Archiv für den Monat Februar 2019

Germany bans Facebook from combining user data without permission

Germany’s Federal Cartel Office, or Bundeskartellamt, on Thursday banned Facebook from combining user data from its various platforms such as WhatsApp and Instagram without explicit user permission.

The decision, which comes as the result of a nearly three-year antitrust investigation into Facebook’s data gathering practices, also bans the social media company from gleaning user data from third-party sites unless they voluntarily consent.

“With regard to Facebook’s future data processing policy, we are carrying out what can be seen as an internal divestiture of Facebook’s data,” Bundeskartellamt President Andreas Mundt said in a release. “In [the] future, Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook user accounts.”

Mundt noted that combining user data from various sources “substantially contributed to the fact that Facebook was able to build a unique database for each individual user and thus to gain market power.”

Experts agreed with the decision. “It is high time to regulate the internet giants effectively!” said Marc Al-Hames, general manager of German data protection technologies developer Cliqz GmbH. “Unregulated data capitalism inevitably creates unfair conditions.”

Al-Hames noted that apps like WhatsApp have become “indispensable for many young people,” who feel compelled to join if they want to be part of the social scene. “Social media create social pressure,” he said. “And Facebook exploits this mercilessly: Give me your data or you’re an outsider.”

He called the practice an abuse of dominant market position. “But that’s not all: Facebook monitors our activities regardless of whether we are a member of one of its networks or not. Even those who consciously renounce the social networks for the sake of privacy will still be spied out,” he said, adding that Cliqz and Ghostery stats show that “every fourth of our website visits are monitored by Facebook’s data collection technologies, so-called trackers.”

The Bundeskartellamt’s decision will prevent Facebook from collecting and using data without restriction. “Voluntary consent means that the use of Facebook’s services must [now] be subject to the users’ consent to their data being collected and combined in this way,” said Mundt. “If users do not consent, Facebook may not exclude them from its services and must refrain from collecting and merging data from different sources.”

The ban drew support and calls for it to be expanded to other companies.

“This latest move by Germany’s competition regulator is welcome,” said Morten Brøgger, CEO of secure collaboration platform Wire. “Compromising user privacy for profit is a risk no exec should be willing to take.”

Brøgger contends that Facebook has not fully understood digital privacy’s importance. “From emails suggesting cashing in on user data for money, to the infamous Cambridge Analytica scandal, the company is taking steps back in a world which is increasingly moving towards the protection of everyone’s data,” he said.

“The lesson here is that you cannot simply trust firms that rely on the exchange of data as its main offering, Brøgger added, “and firms using Facebook-owned applications should have a rethink about the platforms they use to do business.”

Al-Hames said regulators shouldn’t stop with Facebook, which he called the number-two offender. “By far the most important data monopolist is Alphabet. With Google search, the Android operating system, the Play Store app sales platform and the Chrome browser, the internet giant collects data on virtually everyone in the Western world,” Al-Hames said. “And even those who want to get free by using alternative services stay trapped in Alphabet’s clutches: With a tracker reach of nearly 80 percent of all page loads Alphabet probably knows more about them than their closest friends or relatives. When it comes to our data, the top priority of the market regulators shouldn’t be Facebook, it should be Alphabet!”

Source: https://www.scmagazine.com/home/network-security/germany-bans-facebook-from-combining-user-data-without-permission/

Werbeanzeigen

Apple Glassboxes IOS Apps to remove screen recording code

Pedestrians pass in front of a billboard advertising Apple Inc. iPhone security during the 2019 Consumer Electronics Show (CES) in Las Vegas, Nevada, U.S., on Monday, Jan. 7, 2019. Apple made its presence felt at CES 2019 with a massive billboard highlighting the iPhone’s privacy features. Source: Photographer: David Paul Morris/Bloomberg via Getty Images

Apple is telling app developers to remove or properly disclose their use of analytics code that allows them to record how a user interacts with their iPhone apps — or face removal from the app store, TechCrunch can confirm.

In an email, an Apple spokesperson said: “Protecting user privacy is paramount in the Apple ecosystem. Our App Store Review Guidelines require that apps request explicit user consent and provide a clear visual indication when recording, logging, or otherwise making a record of user activity.”

“We have notified the developers that are in violation of these strict privacy terms and guidelines, and will take immediate action if necessary,” the spokesperson added.

It follows an investigation by TechCrunch that revealed major companies, like Expedia, Hollister and Hotels.com, were using a third-party analytics tool to record every tap and swipe inside the app. We found that none of the apps we tested asked the user for permission, and none of the companies said in their privacy policies that they were recording a user’s app activity.

Even though sensitive data is supposed to be masked, some data — like passport numbers and credit card numbers — was leaking.

Glassbox is a cross-platform analytics tool that specializes in session replay technology. It allows companies to integrate its screen recording technology into their apps to replay how a user interacts with the apps. Glassbox says it provides the technology, among many reasons, to help reduce app error rates. But the company “doesn’t enforce its customers” to mention that they use Glassbox’s screen recording tools in their privacy policies.

But Apple expressly forbids apps that covertly collect data without a user’s permission.

TechCrunch began hearing on Thursday that app developers had already been notified that their apps had fallen afoul of Apple’s rules. One app developer was told by Apple to remove code that recorded app activities, citing the company’s app store guidelines.

“Your app uses analytics software to collect and send user or device data to a third party without the user’s consent. Apps must request explicit user consent and provide a clear visual indication when recording, logging, or otherwise making a record of user activity,” Apple said in the email.

Apple gave the developer less than a day to remove the code and resubmit their app or the app would be removed from the app store, the email said.

When asked if Glassbox was aware of the app store removals, a spokesperson for Glassbox said that “the communication with Apple is through our customers.”

Glassbox is also available to Android app developers. Google did not immediately comment if it would also ban the screen recording code. Google Play also expressly prohibits apps from secretly collecting device usage. “Apps must not hide or cloak tracking behavior or attempt to mislead users about such functionality,” the developer rules state. We’ll update if and when we hear back.

It’s the latest privacy debacle that has forced Apple to wade in to protect its customers after apps were caught misbehaving.

Last week, TechCrunch reported that Apple banned Facebook’s “research” app that the social media giant paid teenagers to collect all of their data.

It followed another investigation by TechCrunch that revealed Facebook misused its Apple-issued enterprise developer certificate to build and provide apps for consumers outside Apple’s App Store. Apple temporarily revoked Facebook’s enterprise developer certificate, knocking all of the company’s internal iOS apps offline for close to a day.

Source: https://techcrunch.com/2019/02/07/apple-glassbox-apps/

Pedestrians pass in front of a billboard advertising Apple Inc. iPhone security during the 2019 Consumer Electronics Show (CES) in Las Vegas, Nevada, U.S., on Monday, Jan. 7, 2019. Apple made its presence felt at CES 2019 with a massive billboard highlighting the iPhone’s privacy features. Source: Photographer: David Paul Morris/Bloomberg via Getty Images

Your Apps Know Where You Were Last Night, and They’re Not Keeping It Secret

Dozens of companies use smartphone locations to help advertisers and even hedge funds. They say it’s anonymous, but the data shows how personal it is.

The millions of dots on the map trace highways, side streets and bike trails — each one following the path of an anonymous cellphone user.

One path tracks someone from a home outside Newark to a nearby Planned Parenthood, remaining there for more than an hour. Another represents a person who travels with the mayor of New York during the day and returns to Long Island at night.

Yet another leaves a house in upstate New York at 7 a.m. and travels to a middle school 14 miles away, staying until late afternoon each school day. Only one person makes that trip: Lisa Magrin, a 46-year-old math teacher. Her smartphone goes with her.

An app on the device gathered her location information, which was then sold without her knowledge. It recorded her whereabouts as often as every two seconds, according to a database of more than a million phones in the New York area that was reviewed by The New York Times. While Ms. Magrin’s identity was not disclosed in those records, The Times was able to easily connect her to that dot.

The app tracked her as she went to a Weight Watchers meeting and to her dermatologist’s office for a minor procedure. It followed her hiking with her dog and staying at her ex-boyfriend’s home, information she found disturbing.

“It’s the thought of people finding out those intimate details that you don’t want people to know,” said Ms. Magrin, who allowed The Times to review her location data.

Like many consumers, Ms. Magrin knew that apps could track people’s movements. But as smartphones have become ubiquitous and technology more accurate, an industry of snooping on people’s daily habits has spread and grown more intrusive.

 

At least 75 companies receive anonymous, precise location data from apps whose users enable location services to get local news and weather or other information, The Times found. Several of those businesses claim to track up to 200 million mobile devices in the United States — about half those in use last year. The database reviewed by The Times — a sample of information gathered in 2017 and held by one company — reveals people’s travels in startling detail, accurate to within a few yards and in some cases updated more than 14,000 times a day.

[Learn how to stop apps from tracking your location.]

These companies sell, use or analyze the data to cater to advertisers, retail outlets and even hedge funds seeking insights into consumer behavior. It’s a hot market, with sales of location-targeted advertising reaching an estimated $21 billion this year. IBM has gotten into the industry, with its purchase of the Weather Channel’s apps. The social network Foursquare remade itself as a location marketing company. Prominent investors in location start-ups include Goldman Sachs and Peter Thiel, the PayPal co-founder.

Businesses say their interest is in the patterns, not the identities, that the data reveals about consumers. They note that the information apps collect is tied not to someone’s name or phone number but to a unique ID. But those with access to the raw data — including employees or clients — could still identify a person without consent. They could follow someone they knew, by pinpointing a phone that regularly spent time at that person’s home address. Or, working in reverse, they could attach a name to an anonymous dot, by seeing where the device spent nights and using public records to figure out who lived there.

Many location companies say that when phone users enable location services, their data is fair game. But, The Times found, the explanations people see when prompted to give permission are often incomplete or misleading. An app may tell users that granting access to their location will help them get traffic information, but not mention that the data will be shared and sold. That disclosure is often buried in a vague privacy policy.

“Location information can reveal some of the most intimate details of a person’s life — whether you’ve visited a psychiatrist, whether you went to an A.A. meeting, who you might date,” said Senator Ron Wyden, Democrat of Oregon, who has proposed bills to limit the collection and sale of such data, which are largely unregulated in the United States.

“It’s not right to have consumers kept in the dark about how their data is sold and shared and then leave them unable to do anything about it,” he added.

Mobile Surveillance Devices

After Elise Lee, a nurse in Manhattan, saw that her device had been tracked to the main operating room at the hospital where she works, she expressed concern about her privacy and that of her patients.

“It’s very scary,” said Ms. Lee, who allowed The Times to examine her location history in the data set it reviewed. “It feels like someone is following me, personally.”

The mobile location industry began as a way to customize apps and target ads for nearby businesses, but it has morphed into a data collection and analysis machine.

Retailers look to tracking companies to tell them about their own customers and their competitors’. For a web seminar last year, Elina Greenstein, an executive at the location company GroundTruth, mapped out the path of a hypothetical consumer from home to work to show potential clients how tracking could reveal a person’s preferences. For example, someone may search online for healthy recipes, but GroundTruth can see that the person often eats at fast-food restaurants.

“We look to understand who a person is, based on where they’ve been and where they’re going, in order to influence what they’re going to do next,” Ms. Greenstein said.

Financial firms can use the information to make investment decisions before a company reports earnings — seeing, for example, if more people are working on a factory floor, or going to a retailer’s stores.

 

Health care facilities are among the more enticing but troubling areas for tracking, as Ms. Lee’s reaction demonstrated. Tell All Digital, a Long Island advertising firm that is a client of a location company, says it runs ad campaigns for personal injury lawyers targeting people anonymously in emergency rooms.

“The book ‘1984,’ we’re kind of living it in a lot of ways,” said Bill Kakis, a managing partner at Tell All.

Jails, schools, a military base and a nuclear power plant — even crime scenes — appeared in the data set The Times reviewed. One person, perhaps a detective, arrived at the site of a late-night homicide in Manhattan, then spent time at a nearby hospital, returning repeatedly to the local police station.

Two location firms, Fysical and SafeGraph, mapped people attending the 2017 presidential inauguration. On Fysical’s map, a bright red box near the Capitol steps indicated the general location of President Trump and those around him, cellphones pinging away. Fysical’s chief executive said in an email that the data it used was anonymous. SafeGraph did not respond to requests for comment.

 

More than 1,000 popular apps contain location-sharing code from such companies, according to 2018 data from MightySignal, a mobile analysis firm. Google’s Android system was found to have about 1,200 apps with such code, compared with about 200 on Apple’s iOS.

The most prolific company was Reveal Mobile, based in North Carolina, which had location-gathering code in more than 500 apps, including many that provide local news. A Reveal spokesman said that the popularity of its code showed that it helped app developers make ad money and consumers get free services.

To evaluate location-sharing practices, The Times tested 20 apps, most of which had been flagged by researchers and industry insiders as potentially sharing the data. Together, 17 of the apps sent exact latitude and longitude to about 70 businesses. Precise location data from one app, WeatherBug on iOS, was received by 40 companies. When contacted by The Times, some of the companies that received that data described it as “unsolicited” or “inappropriate.”

WeatherBug, owned by GroundTruth, asks users’ permission to collect their location and tells them the information will be used to personalize ads. GroundTruth said that it typically sent the data to ad companies it worked with, but that if they didn’t want the information they could ask to stop receiving it.

The Times also identified more than 25 other companies that have said in marketing materials or interviews that they sell location data or services, including targeted advertising.

[Read more about how The Times analyzed location tracking companies.]

The spread of this information raises questions about how securely it is handled and whether it is vulnerable to hacking, said Serge Egelman, a computer security and privacy researcher affiliated with the University of California, Berkeley.

“There are really no consequences” for companies that don’t protect the data, he said, “other than bad press that gets forgotten about.”

A Question of Awareness

Companies that use location data say that people agree to share their information in exchange for customized services, rewards and discounts. Ms. Magrin, the teacher, noted that she liked that tracking technology let her record her jogging routes.

Brian Wong, chief executive of Kiip, a mobile ad firm that has also sold anonymous data from some of the apps it works with, says users give apps permission to use and share their data. “You are receiving these services for free because advertisers are helping monetize and pay for it,” he said, adding, “You would have to be pretty oblivious if you are not aware that this is going on.”

But Ms. Lee, the nurse, had a different view. “I guess that’s what they have to tell themselves,” she said of the companies. “But come on.”

Ms. Lee had given apps on her iPhone access to her location only for certain purposes — helping her find parking spaces, sending her weather alerts — and only if they did not indicate that the information would be used for anything else, she said. Ms. Magrin had allowed about a dozen apps on her Android phone access to her whereabouts for services like traffic notifications.

But it is easy to share information without realizing it. Of the 17 apps that The Times saw sending precise location data, just three on iOS and one on Android told users in a prompt during the permission process that the information could be used for advertising. Only one app, GasBuddy, which identifies nearby gas stations, indicated that data could also be shared to “analyze industry trends.”

More typical was theScore, a sports app: When prompting users to grant access to their location, it said the data would help “recommend local teams and players that are relevant to you.” The app passed precise coordinates to 16 advertising and location companies.

A spokesman for theScore said that the language in the prompt was intended only as a “quick introduction to certain key product features” and that the full uses of the data were described in the app’s privacy policy.

The Weather Channel app, owned by an IBM subsidiary, told users that sharing their locations would let them get personalized local weather reports. IBM said the subsidiary, the Weather Company, discussed other uses in its privacy policy and in a separate “privacy settings” section of the app. Information on advertising was included there, but a part of the app called “location settings” made no mention of it.

The app did not explicitly disclose that the company had also analyzed the data for hedge funds — a pilot program that was promoted on the company’s website. An IBM spokesman said the pilot had ended. (IBM updated the app’s privacy policy on Dec. 5, after queries from The Times, to say that it might share aggregated location data for commercial purposes such as analyzing foot traffic.)

Even industry insiders acknowledge that many people either don’t read those policies or may not fully understand their opaque language. Policies for apps that funnel location information to help investment firms, for instance, have said the data is used for market analysis, or simply shared for business purposes.

“Most people don’t know what’s going on,” said Emmett Kilduff, the chief executive of Eagle Alpha, which sells data to financial firms and hedge funds. Mr. Kilduff said responsibility for complying with data-gathering regulations fell to the companies that collected it from people.

Many location companies say they voluntarily take steps to protect users’ privacy, but policies vary widely.

For example, Sense360, which focuses on the restaurant industry, says it scrambles data within a 1,000-foot square around the device’s approximate home location. Another company, Factual, says that it collects data from consumers at home, but that its database doesn’t contain their addresses.

Some companies say they delete the location data after using it to serve ads, some use it for ads and pass it along to data aggregation companies, and others keep the information for years.

Several people in the location business said that it would be relatively simple to figure out individual identities in this kind of data, but that they didn’t do it. Others suggested it would require so much effort that hackers wouldn’t bother.

It “would take an enormous amount of resources,” said Bill Daddi, a spokesman for Cuebiq, which analyzes anonymous location data to help retailers and others, and raised more than $27 million this year from investors including Goldman Sachs and Nasdaq Ventures. Nevertheless, Cuebiq encrypts its information, logs employee queries and sells aggregated analysis, he said.

There is no federal law limiting the collection or use of such data. Still, apps that ask for access to users’ locations, prompting them for permission while leaving out important details about how the data will be used, may run afoul of federal rules on deceptive business practices, said Maneesha Mithal, a privacy official at the Federal Trade Commission.

“You can’t cure a misleading just-in-time disclosure with information in a privacy policy,” Ms. Mithal said.

Following the Money

Apps form the backbone of this new location data economy.

The app developers can make money by directly selling their data, or by sharing it for location-based ads, which command a premium. Location data companies pay half a cent to two cents per user per month, according to offer letters to app makers reviewed by The Times.

Targeted advertising is by far the most common use of the information.

Google and Facebook, which dominate the mobile ad market, also lead in location-based advertising. Both companies collect the data from their own apps. They say they don’t sell it but keep it for themselves to personalize their services, sell targeted ads across the internet and track whether the ads lead to sales at brick-and-mortar stores. Google, which also receives precise location information from apps that use its ad services, said it modified that data to make it less exact.

Smaller companies compete for the rest of the market, including by selling data and analysis to financial institutions. This segment of the industry is small but growing, expected to reach about $250 million a year by 2020, according to the market research firm Opimas.

Apple and Google have a financial interest in keeping developers happy, but both have taken steps to limit location data collection. In the most recent version of Android, apps that are not in use can collect locations “a few times an hour,” instead of continuously.

Apple has been stricter, for example requiring apps to justify collecting location details in pop-up messages. But Apple’s instructions for writing these pop-ups do not mention advertising or data sale, only features like getting “estimated travel times.”

A spokesman said the company mandates that developers use the data only to provide a service directly relevant to the app, or to serve advertising that met Apple’s guidelines.

Apple recently shelved plans that industry insiders say would have significantly curtailed location collection. Last year, the company said an upcoming version of iOS would show a blue bar onscreen whenever an app not in use was gaining access to location data.

The discussion served as a “warning shot” to people in the location industry, David Shim, chief executive of the location company Placed, said at an industry event last year.

After examining maps showing the locations extracted by their apps, Ms. Lee, the nurse, and Ms. Magrin, the teacher, immediately limited what data those apps could get. Ms. Lee said she told the other operating-room nurses to do the same.

“I went through all their phones and just told them: ‘You have to turn this off. You have to delete this,’” Ms. Lee said. “Nobody knew.”

Source: https://www.nytimes.com/interactive/2018/12/10/business/location-data-privacy-apps.html?action=click&module=Top%20Stories&pgtype=Homepage

Planned Parenthood
Records show a device entering Gracie Mansion, the mayor’s residence, before traveling to a Y.M.C.A. in Brooklyn that the mayor frequents.
It travels to an event on Staten Island that the mayor attended. Later, it returns to a home on Long Island.

An app on Lisa Magrin’s cellphone collected her location information, which was then shared with other companies. The data revealed her daily habits, including hikes with her dog, Lulu. Nathaniel Brooks for The New York Times

A notice that Android users saw when theScore, a sports app, asked for access to their location data.

The Weather Channel app showed iPhone users this message when it first asked for their location data.

Nuclear plant

In the data set reviewed by The Times, phone locations are recorded in sensitive areas including the Indian Point nuclear plant near New York City. By Michael H. Keller | Satellite imagery by Mapbox and DigitalGlobe

Megachurch

Delete all Your Apps – Android and iOS’s Apps make money by selling your personal data and location history to advertisers.

Delete All Your Apps

It’s not just Facebook: Android and iOS’s App Stores have incentivized an app economy where free apps make money by selling your personal data and location history to advertisers.

Image: Shutterstock

Monday morning, the New York Times published a horrifying investigation in which the publication reviewed a huge, “anonymized” dataset of smartphone location data from a third-party vendor, de-anonymized it, and tracked ordinary people through their day-to-day lives—including sensitive stops at places like Planned Parenthood, their homes, and their offices.

The article lays bare what the privacy-conscious have suspected for years: The apps on your smartphone are tracking you, and that for all the talk about “anonymization” and claims that the data is collected only in aggregate, our habits are so specific—and often unique—so that anonymized identifiers can often be reverse engineered and used to track individual people.

Along with the investigation, the New York Times published a guide to managing and restricting location data on specific apps. This is easier on iOS than it is Android, and is something everyone should be periodically doing. But the main takeaway, I think, is not just that we need to be more scrupulous about our location data settings. It’s that we need to be much, much more restrictive about the apps that we install on our phones.

Everywhere we go, we are carrying a device that not only has a GPS chip designed to track our location, but an internet or LTE connection designed to transmit that information to third parties, many of whom have monetized that data. Rough location data can be gleaned by tracking the cell phone towers your phone connects to, and the best way to guarantee privacy would be to have a dumb phone, an iPod Touch, or no phone at all. But for most people, that’s not terribly practical, and so I think it’s worth taking a look at the types of apps that we have installed on our phone, and their value propositions—both to us, and to their developers.

A good question to ask yourself when evaluating your apps is “why does this app exist?”

The early design decisions of Apple, Google, and app developers continue to haunt us all more than a decade later. Broadly and historically speaking, we have been willing to spend hundreds of dollars on a smartphone, but balk at the idea of spending $.99 on an app. Our reluctance to pay any money up front for apps has come at an unknowable but massive cost to our privacy. Even a lowly flashlight or fart noise app is not free to make, and the overwhelming majority of “free” apps are not altruistic—they are designed to make money, which usually means by harvesting and reselling your data.

A good question to ask yourself when evaluating your apps is “why does this app exist?” If it exists because it costs money to buy, or because it’s the free app extension of a service that costs money, then it is more likely to be able to sustain itself without harvesting and selling your data. If it’s a free app that exists for the sole purpose of amassing a large amount of users, then chances are it has been monetized by selling data to advertisers.

The New York Times noted that much of the data used in its investigation came from free weather and sports scores apps that turned around and sold their users’ data; hundreds of free games, flashlight apps, and podcast apps ask for permissions they don’t actually need for the express purpose of monetizing your data.

Even apps that aren’t blatantly sketchy data grabs often function that way: Facebook and its suite of apps (Instagram, Messenger, etc) collect loads of data about you both from your behavior on the app itself but also directly from your phone (Facebook went to great lengths to hide the fact that its Android app was collecting call log data.) And Android itself is a smartphone ecosystem that also serves as yet another data collection apparatus for Google. Unless you feel particularly inclined to read privacy policies that are dozens of pages long for every app you download, who knows what information bespoke apps for news, podcasts, airlines, ticket buying, travel, and social media are collecting and selling.

This problem is getting worse, not better: Facebook made WhatsApp, an app that managed to be profitable with a $1 per year subscription fee, into a “free” service because it believed it could make more money with an advertising-based business model.

What this means is that the dominant business model on our smartphones is one that’s predicated on monetizing you, and only through paying obsessive attention to your app permissions and seeking paid alternatives can you hope to minimize these impacts on yourself. If this bothers you, your only options are to get rid of your smartphone altogether or to rethink what apps you want installed on your phone and act accordingly.

It might be time to get rid of all the free single-use apps that are essentially re-sized websites. Generally speaking, it is safer, privacywise, to access your data on a browser, even if it’s more inconvenient. On second thought, it may be time to delete all your apps and start over using only apps that respect your privacy and that have sustainable business models that don’t rely on monetizing your data. On iOS, this might mean using more of Apple’s first party apps, even if they don’t work as well as free third-party versions.

Source: https://motherboard.vice.com/en_us/article/j5zap3/delete-all-your-apps

Smart firewall iPhone app promises to put your privacy before profits

you-asked-am-i-addicted-to-my-phone

For weeks, a small team of security researchers and developers have been putting the finishing touches on a new privacy app, which its founder says can nix some of the hidden threats that mobile users face — often without realizing.

Phones track your location, apps siphon off our data, and aggressive ads try to grab your attention. Your phone has long been a beacon of data, broadcasting to ad networks and data trackers, trying to build up profiles on you wherever you go to sell you things you’ll never want.

Will Strafach  knows that all too well. A security researcher and former iPhone jailbreaker, Strafach has shifted his time digging into apps for insecure, suspicious and unethical behavior. Last year, he found AccuWeather was secretly sending precise location data without a user’s permission. And just a few months ago, he revealed a list of dozens of apps that were sneakily siphoning off their users’ tracking data to data monetization firms without their users’ explicit consent.

Now his team — including co-founder Joshua Hill and chief operating officer Chirayu Patel — will soon bake those findings into its new “smart firewall” app, which he says will filter and block traffic that invades a user’s privacy.

“We’re in a ‘wild west’ of data collection,” he said, “where data is flying out from your phone under the radar — not because people don’t care but there’s no real visibility and people don’t know it’s happening,” he told me in a call last week.

At its heart, the Guardian Mobile Firewall — currently in a closed beta — funnels all of an iPhone or iPad’s internet traffic through an encrypted virtual private network (VPN) tunnel to Guardian’s servers, outsourcing all of the filtering and enforcement to the cloud to help reduce performance issues on the device’s battery. It means the Guardian app can near-instantly spot if another app is secretly sending a device’s tracking data to a tracking firm, warning the user or giving the option to stop it in its tracks. The aim isn’t to prevent a potentially dodgy app from working properly, but to give users’ awareness and choice over what data leaves their device.

Strafach described the app as “like a junk email filter for your web traffic,” and you can see from of the app’s dedicated tabs what data gets blocked and why. A future version plans to allow users to modify or block their precise geolocation from being sent to certain servers. Strafach said the app will later tell a user how many times an app accesses device data, like their contact lists.

But unlike other ad and tracker blockers, the app doesn’t use overkill third-party lists that prevent apps from working properly. Instead, taking a tried-and-tested approach from the team’s own research. The team periodically scans a range of apps in the App Store to help identify problematic and privacy-invasive issues that are fed to the app to help improve over time. If an app is known to have security issues, the Guardian app can alert a user to the threat. The team plans to continue building machine learning models that help to identify new threats — including so-called “aggressive ads” — that hijack your mobile browser and redirect you to dodgy pages or apps.

Screenshots of the Guardian app, set to be released in December (Image: supplied)

Strafach said that the app will “err on the side of usability” by warning users first — with the option of blocking it. A planned future option will allow users to go into a higher, more restrictive privacy level — “Lockdown mode” — which will deny bad traffic by default until the user intervenes.

What sets the Guardian app from its distant competitors is its anti-data collection.

Whenever you use a VPN — to evade censorship, site blocks or surveillance — you have to put more trust in the VPN server to keep all of your internet traffic safe than your internet provider or cell carrier. Strafach said that neither he nor the team wants to know who uses the app. The less data they have, the less they know, and the safer and more private its users are.

“We don’t want to collect data that we don’t need,” said Strafach. “We consider data a liability. Our rule is to collect as little as possible. We don’t even use Google Analytics or any kind of tracking in the app — or even on our site, out of principle.”

The app works by generating a random set of VPN credentials to connect to the cloud. The connection uses IPSec (IKEv2) with a strong cipher suite, he said. In other words, the Guardian app isn’t a creepy VPN app like Facebook’s Onavo, which Apple pulled from the App Store for collecting data it shouldn’t have been. “On the server side, we’ll only see a random device identifier, because we don’t have accounts so you can’t be attributable to your traffic,” he said.

“We don’t even want to say ‘you can trust us not to do anything,’ because we don’t want to be in a position that we have to be trusted,” he said. “We really just want to run our business the old fashioned way. We want people to pay for our product and we provide them service, and we don’t want their data or send them marketing.”

“It’s a very hard line,” he said. “We would shut down before we even have to face that kind of decision. It would go against our core principles.”

I’ve been using the app for the past week. It’s surprisingly easy to use. For a semi-advanced user, it can feel unnatural to flip a virtual switch on the app’s main screen and allow it to run its course. Anyone who cares about their security and privacy are often always aware of their “opsec” — one wrong move and it can blow your anonymity shield wide open. Overall, the app works well. It’s non-intrusive, it doesn’t interfere, but with the “VPN” icon lit up at the top of the screen, there’s a constant reminder that the app is working in the background.

It’s impressive how much the team has kept privacy and anonymity so front of mind throughout the app’s design process — even down to allowing users to pay by Apple Pay and through in-app purchases so that no billing information is ever exchanged.

The app doesn’t appear to slow down the connection when browsing the web or scrolling through Twitter or Facebook, on neither LTE or a Wi-Fi network. Even streaming a medium-quality live video stream didn’t cause any issues. But it’s still early days, and even though the closed beta has a few hundred users — myself included — as with any bandwidth-intensive cloud service, the quality could fluctuate over time. Strafach said that the backend infrastructure is scalable and can plug-and-play with almost any cloud service in the case of outages.

In its pre-launch state, the company is financially healthy, scoring a round of initial seed funding to support getting the team together, the app’s launch, and maintaining its cloud infrastructure. Steve Russell, an experienced investor and board member, said he was “impressed” with the team’s vision and technology.

“Quality solutions for mobile security and privacy are desperately needed, and Guardian distinguishes itself both in its uniqueness and its effectiveness,” said Russell in an email.

He added that the team is “world class,” and has built a product that’s “sorely needed.”

Strafach said the team is running financially conservatively ahead of its public reveal, but that the startup is looking to raise a Series A to support its anticipated growth — but also the team’s research that feeds the app with new data. “There’s a lot we want to look into and we want to put out more reports on quite a few different topics,” he said.

As the team continue to find new threats, the better the app will become.

The app’s early adopter program is open, including its premium options. The app is expected to launch fully in December.

Source: https://techcrunch.com/2018/10/24/smart-firewall-guardian-iphone-app-privacy-before-profits/

30 Privacy & Security Settings in iOS You Should Check Right Now

 

With all of the personal information it contains, Apple added plenty of security measures to your iPhone protect you and your device from unwanted access. In iOS 12, there are several changes to help keep your device even more secure and private, and the update built on previous improvements to ensure your data stays safe.

Even with these improvements, your iPhone’s overall security still largely depends on you — from the security measures you use to how much data you wish to share with Apple and other parties. Because of this, we’ve rounded up the new privacy settings in iOS 12 that you should check, along with settings that have existed since previous versions of iOS that still remain relevant.

1. Use Automated 2FA

Two-factor authentication, known commonly as 2FA, gives you an added layer of security for apps and other services in the form of a six-digit numeric PIN that’s sent to you via Messages. In the past, you had to retrieve and input a time-sensitive code, which made access cumbersome. To alleviate this, iOS 12 has made 2FA security codes available as AutoFill options.

In other words, you no longer have to jump from a login page over to Messages to retrieve your security code, then back again to type it in. Unfortunately, the auto-fill feature doesn’t extend to external 2FA apps like Google Authenticator, and there’s no concrete information as to whether it’ll be added on with future updates.

This is a security setting you should simply be aware of, considering how easy it makes 2FA. Once your iPhone gets updated to iOS 12, it would be a good idea to go through any online accounts that contain sensitive data and enable 2FA if it’s available.

2. Audit Your Passwords

To further beef up your privacy and security, iOS 12 has introduced Password Reuse Auditing, a feature that keeps track of saved passwords and flags identical ones for different accounts; This can be accessed by going to Settings –> Password & Accounts –> Website & App Passwords. From there, any accounts that have identical passwords will be marked with a triangle containing an exclamation point.

Tap on any of the suspect accounts, and select „Change Password on Website“ on the following page to create a new password.

3. Keep USB Restricted Mode On

Brute-force USB unlocking tools like Cellebrite and GrayShift have become popular in law enforcement circles nationwide due to their ability to bypass iOS restrictions on the number of incorrect passcode attempts. This enables officers to unlock confiscated devices by entering an unlimited amount of guesses until they finally get past the lock screen.

In an effort to combat this, iOS 12 has USB Restricted Mode, which requires you to unlock your iPhone with a password when connecting to a USB device. Unlike past iOS betas which only required a password for devices that haven’t been unlocked for seven days, iOS 12 (as well as iOS 11.4.1 before it) has significantly reduced the requirement window to one hour.

This stringent requirement effectively nullifies law enforcement’s ability to unlock suspect iPhones with USB unlocking tools, as they will have only a 60-minute window to gain access to the device before the password requirement kicks in. If you want to disable this feature, however, head to Settings –> Touch ID & Passcode, and tap on the toggle next to „USB Accessories“ so it’s green.

4. Disable Face ID (iPhone X)

With its first anniversary fast approaching, it’s safe to say that Face ID has proved to be a reliable way of unlocking your iPhone X while keeping it secure from unwanted access. Nothing is bulletproof, however. Apple advertises a false acceptance rate of 1 in a million for Face ID, and considering there are 7.6 billion people on earth, that means roughly 7,600 other people could unlock your iPhone.

If that’s not enough to warrant concern, there’s an even higher chance of someone forcibly using your own face against your will to gain access to your iPhone. So if you want to maximize security, we recommend disabling Face ID altogether by going to Settings –> Face ID & Passcode. Instead, use a strong password, something longer than a six-digit numeric passcode.

5. Disable Face ID Temporarily (iPhone X Only)

If you must keep Face ID on, don’t worry. Apple has included a quick way to disable Face ID temporarily, in case you know your physical security is about to become compromised. Be sure to check out our guide below to find out more about this option, which leaves your phone’s security in the hands of your passcode.

6. Disable Touch ID

Just like the iPhone X with Face ID, Touch ID on other iPhone models can be a problem. For one, you don’t want to store your fingerprint in any database, even if it’s locally on your iPhone, since someone could potentially pull that record with access to your device. It’s much safer in the long run to use a less-convenient passcode. You can disable Touch ID via the Touch ID & Passcode settings.

7. Disable Touch ID Temporarily

Again, just like with Face ID, you can disable Touch ID temporarily instead if you don’t want to lose the convenience of Touch ID permanently. With a certain button combo press, you can disable it before handing it over to law enforcement, thieves, or even nosy friends and family.

8. Set a Stronger Passcode

By default, the iPhone passcode is six numeric digits long, though you can still set it to four numeric digits for added convenience. While there is nothing inherently wrong with using these passcode limits, they aren’t the most secure. A four-digit passcode, for instance, has 10,000 possible combinations, and considering there are 85.8 million iPhone users in the United States alone, there just aren’t enough unique combinations to go around.

Increasing the passcode to six digits increases the number of possible combinations to one million and brings it up to par with Face ID’s odds. If you want to go beyond those odds and maximize your iPhone’s security, change your passcode to a password, as using a true password with a combination of letters, numbers, and special characters will make your lock screen virtually impenetrable.

Granted, entering a convoluted password into your phone every time you want to use it is not ideal, but it’s currently the most secure way to lock your iPhone. So if you want to maintain a balance between convenience and security, choose a six-digit passcode over a four-digit one, while making sure to avoid common passcodes like 123456 or six of the same number.

To change your iPhone’s password, go to Settings –> Touch ID & Passcode –> Change Passcode. Enter your old passcode when prompted, then tap „Passcode Options“ to choose which type of passcode you’d like to make.

9. Stop Showing Parked Location

If you connect your iPhone to your car either through Bluetooth or CarPlay, your iPhone may be recording the location of where you park. While this information may be useful to some, to others, it may feel like an outright invasion of privacy. So if you feel like the latter, you’ll naturally want to shut this feature off. To do so, open your Settings app, then tap on „Maps.“ From there, simply tap on the toggle next to „Show Parked Locations“ to turn the feature off.

10. Disable & Clear Significant Locations

„Significant Locations“ is a setting that lets Apple record a list of your most frequently visited locations. And while this may optimize some apps that rely on location services, the improvements might be outweighed by privacy concerns overall.

So if you’d rather not let Apple know about locations you frequently visit, head over to Settings –> Privacy –> Location Services –> System Services –> Significant Locations, then disable it. From there, you also have the added option of clearing the history that your iPhone may have accumulated over time.

11. Turn Off Location-Based Alerts, Apple Ads & Suggestions

When enabled, location-based alerts, Apple ads, and suggestions all track your location to provide targeted notifications, advertisements, and options. To say that these options are not the most privacy-centric features in iOS 12 would be an understatement. In fact, these settings are actually quite creepy.

So if you don’t want to be specifically targeted by Apple wherever you go, open your Settings app, select „Privacy,“ and tap on „System Services“ on the following page. From there, you can deactivate „Location-Based Alerts,“ „Location-Based Apple Ads,“ and „Location-Based Suggestions“ by turning their corresponding toggles off.

12. Disable Share My Location

Having „Share My Location“ enabled lets you send your current whereabouts to a friend who requests it. While you need to mutually agree to this arrangement with another person using the Find My Friends app, there are ways of tracking your iPhone without your permission. If you’d like to avoid that risk altogether, disable the option by going to Settings –> Privacy –> Location Services –> Share My Location.

Alternatively, you can change the device that shares your location, if you have more than one attached to your Apple ID. You can also check with friends of yours you have approved to view your location.

13. Turn Off Analytics

Formerly „Diagnostics & Usage, the „Analytics“ page found within your iPhone’s Settings app contains options that share data from your phone to Apple in an effort to help identify bugs in the system and make iOS better overall. Think of it as a beta test, only for the official iOS 12 release.

While this information gives Apple the ability to detect issues and help keep iOS 12 running smoothly, you wouldn’t be alone in feeling that your iPhone may be sharing too much without your knowledge. If you’d like to end hidden communication between your Device and Apple, go to Settings –> Privacy –> Analytics.

From there, you have many options you can disable:

  • Turn off „Share iPhone & Watch Analytics“ to disable all analytics with Apple.
  • „Share With App Developers“ shares your app data with that app’s developer. Disable this setting to close that line of communication.
  • Disable „Share iCloud Analytics“ to prevent Apple from using your iCloud data to improve on apps and services associated with that information.
  • „Improve Health & Activity“ shares your health and activity data with Apple to improve these services on your iPhone. Disable this feature if you don’t want Apple to know about such private information.
  • „Improve Health Records“ shares pertinent health conditions such as medications, lab results, and other conditions with Apple. Disable this feature as you did with health and activity above.
  • „Improve Wheelchair Mode“ will send Apple your activity data if you use a wheelchair. Again, turn this feature off as you did „Improve Health & Activity,“ regardless of whether you’re in a wheelchair or not.

14. Limit Ad Tracking

„Limit Ad Tracking“ can be enabled if you prefer your ads to be directly targeted towards you and your interests. If you’re more focused on privacy, however, letting Apple share your data with advertisers may not be to your liking. This setting is one you actually turn on instead of the other way around. So head to Settings –> Privacy –> Advertising, then enable „Limit Ad Tracking.“

Notice how the option is Limit Ad Tracking, not Stop Ad Tracking. Even with this setting enabled, Apple claims that your iPhone connectivity, time setting, type, language, and location can be used to target advertising. If you disabled Location-Based Ads, location targeting will not apply to you, but all others will. Tap „View Ad Information“ to learn more.

15. Prevent Replying in Messages

Introduced in iOS 10, your iPhone gives you the option to 3D Touch messages to reply from your lock screen. While convenient, the feature is also easily accessed by other people. So if you’re worried about those around you replying to incoming messages on your iPhone, you might want to disable this option. Be sure to check out the article below to see how.

16. Disable Raise to Wake

With „Raise to Wake“ enabled, you’ll simply need to raise your phone from a flat position to wake it up. As natural and convenient as this feature is, it does pose a privacy risk. If your iPhone turns face-up accidentally, for instance, anyone within view of your iPhone’s display may see messages and notifications that you want to keep private.

To avoid this scenario, head over to your iPhone’s Settings app and select „Display & Brightness.“ From there, simply tap on the toggle next to „Raise to Wake“ to disable the feature. If you don’t want to disable „Raise to Wake“ but still want your content private on the lock screen, you can disable previews instead.

17. Stop Using Lock Screen Widgets

Lock screen widgets are great for staying on top of your messages, notifications, calendar — basically whatever else you need to know without having to unlock your iPhone. The obvious downside is you don’t need to unlock your iPhone to view important information. Anyone can pick up your iPhone and potentially see who’s texting you what, in addition to finding out your agenda is for the day.

To avoid this potential breach in privacy, you could hit „Edit“ at the bottom of the lock screen, then delete all widgets. However, you will lose those widgets when you’ve unlocked your phone as well, not just on the lock screen. So if you want to deactivate the widgets for only the lock screen, simply head to the article below.

18. Disable Control Center on Lock Screen

The Control Center went through a major revamp on iOS 11 and gave us the ability to customize the toggles with a number of features and options. Unfortunately, these nifty additions can be detrimental to you and your iPhone in terms of privacy and security.

While most content-sensitive apps require a passcode from the lock screen to access, there are apps that, at the very least, give users limited access without having to unlock the iPhone. If you have Notes activated, for instance, anyone can freely access it straight from the Control Center to write notes, though they cannot view written notes without unlocking your iPhone first.

You can disable any apps from the Control Center that you don’t want people having access to, but that means you won’t be able to access them when your iPhone is unlocked, either. An alternative option is to disable Control Center entirely from the lock menu by going to Settings –> Touch ID & Passcode and disabling the switch next to „Control Center.“ We’ll talk more about Passcode Lock later.

One app that should be disabled from Control Center is Wallet. While you do need your Touch ID, Face ID, or passcode to access any credit cards stored in your iPhone, other types of cards, like Starbucks, travel passes, and various other loyalty cards, do not. So if you want to prevent others from gaining access to these forms of currency, you’ll need to disable Wallet from Control Center.

To further customize options in your Control Center, open your Settings app, select „Control Center,“ then tap on „Customize“ on the following page.

19. Ask Websites Not to Track Me on Safari

„Ask Websites Not to Track Me“ gives you the option to decide whether or not to allow Safari to share your iPhone’s IP address with the websites you visit. For obvious privacy reasons, you’ll most likely not wish to share this information with sites, so to enable this setting, tap on „Safari“ within the Settings app, then enable the switch next to „Ask Websites Not To Track Me.“

Notice that the setting says Ask. Websites don’t have to comply, so there’s still a chance you’re being tracked. To learn more about this issue, check out the following guide.

20. Block Cross-Site Tracking

Safari has alwasy blocked third-party cookies, but those third parties have always been able to get around the restriction with first-party cookies — cookies the site uses for the site itself. Think of it as nefarious advertisers leeching off a site’s own cookies that are needed to make your visit more convenient. If that’s all sounds confusing, check out our full guide below on what cross-site tracking is, why it matters, and how to stop it.

21. Block All Cookies

As just discussed, cookies allow websites to save bits of your information for faster reloading next time you visit. And while this feature makes web browsing more convenient, cookies aren’t exactly a benefit in terms of overall privacy.

Since iOS 11, Apple has streamlined the blocking of cookies by doing away with various options in favor of a blanket ban on all. To disable cookies, open the Settings app and tap on „Safari.“ From there, simply tap on „Block All Cookies“ to turn the option on. While you may notice a difference in performance on some sites, at least you know you’re securing your privacy.

22. Remove App & Website Passwords

Your iPhone and iCloud account have a built-in password manager to make entering passwords easier and more secure. While these passwords are protected by Face ID, Touch ID, or your iPhone’s passcode, disaster will ensue if your iPhone gets breached, with the thief having unfettered access to all of your passwords.

To protect yourself and manage passwords saved, visit Settings –> Passwords & Accounts –> App & Website Passwords, and input your passcode or Touch ID to view your saved passwords. To delete passwords individually, swipe left on each password and hit „Delete.“ To erase en masse, tap „Edit“ in the top-right corner, then select each password you’d like to remove. Tap „Delete“ in the top-left corner to finish up.

23. Disable Certain AutoFill Data

Besides keeping your passwords, your iPhone has the ability to store your personal information for AutoFill. This handy feature makes filling out forms online or in apps a breeze, as your iPhone can now automatically enter pertinent information such as your name, phone number, credit card numbers, and home address, to name a few.

Obviously, the downside is this personal information can be a potential boon for any would-be thief that manages to get into your iPhone. To protect yourself, open Settings, tap on „Safari,“ and hit „AutoFill“ on the following page. From there, you can investigate what information is already saved, such as Contact Info and Credit Cards, or disable all by toggling each slider off.

24. Turn Off Microphone Access for Apps

Many apps request microphone access for legitimate purposes. Waze, for instance, uses this access to let you speak to the app to aid in handsfree navigation. That said, there are sketchy apps out there that may not be as forthcoming with what they do when granted access to your iPhone’s microphone.

Naturally, you’ll want to manage which apps have access to your iPhone’s microphone, so open your Settings app and go to „Privacy“ and tap on „Microphone“ on the following page. Here, you will find a list of all apps that are approved to use your microphone. Disable any or all by tapping the toggle next to each app.

25. Disable Camera Access for Apps

Apps like Snapchat depend on camera access to function. The same can’t be said for many apps, however, and some may have gained unjustified access to your iPhone’s camera without you realizing. Because of this, we recommend making a habit out of periodically checking for any wayward apps that have been granted camera access and disabling them accordingly.

To do so, open your Settings app and select „Privacy,“ then tap on „Camera“ on the following page. From there, tap on the toggle next to any suspect apps to disable camera access on your iPhone.

26. Turn Off Location Services for Apps

Location services are essential for navigation apps like Waze to work, as it enables GPS tracking to tag your location and give you directions accurately. In addition to that, apps like Snapchat can use your position when taking photos to apply exciting and unique filters that are only available where you currently are. Some apps, however, may not be as forthcoming about how they use your location data.

Needless to say, we recommend going to Settings –> Privacy –> Locations Services to disable the service for certain apps. And while you have the option to kill „Location Services“ entirely, this will cause you to lose access to all location functions. It’s a much better option to go through each app, and make sure to set the apps you don’t want to have access to your location to „Never.“

27. Empty Out Recently Deleted Photos

Apple saves your deleted photos in a „Recently Deleted“ folder for 30 days before permanently erasing them to make retrieval of accidentally deleted photos easier. If someone were to gain access to your phone, however, they’d have access to any photos deleted within 30 days from that time.

So, in order to avert potential disaster, always be sure to head to the Recently Deleted folder within the Photos app and empty it out of unwanted photos whenever you delete photos from your other galleries.

28. Use Biometrics for App Store Purchases

Let’s say you decide to buy an app. You leave your iPhone for a moment to attend to something important, but as you do, someone manages to break in and gain access to the App Store. Because you just purchased an app, the App Store may not require your password to buy another app, so this person can go crazy buying expensive apps at your expense.

As a preventative measure, it’s always a good idea to require your authorization before purchasing any apps. So if you use Touch ID or Face ID, head over to Settings –> Touch ID & Passcode (or Face ID & Passcode on iPhone X). From there, tap on the toggle next to „Touch ID for iTunes & App Store“ to enable the feature. Enter your iTunes password to confirm and you’ll be all set.

If you don’t use Touch ID, tap on your name at the top of the Settings page. Then, go to iTunes & App Stores –> Password Settings. Set the preference to „Always Require“ for maximum security. As an added option, you also have the ability to always require a password for free downloads by toggling the security measure on.

29. Frequently Auto-Delete Messages

As far as deleting older conversations within the Messages app, Apple permanently stores all your messages on your iPhone by default and largely leaves it up to you to delete them manually. Even if you have Messages in iCloud enabled, messages will still be stored locally. As such, erasing conversations can be a tedious process, especially if you’re concerned about your privacy and have made manually cleaning out your older texts a part of your monthly routine.

Thankfully, your iPhone has a feature that lets you automate the process of deleting old messages and set your device to remove older conversations after a certain period of time. To do so, just jump over to Settings –> Messages –> Keep Messages. Choose either „30 Days“ or „1 Year,“ and your iPhone will make sure your messages never see a day beyond that time.

For more information on permanently deleting texts from your iPhone, check out the guide below.

30. Disable Access to Apps When Locked

By default, your lock screen contains a treasure trove of personal data like recent notifications, your Wallet, and the Today View, which is a collection of widgets of your most useful apps. Fortunately, many of the apps that contain this info can be specifically disabled from the lock screen by going to the „Touch ID & Passcode“ menu (or „Face ID & Passcode“ on iPhone X) within the Settings app.

From there, you can choose which apps you’d like to prevent access to from your lock screen. If you’d rather not have others see your texts, emails, or app alerts, or if you’d prefer people not see information from your apps in the Today View, you can disable those apps and features here.

Source: https://ios.gadgethacks.com/news/30-privacy-security-settings-ios-12-you-should-check-right-now-0185045/

Apple will be around for a long time. But the next Apple just isn’t Apple.

Apple, the iPhone, and the Innovator’s Dilemma

David Paul Morris/Bloomberg/Getty Images

If you re-read the first few chapters of The Innovator’s Dilemma and you insert “Apple” every time Clayton Christensen mentions “a company,” a certain picture emerges: Apple is a company on the verge of being disrupted, and the next great idea in tech and consumer electronics will not materialize from within the walls of its Cupertino spaceship.

The Innovator’s Dilemma, of course, is about the trap that successful companies fall into time and time again. They’re well managed, they’re responsive to their customers, and they’re market leaders. And yet, despite doing everything right, they fail to see the next wave of innovation coming, they get disrupted, and they ultimately fail.

In the case of Apple, the company is trapped by its success, and that success is spelled “iPhone.”

Take, for example, Christensen’s description of the principles of good management that inevitably lead to the downfall of successful companies: “that you should always listen to and respond to the needs of your best customers, and that you should focus investments on those innovations that promise the highest returns.”

Molly Wood (@mollywood) is an Ideas contributor at WIRED and the host and senior editor of Marketplace Tech, a daily national radio broadcast covering the business of technology. She has covered the tech industry at CNET, The New York Times, and in various print, television, digital and audio formats for nearly 20 years. (Ouch.)

Then think about the iPhone, which, despite some consumer-unfriendly advances like the lost headphone jack and ever-changing charging ports, has also been adjusted and tweaked and frozen by what customers want: bigger screens, great cameras, ease of use, and a consistent interface. And the bulk of Apple’s investment since 2007, when the iPhone came out, has been about maintaining, developing, and selling this one device.

In the last quarter of 2018, the iPhone accounted for $51 billion of Apple’s $84 billion in revenue. Its success, the economic halo around it, and its seeming invincibility since its launch have propelled Apple to heights few companies have ever imagined. But the device will also be its undoing.

Here’s what happens when you have a product that successful: You get comfortable. More accurately, you get protective. You don’t want to try anything new. The new things you do try have to be justified in the context of that precious jewel—the “core product.”

So even something like Apple’s Services segment—the brightest non-iPhone spot in its earnings lately—mostly consists of services that benefit the iPhone. It’s Apple Music, iTunes, iCloud—and although Apple doesn’t break out its numbers, the best estimate is that a third or more of its Services revenue is driven by the 30 percent cut it takes from … yep, apps downloaded from the App Store.

The other bright spot in the company’s latest earnings report is its Wearables, Home, and Accessories category. Here again, Apple doesn’t break out the numbers, but the wearables part of that segment is where all the growth is, and that means Apple Watches. And you know what’s still tied nice and tight to the iPhone? Apple Watches.

Even Apple’s best-selling accessories are most likely AirPods, which had a meme-tastic holiday season and are, safe to say, used mostly in conjunction with iPhones. (I’d bet the rest of the accessories dollars are coming from dongles and hubs, since there’s nary a port to be found on any of its new MacBooks.) As for stand-alones, its smart speakers are reportedly great, but they’re not putting a dent in Amazon or Google, by latest count. Apple TV, sure. Fine. But Roku shouldn’t have been embedded in a TV before Apple was.

And none of these efforts count as a serious attempt at diversification.

You may be tempted to argue that Apple is, in fact, working on other projects. The Apple acquisition rumors never cease; nor do the confident statements that the company definitely, absolutely, certainly has a magical innovation in the works that will spring full grown like Athena from the forehead of Zeus any day now. I’m here to say, I don’t think there’s a nascent warrior goddess hiding in there.

Witness Apple’s tottering half-steps into new markets that are unrelated to the iPhone: It was early with a voice assistant but has stalled behind Amazon and even Google Assistant. It wasn’t until last year that the company hired a bona fide machine-learning expert in John Giannandrea, former head of search and AI at Google—and he didn’t get put on the executive team until December 2018. That’s late.

There’s its half-hearted dabble in self-driving technology that was going to be a car, then became software, then became 200 people laid off. Its quailing decade-long attempt to build a streaming service would be sort of comical if there weren’t clearly so much money being thrown around, and so tentatively at that. Rumors of its launch go back as far as 2015, although now it’s supposed to launch in April—this time they mean it.

But even if the streaming service actually arrives, can it really compete against YouTube, PlayStation, Sling, DirecTV, Hulu, and just plain old Netflix? Apple’s original programming is also apparently “not coming as soon as you think.” Analysts are, at this point, outright begging Apple to buy a studio or other original content provider, just to have something to show against Netflix and Amazon originals.

Of course, lots of companies innovate through acquisition, and everyone loves to speculate about what companies Apple might buy. Rumors have ranged from GoPro to BlackBerry to Tesla to the chipmaker ARM. Maybe Netflix. Maybe Tesla. Maybe Disney. Maybe Wired. (Apple News is a hugely successful product … mostly on iPhones, of course.) But at every turn, Apple has declined to move, other than its $3 billion Beats buy in 2014 (which it appears to be abandoning, or cannibalizing, these days).

Now, let me be clear, once again. None of this is to suggest that Apple is doing anything wrong. Indeed, according to Christensen, one of the hallmarks of the innovator’s dilemma is the company’s success, smooth operations, great products, and happy customers. That’s one of the things that makes it a dilemma: A company doesn’t realize anything’s wrong, because, well, nothing is. Smartphone sales may be slowing, but Apple is still a beloved brand, its products are excellent, its history and cachet are unmatched. But that doesn’t mean it has a plan to survive the ongoing decline in global smartphones sales.

The Innovator’s Dilemma does say an entrenched company can sometimes pull out of the quicksand by setting up a small, autonomous spinoff that has the power to move fast, pursue markets that are too small to move the needle for a company making $84 billion a quarter, and innovate before someone else gets there first.

Well, Apple has no autonomous innovation divisions that I know of, and the guys in charge are the same guys who have been in charge for decades: Tim Cook, Eddy Cue, Phil Schiller, Craig Federighi, Jony Ive—all have been associated with Apple since the late ’80s or ’90s. (I mean, has there ever really been a time without Jony Ive?)

You see what I’m saying here: brilliant team with a long record of execution and unparalleled success. Possibly not a lot of fresh ideas.

And then there’s the final option for innovation, one that Apple has availed itself of many times in the past. As Steve Jobs often said, quoting Picasso: “Good artists copy; great artists steal.” The iPod was born of existing MP3 players; the iPhone improved on clunky, ugly smartphones already on the market. The MacOS and the computer mouse were developed to maturity (yes, with permission) after being invented at Xerox PARC.

So maybe Apple will find the hottest thing in tech that’s still slightly unknown and come out with a better version. But is there such a thing as a way-sexier cloud computing business?

I guess it’s possible that the rumored virtual- and augmented-reality headset that Apple is supposed to release in 2020 will take the world by storm and popularize VR in a way that no one imagined, and like AirPods, will take a look that’s painfully dorky on the surface and turn it into a not-quite-ironic must-have statement of affluence and cool. It’s happened before. But this time, I think the company will get beaten to that punch—or whatever punch is next. Apple will be around for a long time. But the next Apple just isn’t Apple.

Source: https://www.wired.com/story/ideas-molly-wood-apple/