Hasta La Gadget!

Each iPad, iPhone and iPod Touch contains a "unique device identifier" that can potentially be linked to a customer's real-world identity, according to a security researcher. Photo: Jon Snyder/Wired.com

The unique string of numbers and letters assigned to your iPhone can potentially expose your real-life identity.

Security researcher Aldo Cortesi last week published his discovery of a flaw in the unique device identifier (UDID) stored on each iPhone, iPad and iPod Touch.

While this device identifier is well-known, it’s not supposed to be connected to a person’s actual identity. But Cortesi discovered that some apps can link the identifier to the phone owner’s Facebook profile, which effectively puts a face behind that string of numbers and letters.

“It’s like a permanent, unalterable tracking cookie that can’t be changed and that the user is not aware of,” Cortesi told Wired.com. “The UDID idea has got such deep flaws because it literally identifies the device.”

Apple and iOS app programmers use the 40-character string of letters and numbers as a method to identify each device uniquely, and presumably anonymously. The UDID is permanently tagged to the device, and it can’t be erased or changed.

By itself, the UDID doesn’t expose personal data, but to the extent that it’s tied to other information about the phone’s user, it can function like a permanent, ineradicable “evercookie.” In theory, that could allow advertisers or other parties to track a wide variety of your activities through your smartphone. Whether that constitutes a privacy invasion, an annoyance or a convenience depends on your perspective. Early concerns over Web cookies, for example, have faded as the business community has standardized privacy protocols, including allowing users to easily identify sites that use them, and to opt out if they so choose.

This identifier is at the center of criticism amid growing concerns about smartphone privacy. The Wall Street Journal last year conducted independent tests and found that out of 101 apps, 56 transmitted the device’s UDID to other companies without user awareness or consent.

In reaction to WSJ’s investigation, some customers in April filed a lawsuit against Apple and a handful of app makers, alleging that they invaded user privacy by accessing customer information without permission and sharing it with third-party advertisers. They argued that the UDID could be virtually stapled to other information, such as age and location, to personally identify a customer, and that advertisers can create profiles to track each customer for marketing purposes.

“They’re permanent Social Security numbers in your phone that are freely transmitted and can’t change,” said Justin Brookman, director of the Center for Democracy and Technology’s consumer privacy project.

Cortesi said that Apple’s UDID methodology is problematic because of the way it is designed. To track how apps transmit UDIDs, Cortesi created a tool called Mitmproxy.

In April, he found that OpenFeint, a gaming network integrated inside some apps to link players together, was transmitting UDID attached to personally identifiable information in some instances. When customers used their Facebook accounts to log in to OpenFeint, the game was transmitting UDID attached to the customer’s Facebook ID, picture and occasionally GPS coordinates, he said.

OpenFeint claims to have 75 million registered gamers. Popular games that integrate OpenFeint include TinyWings, Pocket God, Robot Unicorn Attack and Fruit Ninja.

OpenFeint fixed the flaw after Cortesi notified the company. However, Cortesi explained that the issue is not isolated to the gaming network.

Apple explicitly tells iOS programmers that they “must not publicly associate a device’s unique identifier with a user account” to ensure privacy. However, the fact that a network as big as OpenFeint managed to link UDIDs to Facebook accounts means that there are probably other apps linking UDIDs to personal data that have slipped past Apple’s radar.

“By designing an API to expose UDIDs and encouraging developers to use it, Apple has ensured that there are literally thousands of databases linking UDIDs to sensitive user information on the net,” Cortesi said.

Other than concerns about trading customer data with advertisers, an additional possibility is that app makers can peek at what a specific person is doing inside their apps, using analytics tools such as Flurry, Cortesi said.

Apple did not return a request for comment.

Charlie Miller, a security researcher who specializes in hacking smartphones, told Wired.com that the security issue raised by Cortesi is not a huge concern, but it does highlight some issues with the UDID. He said that a more secure design would be to have each app randomly generate a unique identifier for each device, so that a programmer can only track information relevant to his or her app.

However, Miller added that the erosion of privacy is inevitable in the always-connected age, and we have to sacrifice some privacy in exchange for app-powered services.

“The bottom line is traditional privacy has gone out the window with smartphones,” Miller said. “You’re carrying around always-on GPS-enabled, internet-enabled devices. You’re downloading and running applications that are designed to share your thoughts and photos. [Cortesi] points out some things Apple could have done better to help protect your privacy, but basically, you voluntarily give up some of your privacy in order to use these apps and devices.”

See Also:

• iPhone or iSpy? Feds, Lawyers Tackle Mobile Privacy
• Why and How Apple Is Collecting Your iPhone Location Data
• iPhone’s Location-Data Collection Can’t Be Turned Off
• iPhone Software Update Squashes Location-Data ‘Bugs’

We don’t have official word from Apple on the subject, but we’re hearing rumors that might explain why some iPad 2 backlights tend to bleed — according to Digitimes‘ anonymous sources, LG Display was “forced to reduce its shipments in the first quarter due to light leakage problem for panels,” and that Samsung took up the slack. That suggests that some of today’s vaunted 9.7-inch IPS displays may be from LG’s faulty batch and some may be slightly superior Samsung screens, but we don’t really recommend you crack yours open on the basis of an uncorroborated rumor (or at all, really) to find out the truth of the matter.

Update: An astute reader reminds us that while LG, Panasonic and Chimei make IPS screens, Samsung traditionally does not. Perhaps Samsung has managed to get its plane-line switching (PLS) displays into iPads instead, as was rumored last month, or perhaps this rumor is simply inaccurate, in whole or in part.

[Thanks, trucker boy]

iPad 2 light leakage due to faulty LG panels? (update) originally appeared on Engadget on Sat, 07 May 2011 18:09:00 EDT. Please see our terms for use of feeds.

Permalink CNET  |  Digitimes  | Email this | Comments

We know you’ve got questions, and if you’re brave enough to ask the world for answers, here’s the outlet to do so. This week’s Ask Engadget inquiry is coming to us from Gaurav, who can’t seem to contain his excitement for cord-free audio. And we can’t blame him. If you’re looking to send in an inquiry of your own, drop us a line at ask [at] engadget [dawt] com.

“Pretty simple: I am looking to purchase a small stereo system which can fit on a side table, and can connect to AirPort Express. Something stylish, but more importantly, reliable. Thanks!”

Any of you kitchen thrashers care to spill the beans on your preferred system? If so, comments are welcoming one and all down below.

Ask Engadget: best mini stereo for use with AirPort Express originally appeared on Engadget on Fri, 06 May 2011 22:29:00 EDT. Please see our terms for use of feeds.

Permalink   |   | Email this | Comments

The iPad’s music player hasn’t changed much since its debut, and unlike its desktop counterpart, it also lacks a built-in music visualizer for your mesmerization. Luckily, for the folks who are seeking ways to spice up their iPad music experience, you now have a new option: Planetary, by Bloom Studio. As you can tell by the name and the screenshot above, what we have here is a visually compelling app for exploring your tablet’s music library. It’s very straightforward: each artist or band is shown as a star, surrounded by albums in the form of orbiting planets, and then you have individual tracks displayed as moons orbiting each album.

During playback, each track leaves behind a trail on its orbit to indicate its play time, though you can hide the orbit lines (and labels) if you them too distracting. To choose other albums or artists, the good old pinch-to-zoom or the simple tapping on other 3D objects will move you between the moons and constellations, or you can just tap on the bottom-center button to jump straight to the letter selector for artists. Obviously, the former’s more fun within the first few hours, but after awhile we found ourselves preferring the quicker option to skip the mellow animation. Head past the break for our full impression and demo video.

Continue reading App review: Planetary for iPad

App review: Planetary for iPad originally appeared on Engadget on Fri, 06 May 2011 15:14:00 EDT. Please see our terms for use of feeds.

Permalink   |  iTunes, Bloom Studio  | Email this | Comments

Gone are the days of going to the music store, finding a vintage CD or cassette tape, happily unwrapping it and thoroughly perusing the cover art as you listen to your new album for the very first time. In a want-it-now world, that simply takes too long — and we have the internet to thank for the change in pace. As preferences seem to shift in the music consumption universe, it feels as if tastes are centered around consuming the largest amount of music possible. And thanks to the sudden proliferation of online streaming services, satisfying those desires in record time has become a reality.

Unsurprisingly, competition is mighty fierce — consumers have options for user-made radio stations, on-demand streaming content, and cloud-based multimedia. But if you’ve been hearing the word on the street, Apple and Google could soon make their way onto the scene by offering streaming music options of their own. Almost everything these two tech giants touch turns to gold (emphasis on almost — we don’t think Ping and Buzz built the best reputations), so there’s reason to believe that these oft-rumored services will become automatic front-runners the day they’re released. Head on past the break to see some of the lucky / unlucky contestants planning to give Google and Apple a run for their (near-limitless) money, replete with a breakdown of what they offer and how hard they hit the wallet.

Continue reading Streaming music breakdown: how Google Music and iCloud will impact today’s options

Streaming music breakdown: how Google Music and iCloud will impact today’s options originally appeared on Engadget on Fri, 06 May 2011 12:00:00 EDT. Please see our terms for use of feeds.

Permalink   |   | Email this | Comments