Categories
Mobile Syrup

Researchers found Apple apps still track users when they turn off analytics

While Apple champions itself as a privacy-conscious company, new research reveals several Apple apps collect detailed information about users, even when they turn off tracking.

The news should, unfortunately, not come as a surprise given previous research about Apple’s not-so-private privacy features. For example, Apple’s App Tracking Transparency, which supposedly lets iPhone users tell apps not to track them, doesn’t actually do that much. Now, research shows that the iPhone Analytics setting, which promises to “disable the sharing of Device Analytics altogether,” doesn’t do anything for Apple apps.

According to research shared with Gizmodo from app developers and security researchers Tommy Mysk and Talal Haj Bakry, several iPhone apps, including the App Store, Apple Music, Apple TV, Books, and Stocks, all ignore the iPhone Analytics settings and other privacy settings. Germany-based Mysk and Toronto-based Bakry work for the Mysk software company and frequently share research on the Mysk Twitter account and blog. Regardless of whether users turned these settings on or off, these iPhone apps would send the same amount of data to Apple.

For example, the App Store appears to harvest data for just about everything users do. That includes which apps they tap on, search queries, ads users see, and more. It also sent data about the device users have, including ID numbers, screen resolution, keyboard languages, and more. These data points are all commonly used for fingerprinting, a tracking tactic that gathers a bunch of data to create a digital fingerprint that can be used to track activity across apps and services. Other apps shared data about what users did in those apps, such as which stocks they viewed in the Stocks app.

Notably, the researchers tested other apps for Gizmodo and found that the Health and Wallet apps didn’t transmit any analytics data regardless of the settings.

Mysk and Bakry tested two iPhones, a jail-broken iPhone running iOS 14.6 and a regular iPhone running iOS 16. With the jail-broken iPhone, the duo was able to decrypt the traffic being sent from the phone and examine what was being sent. Part of why they chose iOS 14.6 was because Apple introduced the App Tracking Transparency feature in iOS 14.5, which included the prompt asking users if they wanted to allow an app to track them.

While they couldn’t decrypt the traffic sent from the iPhone running iOS 16 to see what data was being sent, Mysk and Bakry noted that the same apps sent similar packets of data to the same Apple web addresses as what they found on the jail-broken iPhone. Moreover, data was transmitted at the same times and under the same circumstances, and adjusting the various privacy settings made no difference. The similarities suggest that the regular iPhone was transmitting similar data to what the researchers could see on the jail-broken iPhone.

It’s possible Apple doesn’t use the information it receives if the privacy settings are turned on, but then why collect it in the first place? Moreover, Gizmodo notes that Apple’s privacy policy suggests the iPhone Analytics setting doesn’t work that way anyway. Moreover, Mysk and Bakry said third-party apps they test don’t send data when the analytics settings are turned off.

What makes Apple’s data collection particularly egregious is that the company has long promoted itself as the private option. Remember the massive billboards Apple put up around Toronto advertising how it stays out of your business? Anyway, Apple doesn’t think its tracking behaviour is actually tracking. As Gizmodo pointed out, Apple says its “advertising platform does not track you, meaning that it does not link user or device data collected from our apps with user or device data collected from third parties for targeted advertising or advertising measurement purposes, and does not share user or device data with data brokers.” Put another way, Apple’s tracking isn’t tracking because only Apple collects that data, which seems like a very Apple-friendly view of tracking.

Source: Gizmodo

Categories
Mobile Syrup

Fitbit Sense 2 Review: Running in reverse

Fitbit unveiled its newest smartwatch, the Sense 2, alongside the Versa 4 and the Inspire 3 fitness tracker back in August. Since then, both Apple and Google launched new smartwatches, with Google’s Pixel Watch largely stealing the show from Fitbit thanks in part to its inclusion of the company’s tracking tech.

That leaves the Fitbit Sense 2 in a lurch. At $399 in Canada, it’s about $50 cheaper than the base Wi-Fi/Bluetooth Pixel Watch. It’s also $100 more than the Versa 4, and $200 more than the Charge 5. One upside to this price is it’s less than the original Sense retailed for. The problem is that a lot has changed since then.

Previously, the Sense series was the pinnacle of Fitbit wearables – it offered the best tracking tech and a smartwatch experience. Now that the Pixel Watch exists, the Sense series doesn’t hold the crown for best Fitbit smartwatch. While it still offers the premiere tracking experience, it’s hard to justify paying as much as $200 more for the few extra benefits the Sense 2 offers. And if you’re looking for a smartwatch first, with the added benefit of Fitbit tracking, the Pixel Watch is a much better option.

None of that is to say the Sense 2 doesn’t have a place – it certainly does. Unfortunately, it feels like a more niche option, ideal for those who want Fitbit fitness tracking first and foremost, plus a taste of smartwatch functionality. Alternatively, it could be an option for iPhone users who want a smartwatch with fitness-tracking tech, but don’t want to go with the Apple Watch. Unfortunately, the Sense 2’s few smart features are further restricted in Apple’s smartphone ecosystem.

I could see the Sense series having a place as the ‘budget’ Google smartwatch (i.e. as a spiritual Pixel Watch Series-A), but that only works if the Sense series offers Wear OS and smart features like Google Assistant. The Sense 2, however, sports what can best be described as a cheap imitation of Wear OS, and abandoned smart features like Google Assistant that were available on its predecessor.

Specs

  • Connectivity: Wi-Fi/Bluetooth
  • Case: Aluminum
  • Dimensions: 40.5×40.5×11.2mm
  • Display: AMOLED with Corning Gorilla Glass 3
  • Sensors: Multi-path optical heart rate sensor, ECG, electrical sensor for continuous EDA, red and infrared sensors for SpO2, gyroscope, altimeter, 3-axis accelerometer, ambient light sensor, NFC, skin temperature sensor, GPS
  • Water resistance: 5 ATM
  • Smartphone compatibility: Android 8+ and iOS 13.3+

Thinner, sleeker design

One of the best overall improvements with the Sense 2 over its predecessor is the design. The Sense 2 is the same length and width as the original Sense, but is a fair bit thinner and lighter (although the Sense 2 is still heavier than the Pixel Watch).

Beyond that, the Sense 2 doesn’t really change much. It sports the same squircle shape as the original Sense. It’s got the same band mechanism too, which means if you loaded up on cool bands for the Sense, they’ll still work with the Sense 2. Fitbit did move the metal band used for electrocardiogram (ECG) measurements. Instead of wrapping around the edge of the watch, the Sense 2 moved the ECG band to below the glass so it wraps around the screen like a slight extension of the bezel. It makes for a bit of an odd look and, while I don’t think it’s bad, it contributes to the Sense 2 display appearing “deep” in the watch.

Fitbit Sense (left) and Sense 2 (right) on a wrist for size comparison.

Perhaps it’s a side-effect of coming from the Pixel Watch, but the Sense 2 display appears sunken into the glass. On most devices, the screen appears to be at least on the same level as the glass, even if it’s not. That’s not the case with the Sense 2.

Weird depth aside, the Sense 2 display is otherwise fine. It’s not significantly better than the display on the original Sense, but it’s not worse either.

What’s the big deal about a button, anyway?

The button on the Fitbit Sense 2 (top) and the button-that-wasn’t-a-button on the Sense (bottom).

If you’ve followed Fitbit news, you’ve likely heard by now that the Sense 2 has a physical button. Indeed it does, and it’s not a bad button, although it doesn’t offer a satisfying tactile click. For some people, that’s more than enough of an improvement, while others might wonder why it even matters.

Before the Sense 2 (and Versa 4), most Fitbit devices had an inductive “button,” button here referring to a small, touch-sensitive divot on the side of Fitbit wearables. The button-that-wasn’t-a-button was a frustration for many users, although I never had an issue with it on the original Sense (older Fitbit trackers I tried did have some issues with the button, however).

The move to a physical button thus will please the few who abhorred the fake button and will make no real difference to the vast majority of users since, functionally, nothing has changed.

Trying really hard to be Wear OS

The app list on the Fitbit Sense 2 (left) and Wear OS-powered Pixel Watch (right)

With the hardware portion out of the way, let’s talk software. Unfortunately, this was where the Sense 2 started to fall apart for me.

First, Fitbit told me that the Sense 2 doesn’t run Wear OS, but that didn’t stop the company from loading a mediocre copy of it onto the device. The Sense 2’s user interface (UI) is a nearly 1:1 replication, including the same swipe gestures, tile system, and more. It also completely changes how you use the Sense 2 compared to older Fitbit smartwatches, which will likely cause confusion for anyone upgrading from a Fitbit. If you’re coming to Fitbit from Wear OS, first: why? And second, you’ll feel a little more at home on the Sense 2 thanks to the similarity to Wear OS.

Swiping down on the Sense 2 opens the quick tiles for adjusting common settings on the fly (on the OG Sense, this was a swipe in from the left). Swiping up on the Sense 2 shows notifications (on the OG Sense, this was a swipe down).

In direct lighting, the Fitbit Sense 2 bezel is more apparent.

Left and right swipes on the Sense 2 cycle through ‘tiles,’ which are currently dedicated to showing various fitness metrics. That’s similar to the system on Wear OS, and like Wear OS, users can edit the order of tiles through the companion app.

Finally, like Wear OS, the button acts both as the home button to return to the main watch face, and also as a way to open the app drawer, which is also designed to look just like the app drawer on Wear OS. (On the OG Sense, you swiped in from the right side to access apps.) The physical button also offers a few shortcuts, like a press-and-hold action to activate a shortcut of your choosing, such as payments or Amazon Alexa. You can double-click the button to launch a shortcut menu with access to Alexa, Settings, Notifications, and Fitbit Pay.

Performance is lacking

Regarding lag and UI performance, I’m usually a little more forgiving of smartwatches. By their nature, they aren’t as powerful as smartphones, which are expected to offer a buttery-smooth experience all the time. With that in mind, there’s a fairly stark difference between a responsive watch with the odd bout of jitter, and an unresponsive, laggy watch. Unfortunately, the Sense 2 is more often in the latter category.

The Wear OS-like UI is fairly swipe-heavy, and as you try to navigate around, you can often see frames dropping and animations jittering. The watch is useable, but it often feels like I’m waiting for it to catch up to me.

If the Fitbit Sense 2 were more of a smartwatch and less of a fitness tracker, the performance might be a bigger problem. I mostly used the Sense 2 as a fitness tracker, which was generally fine. But when trying to engage with the ‘smart’ features, the performance often made using the watch more trouble than it was worth.

One bright spot, however, is battery life. In my testing, the Sense 2 easily hit the six-day claim Fitbit made. That said, I didn’t make much use of the GPS features since I’m not a runner – heavy GPS users will likely see shorter battery life.

Less smart before

It doesn’t help that Fitbit seems to have stripped away many of the features that helped the Sense line feel like a smartwatch. Basics like calls and notifications showing up on your wrist are still there (but only Android users can reply to texts or notifications from their wrist). Other features like Google Assistant are missing. That’s a particular frustration for me, given that Google Assistant was the main thing I used on my OG Sense. I also praised on-wrist Google Assistant in my Pixel Watch review, in part because it feels like a necessity.

Voice commands make using the minuscule display on a smartwatch much, much better. And what’s strange is the Fitbit Sense 2 still has Amazon Alexa, so it clearly has the chops to run a voice assistant.

When I asked Fitbit about the missing features, a spokesperson told me the company completely redesigned the watch and prioritized integrating the most important features for Fitbit users, like fitness tracking. Moreover, they warned that some features “will take longer than others to release.” That includes things like Google Maps and Wallet, but when I asked specifically about whether Google Assistant would come to the Sense 2 in the future, Fitbit couldn’t “confirm or deny” whether it would happen.

I’m interested to see how Maps and Wallet will work when they arrive, but I don’t have high hopes. I also find it exceptionally odd that the Sense 2 would support some Google services like Maps and Wallet, but not Assistant.

Moreover, there’s a lack of third-party apps too. I was never a big fan of apps on watches, but my OG Sense had a few useful options like Spotify or Starbucks. Those are nowhere to be found on the Sense 2, with the Fitbit App Gallery only listing a handful of Fitbit apps, all of which came pre-installed on the watch.

Fitness remains the star of the show and the Sense 2’s Achilles’ heel

Despite all the other issues, the Fitbit Sense 2 still handles fitness tracking well. It’s got the most fitness features of any Fitbit device, including the Pixel Watch, and remains the best option for those who want the ultimate Fitbit tracking experience.

Tracking options include SpO2, heart rhythm and heart rate, skin temperature, breathing rate, and a wealth of stress-tracking features (to name a few). The problem, however, is that aside from a small selection of the stress tracking features, most of the fitness tracking capabilities are also available on the Versa 4 or Charge 5, which are both quite a bit cheaper.

In other words, if you’re not a particularly stressed person (or if you’re not interested in keeping an eye on stress), you’ll probably do just fine with other Fitbit devices. The Versa 4 offers almost all the same features, minus the stress stuff and ECG, for $100 less. The Charge 5 has ECG, lacks the stress features and several of the smart features, but clocks in at half as much as the Sense 2.

Fitbit Sense (left) and Sense 2 (right) wrist comparison.

One other interesting note I have about the Sense 2 tracking is that, at least in my experience, it’s significantly different from what the Pixel Watch reported. For example, the Sense 2 almost always listed my daily step count at around 1,000 steps more than what the Pixel Watch said. At first, I thought this was due to wearing the Sense 2 on my right wrist, as I’m right-handed. However, after swapping it to my left wrist, there was still a significant disparity in reporting. Other things, like Active Zone Minutes (a measure of activity based on heart rate) and calories burned, were similar with smaller discrepancies between the devices. Given some other testers have also reported issues with the Pixel Watch’s tracking accuracy, I’d lean towards the Sense 2 numbers being correct.

Categories
Mobile Syrup

New tool could help detect which in-app browsers try to track you

Earlier this month, security researcher and former Google employee Felix Krause published a report detailing how Instagram, Facebook, and other apps can use the in-app browser to track people’s online behaviour. Now Krause is back with a tool that can help show users the extent of this tracking.

Here’s a quick explainer in case you missed Krause’s original report. Many apps feature a built-in web browser that opens links users click in the app. Krause highlights apps from Meta, like Facebook and Instagram, in the report, but many other apps do this too. (Tiktok is one of the more egregious – Krause claims TikTok can monitor all keyboard inputs and taps in its custom browser, but the company told Forbes it only uses the JavaScript in question for debugging.)

It’s worth noting that not all in-app browsers are bad. While some apps use custom in-app browsers, others use Apple’s Safari. Twitter, Reddit, Gmail, and other apps rely on Safari or the ‘SFSafariViewController’ to open websites in apps. Krause offers a list of apps that do this, noting that they are “on the safe side” as there’s no way for apps to inject code. Android offers a ‘Custom Tab’ feature that leverages users’ default browser, if it supports Custom Tabs, to load websites inside of apps. It’s not clear if JavaScript injections similarly impact this.

On the one hand, this probably shouldn’t come as a huge surprise to most people. If apps track what you’re doing in the app, why would that change for the in-app browser? On the other, this could serve as a wake-up call for some and, hopefully, encourage some action to prevent this tracking. That could come from those in control of app stores (for example, Apple could adjust its guidelines to prevent this kind of behaviour or perhaps extend its App Tracking Transparency feature to cover this kind of behaviour).

More likely, users will be on their own to protect themselves. The best way is to avoid using an in-app browser — thankfully, most apps include an option to use the default browser instead, which means whatever link you click will open in your actual browser, not the in-app option.

Another thing you can do? Test which apps inject JavaScript into the in-app browser using Krause’s new tool. Called ‘inappbrowser.com,’ it’s a website users can open that will detect JavaScript injections. There are, of course, limitations. The inappbrowser.com tool can’t detect all JavaScript commands that are executed, and just because JavaScript is present doesn’t mean something malicious is happening.

Still, running the inappbrowser.com test could let you know if an app is injecting JavaScript and if it is, that could mean it’s tracking something. To use the tool, navigate to ‘inappbrowser.com’ with an in-app browser. The trick, of course, is to get there — most in-app browsers don’t let you type in a URL. Instead, you have to click the link within the app you want to test. For example, you could post a comment with the link and click it or send a DM to yourself.

You can learn more about in-app browser tracking here.

Source: Felix Krause Via: The Verge

Categories
Mobile Syrup

iPhone apps and games track you, even if you ask them not to

Surprise, surprise: it turns out some iPhone apps still track users even when they use Apple’s new App Tracking Transparency feature to avoid being tracked.

For those who may not be familiar with it, Apple added App Tracking Transparency in an update to iOS 14 earlier this year. The feature lets users block apps from accessing their device’s Identifier for Advertisers (IDFA), a sort of advertising identification number tied to a device. The change should prevent apps from sharing data gathered about you from your iPhone or iPad with third-party companies (for example, Instagram could still share data with Facebook since they’re the same company).

Unfortunately, what should happen and what does happen are often completely different things. And according to an investigation from The Washington Post in conjunction with privacy-focused app developer Lockdown (via Input), some apps and games ignore users’ settings.

Of the ten apps studied, Lockdown found that none stopped tracking when users asked not to be tracked. The investigation found at least three popular iPhone games, including Subway Surfers, sent user data to third-party advertising companies, regardless if users had enabled App Tracking Transparency. Worse, the investigation found that Apple had done nothing to stop it, despite being alerted to the issue.

Blocking IDFA access doesn’t matter because apps can fingerprint users with other data

Here’s the thing — blocking an app’s access to your IDFA actually works, in the most barebones, basic way. The apps studied in the investigation didn’t have access to users’ IDFA and didn’t use it for tracking. Instead, they effectively created their own IDFA for devices by gathering various other metrics.

Going back to the Subway Surfers example, the investigation found it sent 29 data points about users’ devices to an ad company called ‘Chartboost.’ Some of the data points included users’ IP address, remaining free storage, current volume level, accessibility settings, device name, time zone, country, carrier and more.

Gathering a bunch of device data like this is actually a common tracking tactic called fingerprinting. By gathering a large amount of seemingly innocuous data about a users’ device, companies can effectively track that device (and, by extension, the user) across various apps and platforms.

Few of the developers behind the apps responded to requests for comment from The Washington Post. However, Subway Surfers developer Sybo did, and claimed it gathered the data “for the game to function properly.” While maybe some of the data points could help the game work — for example, getting accessibility settings could help the game accommodate users who rely on those options — most of the data should have no impact on the function of the game.

Apple needs to do more if it wants to be a privacy-first company

More than anything, the investigation demonstrates that Apple’s App Tracking Transparency feature is, ultimately, not that helpful. Worse, it may even be detrimental by lending users a false sense of security. Apple’s effectively telling users that they don’t have to worry about being tracked if they enable the feature. App Tracking Transparency also bolsters the company’s privacy-first image — I’ve seen plenty of social media posts about how App Tracking Transparency convinced people to switch from Android to iPhone to improve their privacy.

If Apple were really serious about privacy, it would add fingerprinting protection to iOS to reduce or hopefully stop tracking practices like this. In its current form, App Tracking Transparency is, at best, shallow marketing. At worse, it’s detrimental to user privacy by tricking people into thinking they’re protected when they aren’t.

Source: The Washington Post, Lockdown Via: Input