Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

9/10/2019
04:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Privacy Features in iOS 13 Let Users Limit Location Tracking

Apple will introduce other features that allow more secure use of iPhones in workplace settings as well.

Apple's soon-to-be-released iOS 13 includes multiple features designed to give iPhone users substantially better control over their privacy and security settings for both personal and business use.

Apple today announced it will release iOS 13 on September 19, one day before the company's scheduled rollout of the new iPhone 11 Pro and iPhone 11 Pro Max phones. The new operating system will be available as a free update to users of Apple's iPhone 6S and later.

On the consumer side, one of the most significant privacy improvements in the operating system is a feature that allows users to limit the location data a mobile application can collect about them. They will have the option of deciding whether to share their precise location with a mobile app always, only when the app is in use, or never at all. In essence, users will have the ability to prevent a mobile app from running in the background when they're not using it.

Other location-related features include a control that prevents apps from accessing location information without permission when a user is using Wi-Fi or Bluetooth, and another that alerts users when an app is using location data in the background. Significantly, the notification will include a map of the location data that an app has collected, along with the app's own explanation for why it is collecting the data. A user can then decide whether to limit the app's location collection ability.

"From an application perspective, the new iOS is adding some more detailed controls around the location data that apps receive from the operating system," says Harrison Van Riper, strategy and research analyst at Digital Shadows. "Over the last few months there have been several high-profile location data exposures, so this could be a response to that."

For third-party application vendors and services that depend on location tracking, the changes could make a huge difference. Facebook, whose privacy practices have come under searing scrutiny in recent months, is easily the most prominent among those that will be impacted by the changes. With iOS 13, users will be able to restrict the social media giant's ability to track their movements and ensure it obtains their permission before accessing location data when the user is using Wi-Fi and Bluetooth.

In a measure of concern, Facebook in a blog Monday warned users about the impending changes with iOS 13. The company, whose revenue depends largely on its ability to monetize user data, stressed the platform works better with location information.

The company reminded users that location information powers features such as check-ins and event planning, besides enabling better ad targeting. "Features like Find Wi-Fi and Nearby Friends use precise location even when you're not using the app to make sure that alerts and tools are accurate and personalized for you," Facebook said.

Beyond Location
Meanwhile, other consumer-facing enhancements in iOS 13 include a new Sign-in With Apple ID feature that will give users the option of signing into applications and websites using their Apple IDs.  

"With the new feature, iOS 13 will highly encourage two-factor authentication," Digital Shadows' Van Riper says. "If a user was to select 'Sign in with Apple' to create a new account, their Apple ID has to have two-factor authentication enabled in order to use the feature." They also will be required to use either Apple's Touch ID or Face ID when creating the account, Van Riper notes.

Users who don't want to share their email with a particular app will have the option of letting Apple create a unique single-use email address that forwards to the user's actual email address. The feature will work on all supported Apple devices, as well as on Android and Windows applications.

All iOS applications that require a user sign-in will be required to support the new Apple sign-in option. "These are all great steps in the right direction in preventing unauthorized account takeovers and illegitimate account creations," Van Riper says.

Importantly, since a third-party website will also be using temporary credentials generated by Apple, user data isn't persistent and cannot be commoditized and resold as it can with similar options from Google and Facebook, says Russ Mohr, Apple evangelist at MobileIron.

Enterprise Use
With iOS 13, Apple has also introduced some new features for protecting user privacy in a workplace setting. The most important among them is "User Enrollment," a feature designed specifically for bring-your-own-device (BYOD) environments. It creates an entirely new and encrypted partition on a device and associates a Managed Apple ID that is used only for work apps and data, Mohr says.

"Apple is clearly targeting a population of users that were hesitant to give IT visibility into their devices," he notes. "With User Enrollment, iOS and MacOS users can be sure that IT departments can't view their apps, can't wipe their device, and aren't privy to other [identity] information like SIM information or even their personal Apple ID," he says.

With iOS 13, Apple is also providing new extensions that make single sign-on easier for enterprise organizations to implement. The technology is underpinned by the use of certificates and modern authentication, which is both easier for employees and more secure for the enterprise, Mohr says.

Unlike Google's Managed Profiles on Android, Apple still does not allow two instances of the same app to run on a device. Support for such a capability would allow users that use an app for both personal and business — like email, for instance — to keep their data completely separate, Mohr says.

"It seems like Apple will go down the path of personas, though, as they have with the Notes app, which has some data tied to the business account and some to the personal account," he notes. Currently, only business data is backed to a business iCloud account, and the data is automatically removed when the device leaves company management, he says.

Details of Apple's new iPhones together with pricing and availability information are available here.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Phishers' Latest Tricks for Reeling in New Victims."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18214
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
CVE-2019-18197
PUBLISHED: 2019-10-18
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...