At the time, Uber was dealing with widespread account fraud in places like China, where tricksters bought stolen iPhones that were erased of their memory and resold. Some Uber drivers there would then create dozens of fake email addresses to sign up for new Uber rider accounts attached to each phone, and request rides from those phones, which they would then accept. Since Uber was handing out incentives to drivers to take more rides, the drivers could earn more money this way.
To halt the activity, Uber engineers assigned a persistent identity to iPhones with a small piece of code, a practice called “fingerprinting.” Uber could then identify an iPhone and prevent itself from being fooled even after the device was erased of its contents.
This really doesn't match up with how the conversation/outrage is playing out on Twitter right now. People seem to be interpreting this as "Uber continues to track your location after you have deleted the app," when what really happened seemed to be "If you delete Uber and then reinstall it on the same phone, Uber knows that it's the same phone."
See for example this Tweet, with hundreds of retweets and lots of verified replies:
I'm genuinely curious how that would even work on the technical level. As an app developer, I'm not making the connection here as to how iOS would even allow that.
To me it seems like this is mischaracterized to make it sound worse than it is. Can someone explain why people are making a big deal about this practice?
Its because its fashionable to beat the horse that Uber is a terrible company led by a terrible man. I personally am no fan of Uber or Travis, but I do get disgusted sometimes when the media hypes certain perceptions to an inappropriate degree.
So for all means continue to investigate the seemingly terrible and anti-women culture and the fraudulent stealing of Technology from Google. But like you said, don't mischaracterize other facts to make them sound more terrible than what they really are.
Because it violated their agreement with Apple and accessed private APIs, infringed on user privacy, and they geofenced the behavior to try to sneak it past app review. It's another example of Uber knowingly being evil.
That's true, but there's a bit of live by the sword, die by the sword here. Uber is no stranger to the power of propaganda with their campaigns on the sharing economy, unions, regulations, etc.
But how do you judge uber if you can't trust journalistic integrity? The very people you trust to think for you are unqualified - which leads me to believe so is your opinion. This seems to be the problem with Fake News.
One of the risks of refusing to talk about services is that you're at the mercy of games of telephone. People describe what you're doing to journalists who carefully dilute anecdotes and details to obscure their exact source. Then you don't comment directly on the system because it's a secret, and here you are.
The problem for Uber is that they /are/ scummy. They proudly bend every possible rule to their advantage. It's easy to believe the worst about them.
The concept of fake news Rose from one guy making shit up for ad money. The whole ordeal about how fake news is this sinister plot to disinform is a disinformation effort in itself. There's a big difference about reporting while being misinformed vs disinforming or to harness views.
what i'm saying is that people doing misinformed reporting causes people to not trust the news at all. and let's cynical people (trump) label all journalism as fake news
I think it takes a certain kind of individual to trust everything they read at face value without getting multiple points of view on an issue and researching their own facts. Not saying we shouldn't hold reporters accountable to higher standards but we live in a time where everything is rushed and pumped out as "content' for ad revenue.
Basically, they created a unique 'fingerprint' of the iPhone. It was unique enough that even if you reinstalled the app, the fingerprint would still be the same. This was done, ostensibly, to prevent people from scamming them by reinstalling the app and coming over as new users? But they already have the phone number, so I don't understand the point.
In the article this is in the context of fraudsters buying used phones to fake rides in China and take advantage of incentive programs to make money. So they want to track these devices as they change hands.
changing "tracking" to "identifying and tagging" and changing "even after its app had been deleted from the devices, violating Apple's..." to "even after its app had been deleted and the devices erased — a fraud detection maneuver that violated Apple's..."
In a really long article like this which is probably under some time pressure to publish, there's almost always things that seem clear to the author aren't to the reader. This is a standard clarification bug fix, and tweets were over an hour after the article was published - enough time to gather feedback and realize the need for clarification.
At least in this instance, the only specific narrative being pumped is the one that journalists are always pumping a specific narrative on touchy subjects.
The tweet responses:
> @MikeIsaac 32 minutes ago
> Since the line about fingerprinting is being misinterpreted(though it is explained later in piece) adding language up top to better explain.
> @MikeIsaac 31 minutes ago
> appreciate Technical community's concerns about how It is presented. Uber was not tracking location after device wipe (which I never said).
> @dangillmor 30 minutes ago
> What exactly were they tracking? Not entirely clear (at least to me).
> @MikeIsaac 29 minutes ago
> ID-ing devices. so if I steal a phone and wipe it, they can still determine I had that phone and used it to defraud uber, using other data
That's a clever media hack. Using provocative headlines and misleading lead to get clicks and shares, but using a separate medium (Twitter) to get away with it.
Clever, but it's disappointing that even NYT is turning into this madness.
They've also updated the article text now: "To halt the activity, Uber engineers assigned a persistent identity to iPhones with a small piece of code, a practice called “fingerprinting.” Uber could then identify an iPhone and prevent itself from being fooled even after the device was erased of its contents."
Note that this was at least 4 hours after the outrage on Twitter started. Seems like a very intentional, well-calculated strategy indeed.
> Note that this was at least 4 hours after the outrage on Twitter started. Seems like a very intentional, well-calculated strategy indeed.
That comment seems a bit disingenuous. i.e. it's entirely possible it takes a journo 20 seconds to post a correct to a twitter account he/she controls and 4 hours/days/weeks to get his/her editors to sign off on the same correct and the change pushed to the news website.
Large news sites like the NYT have editing procedures and internal hoops to go through. This isn't just joe shmo's blog that is updated at a whim. I've written freelance articles with editing periods of months, you can imagine that it's a lot harder when it's news.
Kind of reminds me of the "motte and bailey"[0]. The misleading but technically accurate claim gets all the play and all the reaction. The author goes on Twitter and says "golly gee I didn't mean for you take it like that, all I really meant was [much weaker claim that wouldn't have gotten all this attention in the first place]."
The correction bounces around but never takes hold the way the initial claim does and people quietly go on believing their initial interpretation. Sad.
100% sure that all decent banking app use device fingerprinting. 100% sure that it is not breaking the rules and it is really important that they keep doing it.
While you're right that a lot of FinTech applications do use fingerprinting, it is absolutely against the rules. It's rather annoying from a mobile security perspective but given the rampant abuse of persistent device identifiers on Android, I understand and appreciate Apple's stance here.
> While you're right that a lot of FinTech applications do use fingerprinting
Do they really? [Citation needed] very much here. Which fintech app fingerprints devices? What would even be the point of doing that. You can persist a token in the keychain for that which is enough unless you are devious.
If they're doing this on iOS, which is where it's interesting (in that it violates Apple's policies), they have a perfectly good 2-factor solution already present -- your finger.
The first time you use an app you have to enter your user name and password and that is stored in the secure enclave that not even the operating system had access to.
When the banking app request validation, you use your fingerprint to authenticate and the secure enclave sends the username and password to the app. The fingerprint scanner is connected directly to the secure enclave.
When you sell your phone, you go through the process of erasing your phone, the encryption key is destroyed and your fingerprint is no longer valid.
To halt the activity, Uber engineers assigned a persistent identity to iPhones with a small piece of code, a practice called “fingerprinting.” Uber could then identify an iPhone and prevent itself from being fooled even after the device was erased of its contents.
I also interpreted "track" as "report geolocation data," but that's not what the reporter means, and honestly the reporter's meaning is more consistent with, e.g., "this website is tracking users" or "Do-Not-Track".
What goes around comes around. Reminds me of that time when Uber would issue throwaway credit cards and burner iPhones to people, so that they would order and cancel Lyft rides...
>" Some Uber drivers there would then create dozens of fake email addresses to sign up for new Uber rider accounts attached to each phone, and request rides from those phones, which they would then accept. Since Uber was handing out incentives to drivers to take more rides, the drivers could earn more money this way."
Could someone explain the logic behind how a driver requesting rides benefited them? Did the drivers fake the ride and pay for it themselves? Was there a cash incentive where they were reaping enough to offset paying for the fake rides themselves and profit hanseomely? Is that correct?
Yes, in the earlier days in each city, they (just pulling numbers from thin air) do something like pay a minimum $20 for each trip if you complete 5 trips within an hour without cancellation. Helps to kickstart the driver supply.
Interesting and somewhat ironic to think that Uber had to put countermeasures in place against drivers engaging in their own questionable version of "growth hacking."
Give a reference code to your other phone. That phone now has a credit for their first uber ride or first 20 dollars, something like that. Then take the ride on your driver phone. You get paid from the second phones credit but dont spend any money yourself
It was in one of the 10.3 betas but was removed. I don't think it can be deleted reliably without losing data if iCloud keychain is enabled, e.g. another device might still have the same app or share the app group.
Thanks, I just remember that when I stored the items the documentation recommended that one put in the keychain list, then deleted the app off of an actual device for testing purposes and reinstalled the app on that same device, all those items would still be there so I (wrongly in hindsight ) assumed it was the desired behavior by Apple otherwise other developers would have complained.
Apple made the standard API return garbage in iOS 6, and the API would probably trigger an analysis error iTC, so if they were getting the MAC address it was via much sneakier means.
I have heard that it is quite possible. Supposedly if you measure enough characteristics of the phone, the combination of such characteristics is enough to uniquely identify a phone. May be able to poll such information you measure with those measured by other apps.
There are quite a bit of SKUs, but not enough to make the phone unique itself. You'd ultimately need something more special to do so, such as the MAC address.
It's not clear if such code would work today on the latest iOS version but maybe. They probably used a private API to do so, and that itself was obfuscated in the compiled binary such that apples automatic analysis would fail to catch it.
iPhone model (2 orders of magnitude of possibilities)
Device storage -- increases entropy with iPhone model but still not that much
Device name -- easily changeable by scammer, so not enough
iOS version -- changes over time, not great for a long term fingerprint but might help short term
IP address -- short term attribution ok, but not against scammers. People in china have multiple sims very often so even relying on carrier isn't enough
Cell phone carrier -- same as above
Other apps installed -- as of iOS 9 you have to pre-declare what you want to be able to query, and that's subject to App Store review. It does help give a fair bit entropy. This also can change at any moment. But if you're wiping the device constantly, they might not be installing any apps.
In advertising / web, you want to attribute across sites / installs on a short time basis. You have plugins and their unique version numbers, OS versions and all their attributes, browsers version, fonts installed, etc. Way more variation than iPhones.
To defeat scammers erasing their phone constantly it's actually much harder, and likely needs something a bit more unique.
Each variable you mentioned is not unique, but put them all together and now you are talking. And then apply a heavy dose of statistics and machine learning on top of THAT.
Especially since the behavior/activity of the phone could be suspicious as well.
You also don't need to be 100% accurate all the time. The point is to minimize the damages done to you by scammers, not reduce it to 0 which is impossible.
>request rides from those phones, which they would then accept.
Rider and drivers are randomly assigned. I am not sure if you can choose your driver. Not sure if all these drivers in China made a huge group to benefit each other
It's an APP that has been on your phone at one point. An APP by a company that is peak (maybe valley would be better) SV when it comes to ethical standards. Uber probably has a fingerprinting system that is on par to Google/Facebook and maybe even puts them to shame (maybe paints them in a better light).
I imagine that they wouldn't really have much difficulty tracking you through ad tech, another APP, or some other Cult Of Free system that is willing to sell database access.
At the time, Uber was dealing with widespread account fraud in places like China, where tricksters bought stolen iPhones that were erased of their memory and resold. Some Uber drivers there would then create dozens of fake email addresses to sign up for new Uber rider accounts attached to each phone, and request rides from those phones, which they would then accept. Since Uber was handing out incentives to drivers to take more rides, the drivers could earn more money this way.
To halt the activity, Uber engineers assigned a persistent identity to iPhones with a small piece of code, a practice called “fingerprinting.” Uber could then identify an iPhone and prevent itself from being fooled even after the device was erased of its contents.