Original Article & Authorization
Original article: https://linux.do/t/topic/2598156
Permission granted by the original author.
Why do other apps immediately know what you just searched for?
Have you ever experienced this: One day you search for a pair of Crocs on a social media app, and the very next day, you’re scrolling through a completely unrelated shopping app and see recommendations for those exact Crocs… You start to panic, trying to remember if you ever mentioned those Crocs in the second app. After confirming you hadn’t, you start to guess: either “these two companies are definitely secretly swapping my data,” or “oh no, my phone’s microphone is eavesdropping on me.” While both of those scenarios are pretty wild, especially microphone eavesdropping (which is easy to expose with a packet capture), considering the low bar for internet companies these days, I wouldn’t dare vouch for them.
However, advertisers actually have a more covert and secure way to push a pair of Crocs across apps right in front of you:
For example, if a phone searches for Crocs in app A, that preference is recorded under the device’s name. Switch to app B, and if it recognizes the same device, it can continue pushing that preference. It recognizes the machine; it doesn’t necessarily need to know your name or who you are. So the question is, how do advertisers record this information, and how does it leak out? Recently, I discovered an app made by a security team: Loupe. It has only one function: to tell users how much data a mobile app can actually get from you? And what exactly gets exposed every time you “allow” an additional permission?
For example, the moment I opened Loupe, without granting any permissions, it immediately gave me a rude awakening.
It knew I set my phone’s region to Singapore, use a mixed Chinese-English keyboard, activated the device in September 2023, have copied 29,034 times since then, and last booted 8 days, 3 hours, and 44 minutes ago. It even went ahead and drew a profile of me. Knowing I have Steam and Discord installed, it deduced I’m likely a gamer. Then, seeing GitHub and Slack, it inferred I work in the tech industry.
The above is just what’s displayed in the app. If you check the more detailed report, you’ll find it knows even more.
For example, it knows my iPhone 15 Pro currently has 105GB of storage left, is in dark mode, screen brightness is over half, battery is at 60%, not plugged in; it’s dual SIM, both cards are on 5G, and it even knows how the phone is tilted and in which direction at this very moment.
You might still think, “So what if it knows these bits and pieces? Can it really pinpoint us?” Indeed, it can’t.
Besides, this is still just information Loupe sees based on public APIs: What if, like with other apps, I grant Loupe access to my photo album, location, and other permissions? What information would it then know?
I tried granting photo album permission. Loupe quickly told me I have 1,119 videos and 9,371 photos in my gallery, with 3,033 of them containing geolocation data, and it listed the places I’ve visited most frequently.
Don’t be fooled by the app only pinpointing “Yuhang District”; this is just for Loupe’s display convenience. You should know that EXIF data in photos contains latitude and longitude accurate to about ten meters. An app just needs to analyze the frequency and timestamps of each location to roughly guess where I live, where I work, and that some obscure small town I occasionally pop up in during holidays is likely my hometown.
I recommend setting all apps to use the system’s photo picker, which pops up and lets you select a few photos to authorize. In this case, iOS defaults to not sending photo location data to the app.
Oh, and when you encounter those pop-ups asking if you want to enable all permissions for “convenience,” remember to select ‘Keep Current Settings’.
Next, let’s grant Loupe local network permission and see what it can get.
Honestly, who would think much about this permission normally? It’s just for connecting to a printer or casting a screen, right? But after I tapped ‘Allow,’ all my colleagues’ computers on the local network, an HP laser printer, and two Ugreen NAS devices all showed up.
Of course, it’s reasonable for this permission to see all nearby devices; otherwise, it wouldn’t be able to find them. I just don’t understand, shouldn’t this permission only pop up when I actually need to cast my screen?
Why do many apps, simply by being opened, reach out and ask for it?
I won’t go into detail about location, Bluetooth, and calendar permissions; you can see the information in the screenshots. In short, every time you tap ‘Allow,’ the app understands you more deeply, and your device fingerprint becomes clearer and more diverse.
So how does App B know the fingerprint and preferences calculated for me in App A?
The answer is advertisers. Many apps don’t build their own ad systems; instead, they integrate an existing ad SDK. The splash screen ads and in-feed ads you see in an app are all fetched by this code from an ad platform and then displayed to you. At the same time, the SDK sends your phone’s characteristics back to the ad platform.
Logically, an SDK shouldn’t need to go through all this trouble to identify your phone.
Apple originally issued a legitimate identifier called IDFV, which means “several apps from the same company share one ID.” So, if you have several apps from the same developer installed, it’s effortless for them to recognize you as the same person.
But once you cross company boundaries, IDFV isn’t universal. That’s where IDFA comes in. IDFA is one ID per phone, universal across all apps, specifically designed to help the advertising industry identify people across apps. But then another problem arose. In 2021, Apple launched App Tracking Transparency (ATT), putting the IDFA switch back in the user’s hands. For an app to use it, it first has to pop up and ask you. If you tap ‘Ask App Not to Track,’ that ID is immediately zeroed out.
So in the end, advertisers had to take matters into their own hands, using this device fingerprinting tactic.
So, are apps really secretly using this tactic?
Loupe’s development team is called Mysk. They previously packet-captured Facebook, Instagram, Threads, Chrome, and Spotify, and found that even though these apps promised in Apple’s privacy manifest, “I read this information, but I will never transmit it,” they still secretly sent out the user’s phone uptime. Seriously, guys, what do you need uptime for? Is your taste more unique than Walmart plastic bags or attack helicopters…?
The truth is, there’s only one reason: piecing together device fingerprints.
Similar things have happened in the Android camp. In 2025, a Google research team published a paper where they analyzed 180,000 Android apps and 220,000 SDKs. They found that among popular apps in app stores, 39.4% contained SDKs that collect device fingerprints. If categorized into dating and comic apps, this number soared to 82% and 88% respectively.
Currently, Loupe is completely free and open-source. I think all iPhone users should give it a try (Android users might have to wait a bit longer). Of course, after trying it, there’s no need to be overly paranoid. After all, advertisers have many ways to guess what you like to watch or buy, besides device fingerprinting, such as similar audiences, account linking, and collaborative filtering. I believe Loupe’s biggest value is that it lets you know what data of yours is exposed, and under what circumstances, thereby raising your security awareness. Just be more careful in your daily life.
Currently, Loupe is completely free and open-source. I think all iPhone users should give it a try (Android users might have to wait a bit longer).
If you’re interested in this topic, you can check out my previous articles:
(Repost) An insider reveals how rogue apps trap and hunt users
Related articles, images, data, and code sources:
- https://mysk.blog/2024/05/03/apple-required-reason-api/
- https://mp.weixin.qq.com/s/fR_GTcbEg84GOcQ5XXcyCw
- https://apps.apple.com/cn/app/loupe-app能看到什么/id6766152470
- https://github.com/mysk-research/loupe
- https://nopj.cn/d/7382-loupekai-yuan-xiang-mu-shi-shi-jian-kong-iosyuan-sheng-appshu-ju-quan-xian
Some information may be outdated