Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

9/10/2019
04:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Privacy Features in iOS 13 Let Users Limit Location Tracking

Apple will introduce other features that allow more secure use of iPhones in workplace settings as well.

Apple's soon-to-be-released iOS 13 includes multiple features designed to give iPhone users substantially better control over their privacy and security settings for both personal and business use.

Apple today announced it will release iOS 13 on September 19, one day before the company's scheduled rollout of the new iPhone 11 Pro and iPhone 11 Pro Max phones. The new operating system will be available as a free update to users of Apple's iPhone 6S and later.

On the consumer side, one of the most significant privacy improvements in the operating system is a feature that allows users to limit the location data a mobile application can collect about them. They will have the option of deciding whether to share their precise location with a mobile app always, only when the app is in use, or never at all. In essence, users will have the ability to prevent a mobile app from running in the background when they're not using it.

Other location-related features include a control that prevents apps from accessing location information without permission when a user is using Wi-Fi or Bluetooth, and another that alerts users when an app is using location data in the background. Significantly, the notification will include a map of the location data that an app has collected, along with the app's own explanation for why it is collecting the data. A user can then decide whether to limit the app's location collection ability.

"From an application perspective, the new iOS is adding some more detailed controls around the location data that apps receive from the operating system," says Harrison Van Riper, strategy and research analyst at Digital Shadows. "Over the last few months there have been several high-profile location data exposures, so this could be a response to that."

For third-party application vendors and services that depend on location tracking, the changes could make a huge difference. Facebook, whose privacy practices have come under searing scrutiny in recent months, is easily the most prominent among those that will be impacted by the changes. With iOS 13, users will be able to restrict the social media giant's ability to track their movements and ensure it obtains their permission before accessing location data when the user is using Wi-Fi and Bluetooth.

In a measure of concern, Facebook in a blog Monday warned users about the impending changes with iOS 13. The company, whose revenue depends largely on its ability to monetize user data, stressed the platform works better with location information.

The company reminded users that location information powers features such as check-ins and event planning, besides enabling better ad targeting. "Features like Find Wi-Fi and Nearby Friends use precise location even when you're not using the app to make sure that alerts and tools are accurate and personalized for you," Facebook said.

Beyond Location
Meanwhile, other consumer-facing enhancements in iOS 13 include a new Sign-in With Apple ID feature that will give users the option of signing into applications and websites using their Apple IDs.  

"With the new feature, iOS 13 will highly encourage two-factor authentication," Digital Shadows' Van Riper says. "If a user was to select 'Sign in with Apple' to create a new account, their Apple ID has to have two-factor authentication enabled in order to use the feature." They also will be required to use either Apple's Touch ID or Face ID when creating the account, Van Riper notes.

Users who don't want to share their email with a particular app will have the option of letting Apple create a unique single-use email address that forwards to the user's actual email address. The feature will work on all supported Apple devices, as well as on Android and Windows applications.

All iOS applications that require a user sign-in will be required to support the new Apple sign-in option. "These are all great steps in the right direction in preventing unauthorized account takeovers and illegitimate account creations," Van Riper says.

Importantly, since a third-party website will also be using temporary credentials generated by Apple, user data isn't persistent and cannot be commoditized and resold as it can with similar options from Google and Facebook, says Russ Mohr, Apple evangelist at MobileIron.

Enterprise Use
With iOS 13, Apple has also introduced some new features for protecting user privacy in a workplace setting. The most important among them is "User Enrollment," a feature designed specifically for bring-your-own-device (BYOD) environments. It creates an entirely new and encrypted partition on a device and associates a Managed Apple ID that is used only for work apps and data, Mohr says.

"Apple is clearly targeting a population of users that were hesitant to give IT visibility into their devices," he notes. "With User Enrollment, iOS and MacOS users can be sure that IT departments can't view their apps, can't wipe their device, and aren't privy to other [identity] information like SIM information or even their personal Apple ID," he says.

With iOS 13, Apple is also providing new extensions that make single sign-on easier for enterprise organizations to implement. The technology is underpinned by the use of certificates and modern authentication, which is both easier for employees and more secure for the enterprise, Mohr says.

Unlike Google's Managed Profiles on Android, Apple still does not allow two instances of the same app to run on a device. Support for such a capability would allow users that use an app for both personal and business — like email, for instance — to keep their data completely separate, Mohr says.

"It seems like Apple will go down the path of personas, though, as they have with the Notes app, which has some data tied to the business account and some to the personal account," he notes. Currently, only business data is backed to a business iCloud account, and the data is automatically removed when the device leaves company management, he says.

Details of Apple's new iPhones together with pricing and availability information are available here.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Phishers' Latest Tricks for Reeling in New Victims."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16680
PUBLISHED: 2019-09-21
An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.
CVE-2019-16681
PUBLISHED: 2019-09-21
The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity, leading to file disclosure and XSS.
CVE-2019-16677
PUBLISHED: 2019-09-21
An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF.
CVE-2019-16678
PUBLISHED: 2019-09-21
admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route.
CVE-2019-16679
PUBLISHED: 2019-09-21
Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.