Hacker News new | ask | show | jobs
by sneak 2014 days ago
Client IP is city-level geolocation. It's sent with every communication to Apple, necessarily, because Apple has not embedded Tor into their OS.

AppleID (which you have stipulated) + timestamp (obvious) + client IP (necessary for a TCP/UDP connection) on inbound App Store requests is travel history, because client IP = city. It's quite simple.

Each time you open the App Store not on a VPN, Apple knows which city that Apple ID holder is in.

Additionally, the App Store sends the device serial number to Apple (per Apple's disclosures), so the device serial number is associated with your Apple ID.

The device maintains a persistent, serial-number-linked connection to Apple at all times (APNS) for receiving push notifications. This device-serial linked connection involves Apple seeing the client IP (and thus city) as well. Because Apple has linked the device serial with your Apple ID via the App Store, the persistent, 24/7 APNS connection allows Apple to track which client IP (and thus city) is in use by which AppleID, in real-time, whenever the device is on and connected.

I would appreciate it if you stop systematically responding negatively to so many of my comments. It feels like a pattern of harassment based on my identity to me, rather than you sincerely engaging with what I have to say.

2 comments

Not only that but any time any app gets your meter-accuracy GPS location, Apple also gets it to use for their AGPS service, and (unlike every other AGPS service I've seen) there is no way to turn it off. This information gets sent with an "anonymized" identifier to prevent spoofed requests, but this is easily correlated with the other Apple ID tagged requests they get from the same device.
I’m only responding when you make false claims, as you have done here.

You have no proof that Apple is recording people’s travel history, only speculation about how they could be.

It’s a lie to say they are.

Ahh, I understand you now.

Perhaps that you do not realize that storing client IP logs is standard practice for all internet services, and indeed without special and custom engineering effort is necessary for preventing brute-force attempts and denial of service as well as other types of abuse.

Any system as vast and reliable as APNS or the App Store is logging client IPs (and is thus logging approximate client location).

The data is absolutely being stored.

Anyone who doesn’t embed Tor for all communications, is recording your travel history?

First off, this is still simply false.

It may be technically possible that they are in fact reconstructing identifiable location history for individuals.

It’s also possible that they do what they say they are doing, which is to anonymize as early as possible and not use data for this purpose.

They could easily be keeping these logs separate, and disposing of them in a timely fashion, and not attempting to use them to analyze individual’s locations.

You are clearly technically competent enough to know that either scenario is possible (as well as many others).

Therefore you know it is not true to say that Apple is ‘recording you travel history’ in the absence of additional evidence.