Loupe: Visualizing iOS Device Fingerprinting Surface

Loupe is an open-source iOS and iPadOS application designed to demonstrate the extent of device fingerprinting on Apple devices. By reading real values from public iOS APIs—the same APIs available to any third-party application—Loupe shows users exactly what data their iPhones expose and how that information is used to recognize and track them across different apps and websites.

Device Fingerprinting Without Explicit Permission

Device fingerprinting allows trackers to recognize a user without needing a name, email, or location. While a single data point may not be unique, the combination of multiple readings creates a high-entropy fingerprint that can follow a user across the ecosystem.

Loupe organizes these signals into three tiers based on the "cost" of access:

  • Passive Signals: Data visible to any app without any user prompt. This includes locale, time zone, screen specifications, and battery status.
  • Needs Permission: Data that triggers a standard iOS system prompt, such as contacts, photos, location, and calendars.
  • Advanced Signals: Side-channel uses of public APIs. This includes URL-scheme probing via canOpenURL and the use of Keychain persistence to track users even after an app has been uninstalled and reinstalled.

Critical Privacy Leaks in iOS APIs

Analysis of the signals exposed by Loupe highlights several high-entropy data points that can be used for persistent tracking:

  • System Timestamps: The date the iPhone was last set up or erased is accessible, providing a nearly unique identifier for a device instance.
  • Volume Creation Date: The date and time the storage volume was created is another granular data point used in fingerprinting.
  • Pasteboard Activity: The changeCount of the system pasteboard can be monitored to track user activity.
  • App Presence Probing: Apps can use canOpenURL to check for the presence of other specific applications on the device. While Apple restricts the list of schemes an app can query during the review process, this still allows for targeted profiling.

Community Insights and Technical Counterpoints

Technical discussions surrounding Loupe's findings emphasize the gap between Apple's marketed privacy and the reality of API access.

The App Store Review Process

Some users expressed surprise that such data is accessible despite Apple's App Store review process. However, technical contributors noted that while Apple has added restrictions to prevent apps from listing all installed apps, developers must still specify the schemes they wish to query in LSApplicationQueriesSchemes. This means that while bulk listing is blocked, targeted probing for specific apps remains possible.

Native Apps vs. Web Browsers

Discussion highlighted that native apps often have significantly more access to device telemetry than web browsers. This disparity is a primary driver for companies urging users to download native apps over using mobile websites, as the native environment provides a richer surface for data collection.

Persistence Across Reinstalls

Users noted that some apps can maintain a user's identity even after a full uninstall and reinstall. This is often achieved through the iOS Keychain, which can persist data across app deletions, allowing companies to re-link a returning user to their own previous profile.

Project Availability and Development

Loupe is released under the MIT License for its source code and is built for both iOS and iPadOS, with a macOS version currently in development. Notably, the project was developed almost entirely using AI coding tools.

For those unable to install the app, the developers have provided video demonstrations of the tool in action to illustrate the privacy risks associated with native iOS applications.

Sources