Passcode-Collecting App Pulled From App Store [Updated]

by

Earlier this week, iOS developer Daniel Amitay published a report examining trends in passcodes chosen by users of his Big Brother Camera Security application. Amitay had anonymously collected over 200,000 passcodes used on his app and offered the data up as a proxy for actual iPhone passcode usage data based on the similarity of the input system style and functionality.


Amitay now reports that his application has been pulled from the App Store by Apple, although he is unsure at this time whether the removal was due to publication of the data or his admission of collecting it in the first place.

As of today at 4:58pm EST, Big Brother has been removed from the App Store. I'm certainly not happy about it, but considering the concerns a few people have expressed regarding the transfer of data from app to my server, it is understandable.

I think I should clarify exactly what data I was referring to, and how I was obtaining it. First, these passcodes are those that are input into Big Brother, not the actual iPhone lockscreen passcodes. Second, when the app sends this data to my server, it is literally sending only that number (e.g. "1234") and nothing else. I have no way of identifying any user or device whatsoever.

Amitay points to Apple's iTunes licensing agreement in support of his belief that he can collect such information, noting that he had planned on using the data collected to generate a list of common passcodes that would offer a warning of the codes being too obvious if they were chosen by a user. Consequently, it is unclear whether it is the collection itself or the publication of it that raised Apple's ire.

Amitay is currently reaching out to Apple to address the issue and have Big Brother Camera Security returned to the App Store.

Update: Amitay has updated his post to note that he has received a response from Apple relaying that his application was pulled for "surreptitiously harvesting user passwords". He has submitted an updated version of the application omitting the passcode collection capabilities and has appealed Apple's decision on the basis of the data being specific to the app, anonymized, and used for the purposes of improving the application.

Top Rated Comments

(View all)
Avatar
122 months ago
This developer has done nothing wrong, besides show the stupidity of users who use passcodes such as these. The unsolicited collection of data is something that happens everyday. Whenever you shop at WalMart, they record your credit card number and what you bought so they can refund you if need be. BUT they can easily bring up a purchase history and work out what your shopping style is, what you like to buy, what kinds of thing you buy. That's an invasion of privacy to a degree, but do you care?

The HUGE difference here is the developer can't tie up passcodes to individuals. What he wanted to do was look at the bigger picture. Apple published that they've sold x million iPads. OMG My iPad is in that statistics! That's MY data THEY HAVE NO RIGHT! See how stupid that is?

Information is taken from you all the time, whether or not you know it, and for most purposes it's used for seeing trends in large datasets, not to target you personally. Until your personal privacy is breached there's no need to cry. Apple are bending to consumer pressure because of a large volume of complaints they've probably received about the App.
Score: 8 Votes (Like | Disagree)
Avatar
122 months ago

What is the big advantage of Apple's curated App Store? Oh right, that Apple checks all apps for such things before making them available to the public.

As much as I don't approve of what this developer did, I also fear that there are thousands of apps out there, installed on millions of iOS devices, that send much more private data than just a passcode for the lock screen, unasked.

Apple gets 30% of the revenue, they could be a bit more thorough when testing apps...


That's just not realistically possible. For a start, you'd need to packet sniff all wi-fi packets and trawl through the data looking for something that looked like a 4 digit code in this case. Moreover, the minute Apple started doing this, any developer with malicious intent would immediately switch to sending all data over SSL/TLS. When the data is encrypted, the app could be sending anything and there would be no way to know.

Apple are doing the right thing - their API's heavily limit the damage a rogue developer can do but to try to go any further would just be a waste of everybody's time.
Score: 5 Votes (Like | Disagree)
Avatar
122 months ago

This developer has done nothing wrong, besides show the stupidity of users who use passcodes such as these. The unsolicited collection of data is something that happens everyday. Whenever you shop at WalMart, they record your credit card number and what you bought so they can refund you if need be. BUT they can easily bring up a purchase history and work out what your shopping style is, what you like to buy, what kinds of thing you buy. That's an invasion of privacy to a degree, but do you care?

The HUGE difference here is the developer can't tie up passcodes to individuals. What he wanted to do was look at the bigger picture. Apple published that they've sold x million iPads. OMG My iPad is in that statistics! That's MY data THEY HAVE NO RIGHT! See how stupid that is?

Information is taken from you all the time, whether or not you know it, and for most purposes it's used for seeing trends in large datasets, not to target you personally. Until your personal privacy is breached there's no need to cry. Apple are bending to consumer pressure because of a large volume of complaints they've probably received about the App.


People will always make big deals about these 'privacy' issues. It's the same thing as the whole location cache. People'll freak out because they think that somehow they're somehow special and that their info matters.

Should this dev have told his users about this study of his prior to do it? probably. Did it hurt anyone at all? NO
Score: 5 Votes (Like | Disagree)
Avatar
122 months ago
I don't think anonymous data collection should be forbidden, but when collecting something that could be "personal" information it should be.

In this case it is a users PIN code. While most were probably meaningless, some people may have used the same code to unlock their phone, the same code they use for their bank card or some other important number.

And the issue for me isn't so much that he collected it, it is that the code was probably sent in plaintext over a normal HTTP connection. So if someone was around you with a packet sniffer they could easily grab your unlock code. Of course the chances of this happening are essentially zero (A person must be sniffing the wifi that you are on, you must be using this app, and you must be setting your unlock code) it is still something you probably shouldnt do.

I'm fine with developers collecting simple anonymous data like "how many times did I open this app" or something along those lines, but I'd rather not have my device broadcasting security codes or passwords.
Score: 4 Votes (Like | Disagree)
Avatar
122 months ago
You do realise that app developers are allowed to collect data from people using their apps as long as its anonymous? And the user agreement that we as users sign up to could be classed as letting us know that this can happen in any app. So technically i think he's still working within the EULA. I'm not saying i agree with what he did, but theres no need to flame the guy and call for life time bans etc. if he genuinely wanted to use the data to improve his application by stopping people using common passcodes. I'm sure analysis of passwords to persuade people to use less common passwords is/has been a common thing on the internet.

Also IMO it's not like he set out to trick people into using the same phone lock passcode for his app,(maybe i'm wrong and there were ulterior motives to it). But really, we shouldn't be using the same passwords for things, do you use the same pin code for your atm as your phone, or the same password for online banking and your macroumous login?

Edit: ok re-read the article and he did say that because of the similarity in the code screen he thought it may correlate with real codes, but still from the EULA apple does give the developers the right to do it and we still blindly accept the agreement and really he can't do anything with the data to harm anyone, and i think it helps to bring to light the importance of not using easy to guess common passwords (at the read the EULAs we accept)
Score: 4 Votes (Like | Disagree)
Avatar
122 months ago

This developer has done nothing wrong, besides show the stupidity of users who use passcodes such as these. The unsolicited collection of data is something that happens everyday. Whenever you shop at WalMart, they record your credit card number and what you bought so they can refund you if need be. BUT they can easily bring up a purchase history and work out what your shopping style is, what you like to buy, what kinds of thing you buy. That's an invasion of privacy to a degree, but do you care?

The HUGE difference here is the developer can't tie up passcodes to individuals. What he wanted to do was look at the bigger picture. Apple published that they've sold x million iPads. OMG My iPad is in that statistics! That's MY data THEY HAVE NO RIGHT! See how stupid that is?

Information is taken from you all the time, whether or not you know it, and for most purposes it's used for seeing trends in large datasets, not to target you personally. Until your personal privacy is breached there's no need to cry. Apple are bending to consumer pressure because of a large volume of complaints they've probably received about the App.

Agreed. It is probably the same stupid users that have 0000 or 1234 as their passcodes that are all up in arms about OMG DEY STEELIN MA INFOS! You get your information stolen every day, but since its not brought to your attention in an article, you don't care? I get so many Amazon emails "recommending similar products" that I would never use that it borders on spam. How do they know which products are similar? Oh noes! Shut down Amazon!
Score: 3 Votes (Like | Disagree)

Top Stories

First iPhone 12 Mini Hands-On Video Surfaces [Update: Video Pulled]

Wednesday October 28, 2020 1:21 pm PDT by
Apple's iPhone 12 mini and the iPhone 12 Pro Max aren't set to be available until November 13, but a Romanian YouTuber got his hands on the iPhone 12 mini and showed it off today, offering a size comparison between the iPhone 12 and the 12 mini along with going over some of the device's features. The iPhone 12 mini is identical to the iPhone 12 in design and functionality, but it has a...

Apple References Unreleased 2020 16-Inch MacBook Pro in Boot Camp Update

Monday October 26, 2020 8:42 am PDT by
Last week, Apple released an update for Boot Camp, its utility for running Windows on a Mac. While this update would typically be unremarkable, several of our readers noticed that the release notes reference an unreleased 2020 model of the 16-inch MacBook Pro. While this could easily be a mistake, the 16-inch MacBook Pro is nearly a year old, so it is certainly a worthy candidate for a...

After Mocking Apple, Samsung May Remove Power Adapter From Galaxy S21 Box

Tuesday October 27, 2020 4:29 pm PDT by
Samsung's Galaxy S21, coming in 2021, may not include a power adapter or headphones in the box, according to reports from Korean media sites highlighted by SamMobile. Rumors earlier this year also said that Samsung was considering removing these accessories from future smartphone models, but that didn't stop Samsung from mocking Apple for selling the iPhone 12 models without a power adapter...

Report: Apple Silicon iMac Featuring Desktop Class 'A14T' Chip Coming First Half of 2021

Tuesday October 27, 2020 4:14 am PDT by
The first iMac powered by Apple Silicon is set to arrive in the first half of next year and will feature a desktop class "A14T" chip, according to Chinese-language newspaper The China Times. Codenamed "Mt. Jade," Apple's first custom-made desktop processor will be twinned with its first self-developed GPU, codenamed "Lifuka," both of which are being produced using TSMC's 5-nanometer process, ...

iPhone 12 Ceramic Shield Still 'Scratches at Level 6 With Deeper Grooves at Level 7' in Mohs Hardness Test

Wednesday October 28, 2020 7:10 am PDT by
iPhone 12 and iPhone 12 Pro models feature a new Ceramic Shield front cover that is "tougher than any smartphone glass," according to Apple, but the displays on the devices still have similar scratch resistance as previous iPhones based on a new test. Zack Nelson today shared his much-anticipated iPhone 12 Pro durability test on his YouTube channel JerryRigEverything, and based on the Mohs...

2020 iPad Air vs. iPad Pro: Hands-On Comparison

Tuesday October 27, 2020 3:03 pm PDT by
Apple announced the new 2020 fourth-generation iPad Air in September, but the new tablets just started shipping out to customers last Friday. We picked one up and thought we'd do a hands-on comparison with the iPad Pro, which was last updated in March, because both tablets are about as powerful and share many similarities. Subscribe to the MacRumors YouTube channel for more videos. Design and ...

MagSafe Charger Only Charges at Full 15W Speeds With Apple's 20W Power Adapter [Updated]

Monday October 26, 2020 3:38 pm PDT by
Alongside the iPhone 12 and 12 Pro models, Apple introduced a new MagSafe charger that attaches to the magnetic ring in the back of the devices, providing up to 15W of charging power, which is double the speed of the 7.5W Qi-based wireless charging maximum. Apple does not provide a power adapter with the $39 MagSafe charger, requiring users to supply their own USB-C compatible option. Apple...

Apple Files Mystery 'Personal Computer' With Placeholder 'B2002' Name in Bluetooth Product Database

Tuesday October 27, 2020 12:36 pm PDT by
Last week, a listing appeared in the Bluetooth product database for an Apple product with a placeholder name "B2002" and a model number of "TBD." MacRumors was alerted to the listing by health and fitness tech website MyHealthyApple. The product is filed under the "personal computer" category, which Apple has used for previous Mac and iPad listings in the database, so it is hard to pinpoint...

Apple Releases First macOS Big Sur 11.0.1 Beta to Developers [Update: Public Beta Available]

Wednesday October 28, 2020 10:15 am PDT by
Apple today seeded a new macOS Big Sur 11.0.1 beta to developers for testing purposes, with the new beta replacing the existing macOS Big Sur 11 beta 10 update that was released two weeks ago. The macOS Big Sur beta can be downloaded through the Apple Developer Center and once the appropriate profile is installed, subsequent betas will be available through the Software Update mechanism in...

iPhone 12 Models Might Support Reverse Charging of Future Apple Accessories According to FCC Filing

Tuesday October 27, 2020 6:25 pm PDT by
iPhone 12 models could have an inactive wireless charging feature for accessories, according to an FCC filing discovered by VentureBeat's Jeremy Horwitz. In the filing, Apple said that 2020 iPhones support a wireless charging function that will seemingly be enabled for at least one future Apple accessory:In addition to being able to be charged by a desktop WPT charger (puck), 2020 iPhones...