Mobile // Mobile Business
News
6/9/2014
04:21 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Apple iOS 8 Increases Privacy

iPhone users can look forward to broadcasting a bit less information about their devices as they wander the world.

Google I/O 2014: 8 Things To Watch
Google I/O 2014: 8 Things To Watch
(Click image for larger view and slideshow.)

Apple's iOS 8 will change the way iOS devices communicate with WiFi networks, a shift that will improve privacy for Apple customers and inconvenience marketers, who might turn to Apple's iBeacon tracking technology.

Over the weekend, Swiss programmer Frederic Jacobs, who works on encrypted messaging at Whisper Systems, discovered that Apple's next version of its mobile operating will randomize the MAC addresses of iOS devices as they scan for available WiFi networks.

A MAC address should not be confused with a Mac computer. The term stands for Media Access Control and refers to the unique identification number assigned to the network hardware layer in a device.

Unique identification numbers make networking more efficient; data can be sent to a specific address rather than every network node. But they also can be used as a means of network access control and of user identification.

[Is Apple becoming more open? Read Apple WWDC 2014 Highlights: A New Era?]

MAC addresses are not a foolproof solution for either of these tasks because they can be altered or spoofed. But they're effective enough that marketers use them for retail analytics. Apple's plan to randomize MAC address in iOS 8 is likely to make profiling mobile devices and their owners more difficult for analytics firms. Existing analytics systems will have to come up with another method for identifying devices.

Smartphones, by design, emit pings to find nearby wireless networks in order to join known networks automatically. Euclid Analytics, a mobile marketing startup based in San Francisco, uses this information, which includes the device's MAC address, to track and assess shopper behavior. As a concession to privacy, the company creates a one-way hash of each MAC address, so it has a unique identifier for each device that can't be reversed to determine the source MAC address.

Being able to identify a device, and by inference, the person using the device, has obvious commercial implications but also raises signficiant privacy concerns. In a 2010 blog post, Microsoft chief architect of access Kim Cameron argued that MAC addresses can be used to identify the home addresses, and thus the identities, of device users.

Yet back in 2011, when Google was revising its data collection practices after its StreetView cars were caught vacuuming data from WiFi networks, Google dismissed the notion that MAC addresses presented a privacy issue.

In an online help document about Google's Location Service, Google said, "A MAC address tells you nothing about the owner or user of the equipment concerned. It's just a string of characters that's technically necessary for Web pages and other content to be properly delivered to your device over the Internet."

Google appears to have revised its opinion the following year: The reference to MAC addresses no longer appears in an October 2012 snapshot of that support document.

In iOS 7, Apple extended its Location Services with a notification system called iBeacon that allows apps to notify users -- with ads, discounts, or just for customer tracking -- when near iBeacon hardware. In iOS 7.1, Apple turned the service on by default, so that apps implementing CoreLocation notifications register to receive iBeacon alerts. Users must opt out if they do not wish to be notified in this way.

The arrival of iOS 8 this fall will make MAC addresses more unreliable as a way to track devices and their users. Marketers thus might be inclined to consider Apple's iBeacon system, perhaps alongside competing schemes such Qualcomm's Gimbal and PayPal's Beacon, as an alternative.

What do Uber, Bank of America, and Walgreens have to do with your mobile app strategy? Find out in the new Maximizing Mobility issue of InformationWeek Tech Digest.

Thomas Claburn has been writing about business and technology since 1996, for publications such as New Architect, PC Computing, InformationWeek, Salon, Wired, and Ziff Davis Smart Business. Before that, he worked in film and television, having earned a not particularly useful ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
richardbagdonas
50%
50%
richardbagdonas,
User Rank: Apprentice
6/11/2014 | 3:03:43 PM
iBeacons and no wifi
I am so glad that Apple is going to start randomizing MAC addresses. It all boils down to opt in.

At Mahana (http://mahana.io) we are focused on providing iBeacon tech to apps that need location-based information in an opt-in manner.  The platform would be very suspect if we were collecting data from phones without someone saying "yes."

We would like to see more parity between Android and iOS on the hardware side, but I imagine that will come from industry pressure.
jgherbert
50%
50%
jgherbert,
User Rank: Ninja
6/11/2014 | 2:40:03 PM
DHCP
So I haven't seen an explicit confirmation yet, and perhaps somebody here can provide that, but if I understood correctly, the randomized MAC addresses are only used during scans for WiFi networks (Probe requests / responses), but once you actually join a WiFi network you still use your burnt in address (BIA). This is handy, since I (at least) use static MAC->IP mappings in the dhcpd configuration!

So to get a MAC address you now have to get people to actually join your WiFi network. Enter every store offering comprehensive (free!) WiFi service for you. Once you're on the WiFI, it's as good as it was before the security improvements. If, as mentioned in a recent article, you can also get other user information - e.g. by using a Facebook login to gain access to the WiFi - you could be on to a huge winner in terms of putting some personal meat on that data.
jgherbert
50%
50%
jgherbert,
User Rank: Ninja
6/11/2014 | 2:35:09 PM
Re: Lots of time to transition
"The operation system won't be available until fall, next it will take some time before full deployment has been achieved"

For the devices that support IOS8, it seems likely that adoption will be very high very quickly, just as it was with IOS 7. I'm not going to argue about which statistics are fair to quote on that, but in less than 12 months the penetration of that OS is quite amazing.

As you correctly state though, iOS is not the only game in town. But it's a valuable one to advertisers I'd bet.
Brian.Dean
50%
50%
Brian.Dean,
User Rank: Ninja
6/10/2014 | 6:49:26 PM
Re: Lots of time to transition
@Melgross, yes you are right, I referred to "MAC" (MAC address) as an enabler to perform customer identification and tracking. It's all about the data and the value that data can create, targeting ad content to users that might be interested in a product is better than, randomly sending out ads that generate low customer actions. And data is not just useful for ads -- knowing in aggregate, what consumers are interested in, can help in optimizing the supply chain as well.
Brian.Dean
50%
50%
Brian.Dean,
User Rank: Ninja
6/10/2014 | 6:22:09 PM
Re: Lots of time to transition
@Zaious, sorry for creating the confusion, I was referring to the MAC address going away as a tool that indirectly enables tracking.

If MAC addresses were to not be used completely, then an entirely different anchoring system would have to exist, the only thing that is becoming unavailable from the retail side of the equation is that due to the randomization process, tracking will not be possible -- dynamic IP address create the same problem for websites, that's why websites use cookies.

 
melgross
50%
50%
melgross,
User Rank: Ninja
6/10/2014 | 8:34:25 AM
Re: Check & Mate
I suppose you're one of the few Blackberry users still moping around? I can't speak to Android as much as iOS, but for iOS, privacy is pretty easy to achieve. Apple doesn't receive 97% of their sales and profits from user data as does Google, as unlike the advertising revenue model Google is forced to use, Apple makes most of its revenue and profit on hardware.
melgross
50%
50%
melgross,
User Rank: Ninja
6/10/2014 | 8:27:32 AM
Re: Lots of time to transition
You're misunderstanding the issue, if I understand what you are saying. MAC addresses aren't going away. This is just for roaming for a WiFi network to join. In order to join that network, the proper MAC address is used. If you're saying that the lack of a true MAC address for roaming is the issue, then yes. These big companies are doing whatever they can to get leverage. So far, the heavily Google supported NFC has been a bust. It isn't required that google have any part in any of this. Apple participation is enough. We can see that Google has already partly given up on NFC to support Apple technology in this area. They have no choice, as iBeacon is taking off, and this will further that. A good deal of this has to do with purchasing. If Apple users make significant purchases, then the system will work without Google. If Android users do not make significant purchases, then Google's participation won't matter either.
asksqn
50%
50%
asksqn,
User Rank: Ninja
6/10/2014 | 3:44:53 AM
Check & Mate
Android, iOs 8 sees your complete and utter disregard for consumer privacy and bets the house.
zaious
50%
50%
zaious,
User Rank: Strategist
6/9/2014 | 11:50:55 PM
Re: Lots of time to transition
@Brian.Dean: why would we need to consider a scenario where Mac is no longer available? They are not going to dissolve the entire thing suddenly. Most probably, you were hinting to to some case where 'Mac' is not allowed on the network. 
Brian.Dean
50%
50%
Brian.Dean,
User Rank: Ninja
6/9/2014 | 11:11:52 PM
Lots of time to transition
The operation system won't be available until fall, next it will take some time before full deployment has been achieved, and even then, Android is a big portion of the mobile device market, businesses might opt to wait for data to arrive that indicates that consumers are happy with the move, and that Android will follow soon. All this leave a lot of time before businesses begin to actually receive a lesser level of insight, however, it is important to locate the next best alternative of sharing data as soon as possible, in a way that's beneficial to both businesses and consumers.

I wonder, what would be the next best alternative, once MAC is no longer available.
InformationWeek Elite 100
InformationWeek Elite 100
Our data shows these innovators using digital technology in two key areas: providing better products and cutting costs. Almost half of them expect to introduce a new IT-led product this year, and 46% are using technology to make business processes more efficient.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek - July 21, 2014
Our new survey shows fed agencies focusing more on security, as they should, but they're still behind the times with cloud and overall innovation.
Flash Poll
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
In this special, sponsored radio episode we’ll look at some terms around converged infrastructures and talk about how they’ve been applied in the past. Then we’ll turn to the present to see what’s changing.
Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.