Can App Developers See AppleID?

Software
1

I’m doing a security audit for a friend who is fleeing a domestic abuse situation and I’m uncertain whether app developers can see the AppleID used on an iOS device. This is just a long explanation post so feel free to skip and respond to the simple question of “can apps see your AppleID?” If you have first hand experience as a developer.

I’ve heard Uber was cracking down on people making multiple accounts on the same device for free first time customer promotions a while back. And I wasn’t sure if Uber was tying the app install instance to an AppleID or a unique device ID.

Here’s a specific scenario. Suppose my female friend is using a certain app for years on her main Apple ID. Let’s say it’s an email app, which to protect her, I’ll call MPU-Mail. So she has MPU mail app installed from her AppleID on her iPhone. And she logs into MPU mail with her real name JaneDoe @ Mpumail . com

Now Jane is being harassed by a former boyfriend who has ties to… let’s just say he can track phones, and yes authorities are involved, but he’s good at covering his tracks.

Jane buys a brand new prepaid iPhone with cash and creates a new AppleID with a fake name. Assuming Jane never uses the actual phone number for anything and just uses encrypted messaging and encrypted email, can she be tracked based on the app developer having a record of her Apple ID?

Specifically, since Jane used to use MPU Mail app on her old device, and since that’s her main email for work and professional purposes, she wants to install MPU mail on her new prepaid iPhone with a new fake name AppleID so she can keep getting access to the email on her new phone.

But I told her I’m concerned MPU Mail app developer can see her AppleID so her stalker could get MPU Mail to hand over her account details, which would include the new AppleID that otherwise has zero linkage to her, except for the fact that she logged into MPU mail with her old username on the new iPhone. Which once he has the new AppleID he can follow her movements again.

So… can developers see AppleID? And if they can only see a unique device ID, could that be traced back to the AppleID through Apple? Or is the unique device ID only generated locally on the device and never transmitted to Apple? Perhaps based on some algorithm one way hash.

I don’t want to give specifics of her stalker, but he does this professionally and it’s within the realm of possibility he might get MPU mail to hand over her new AppleID.

It’s also possible he might get MPU mail to hand over the unique device ID of her new phone and then have Apple hand over the AppleID associated with that unique device ID, if Apple has that information.

There’s a lot I’m helping “Jane” with, but this right now is my immediate concern and depending on the answers to these two questions, she may just wind up accessing this email over a web browser using a VPN since then it’s unlikely MPU mail can turn over anything useful to her stalker.

1 Like
2

I can’t say this with 100% certainty but I am 95% sure that they cannot see the Apple ID.

I am saying that because for years iOS developers have said they have no way of knowing who their customers are, and if they could access the Apple ID then I would expect they could fairly easily make that connection.

I would think the biggest risk is that cell phone carriers have a not-great track record of privacy and access to location data, but I suspect you are already aware of that.

Best wishes to you and your friend.

3 Likes
3

Yes, thank you. We need to keep a few pieces of information completely secret.

Her SIM card number, her cell phone number, her phone ESN and her AppleID because with any of those he can track her based on phone company tower data.

Fortunately it’s easy to keep all but the AppleID secret, just by not giving out the new phone number and not using iMessage. Instead using an encrypted messaging app over cell data.

But that AppleID piece is the tough one. Because we need to install the encrypted messaging apps on there, and concern exists they can access the AppleID, thus the question.

Of course, she could create a whole new email and whole new encrypted messaging account user name, but as soon as she gives that to me and her mom and sisters, etc, then her stalker can get her new account username from one of us, and start tugging on the thread that way.

So really it comes down to, can app devs see Apple ID, and regarding a unique device ID that might be generated as part of an app install, is that something Apple can see? Such that you install App X, they see a unique string of characters as a device ID, and then stalker can get Apple to hand over AppleID based on knowing the device ID the app developer had.

1 Like
4

Sorry she is in this situation.

I would assume that anything listed under Types of Data at the link below would be available to developers, since as of December 8, developers will be required to disclose if they collect these data.

3 Likes
5

AFAIK it is not possible for the developer to get a unique identifier.

6

The advertisingIdentifier is an alphanumeric string unique to each device, that you only use for advertising. Specific uses are for frequency capping, attribution, conversion events, estimating the number of unique users, advertising fraud detection, and debugging.

1 Like
7

Unless this stalker works for a state intelligence agency, she cannot be identified if she uses an app anonymously. You’re fine.

8

Thanks for this; so presumably Apple can associate an advertising identifier with the AppleID, correct?

Or does this identifier only live locally on the device?

Is this the same as the reset advertising identifier option in settings or different?

9

While I mostly agree with the assurances that have been given so far, this really caught my attention:

If this means the boyfriend is an accomplished hacker, or a security researcher, then it’s my opinion that Jane may not be able to hide from him indefinitely regardless of the precautions she takes.

1 Like
10

That’s true—he wouldn’t try the fruitless route of trying to extract iCloud information from anonymously used apps, though.

To me it seems dangerous to this person to inculcate fear about an iPhone’s security situation because it might drive them to something that isn’t as secure by design.

1 Like
11

I’m out of my depth on this one.
When a human life is potentially at stake, I wouldn’t take advice from anyone on the internet, myself included.

4 Likes
12

I could not agree more. I have no idea about the situation in “Jane’s” country, but there are organizations and law agencies here in Germany that do this professionally (it depends on the threat level what measures are being taken). And to be honest, they need to know about situations like that in order to protect “Jane”. This is no task for a community. I do not mean that in any harsh or bad way. I do not want to offend anybody. Stay safe out there!

1 Like
13

This is definitely relevant.

1 Like
14

That’s a good guide. It confirms what we said, that Apple ID isn’t exposed to app developers (or else it would be in privacy permissions.) It’s not a concern.

1 Like
15

I came to share that exact guide, as reading about it made me think this thread.

1 Like
16

Hey! Same here! :grin: