow others to have access to the same platform features they have access to. That means Apple can opt into either no longer doing data collection in their app store, or they have to allow third party app stores to do the same kind of tracking Apple does.
They could’ve chosen to simply stop tracking users, but allowing third party app stores to track users is clearly more profitable. Plus, they get to spread FUD about the big evil EU forcing them to let other companies do the shady stuff they do!
On the other hand, this only applies to app stores, and practically nobody installs third party app stores, and even then the app stores are generally not that interested in this kind of tracking. It’s a big nothingburger caused by Apple’s laziness and their hostility to fair competition.
Yeah that’s just some real tin foil shit
I’d say it’s probably an oversight. I don’t want to downplay this, it definitively needs to be addressed in some way. But it’s not like there are many marketplaces out there yet (so far the only one I know of is AltStore PAL, and I doubt the creator is out there to track a bunch of people’s web activities).
I guess if you download something claiming to be Safari on a third party app store, you get what you deserve??
How else does third party app support lead to a Safari security hole?
🤖 I’m a bot that provides automatic summaries for articles:
Click here to see the summary
Apple’s grudging accommodation of European antitrust rules by allowing third-party app stores on iPhones has left users of its Safari browser exposed to potential web activity tracking.
Developers Talal Haj Bakry and Tommy Mysk looked into the way Apple implemented the installation process for third-party software marketplaces on iOS with Safari, and concluded Cupertino’s approach is particularly shoddy.
A website offering an alternative software marketplace can include a button that, when tapped in Safari, launches a marketplace-kit: request that is handled by a MarketplaceKit process on the EU user’s iPhone.
Apple doesn’t allow third-party app stores in most parts of the world, citing purported privacy and security concerns – and presumably interest in sustaining its ability to collect commissions for software sales.
Second, Apple’s MarketplaceKit – its API for third-party stores – doesn’t validate the JSON Web Tokens (JWT) passed as input parameters via incoming requests.
Back when Apple planned not to support Home Screen web apps in Europe – a gambit later abandoned after developer complaints and regulatory pressure – the iGiant justified its position by arguing the amount of work required “was not practical to undertake given the other demands of the DMA.”
Saved 77% of original text.
