3

I just bought my first Apple product (iPhone) a few days ago and from the moment I switched on I have been asked to use the Apple ID and iCloud for pretty much everything.

I have a concern, i.e. if I have an Apple ID registered with my real name, address, etc. will Apple and/or iCloud always know all my browsing data, my emails, email passwords, etc.?

If yes, is there a way to be completely "cut off from the cloud"?

I am not feeling completely secure enough to check my normal e-mail from the iphone until I am 100% sure nobody (at least at Apple) can read it.

What steps can I take to ensure that my data is least exposed to the world/Apple?

e.g. would using fake personal data help?

If you ask why, well, there's nothing much I want to hide except some nighttime activities I don't want anybody to know about - for obvious reasons :-)

  • Why the down vote? He has a legitmate concern for his/her privacy. Also comprimising Apple ID's via Apple customer care and other methods in order to access Apple devices data and to track devices is a well known problem. – Brian Duke Oct 8 '14 at 21:47
3

Apple is generally good about privacy and security, and risks their reputation if they were to violate user expectations by secretly looking at private data they say they don't look at. However, for the more cautious (including me), some default settings do need to be changed. Keep in mind also that iOS devices access a number of non-Apple "cloud" services in their default state, not just Apple services. A few general points, and a few specific default settings changes:

  1. You do not need an AppleID to use an iOS device, unless you want to take advantage of web-based services such as iTunes Store, App Store, and iCloud.

  2. You can supply fake data to create an AppleID, and use a gift card to fund any purchases. Just remember to keep track of exactly what info you provided.

  3. You can actually use multiple AppleIDs for many of the the different services, e.g., iTunes, iCloud, Home Sharing (the older system, not to be confused with Family Sharing), etc.

  4. There are clearly trade-offs between the usability and convenience of a smartphone, and the degree to which you prioritize privacy and security.

  5. Assuming you are using a non-Apple secure email provider, there is little concern about Apple being able to access your email. Secure POP/IMAP/SMTP is encrypted directly between your device and your email provider. Similar for web browsing to secure (https) sites.

  6. Take a long look at all available Settings, in the context of the threats you are most concerned about. There are privacy-related settings in areas other than Settings>Privacy.

  7. I'd suggest considering keeping all three radios off unless explicitly needed (cellular, wi-fi, bluetooth) to protect against carrier and local physical tracking. I'd also suggest keeping Location Services turned off at all times. But before you do, especially if you will use it from time to time, tweak the detailed Location Services settings to restrict what kinds of accesses apps and Apple can have. If you have Location Services on at the same time as Wi-Fi, Apple will, like Google and others do, catalog the GPS Location of wi-fi access points the device can "see" - this includes yours and those belonging to others. Bonus to keeping radios and/or Location Services off: improved battery life.

  8. Make sure your passcode is strong (more than just four digits), and make sure your AppleID account(s) are strongly secured. If you are concerned about people seeing activity happening on your phone, set the Settings>Passcode>RequirePasscode appropriately and restrict what notifications and info appear in your lock screen.

  9. Never associate your device with an "integrated" Facebook or Twitter account. There is some evidence that "integrated" apps have privileged access to private APIs.

  10. In Settings>Privacy>Advertising, turn on Limit Ad Tracking and frequently Reset Advertising Identifier. VendorID is another unique ID apps can access. To reset VendorID, you must delete every app from that vendor. Then you may re-install them.

  11. Don't use HealthKit apps. The legal protections are very unclear at this point, but are likely nowhere near as good as traditional channels such as doctors.

  12. Don't use Siri if you don't want your Contacts sent to Apple. There are reasonable privacy protections built around Siri's access to your Contacts, but they will be sent to Apple when you turn Siri on. Apple says they are deleted every time you turn Siri off.

  13. Restrict Spotlight Search and Safari from pinging external servers for outside data. See: Settings>General>Spotlight Search & Settings>Safari.

  14. Turn off Background App Refresh Settings>General>Background App Refresh, or at least only allow apps that support it to use Background App Refresh only when they are the active app. This is especially important if you use Location Services or allow apps access to other unique patterns such as Motion, Microphone, Camera, etc. Bonus: improved battery life.

  15. Set Settings>Privacy>Diagnostics & Usage to "Don't Send".

  16. If you do use Location Services and have weather in your Notification Center, your location will be periodically sent to weather.com.

  17. Name your phone something common/generic, in Settings>General>About>Name. Apps have access to your device name.

More here: https://www.apple.com/br/ipad/business/docs/iOS_Security_Oct12.pdf and here: https://www.apple.com/privacy/manage-your-privacy/

  • 1
    Also more at support.apple.com/kb/ht4865 – Alan Shutko Oct 9 '14 at 21:42
  • 1
    Strongly suggest turning off "Frequent Locations" as well. Under Settings>Privacy>Location Services>System Services>Frequent Locations This setting stores all the places you've been via your GPS, its quite scary to see it on a map every where you've been and how often you've been there. – Fyrefly Oct 10 '14 at 17:51
  • Apple does say that Frequent Locations is only stored locally on your device and not sent to Apple (support.apple.com/kb/HT5594), but to be extra cautious, or to prevent others who may access your device from seeing your history, this should be disabled. – pseudon Oct 11 '14 at 19:18
  • One other thing to be aware of: it's unknown whether Apple does this, but some non-Apple apps (or their embedded 3rd-party ads or widgets) engage in device fingerprinting to track users/devices. There is some evidence that in addition to things like Phone name, AdvertiserID, and VendorID, these apps are accessing your process list (or testing custom URL schemes) to see what other 3rd-party apps you may have. There's really not much more you can do to detect or mitigate device fingerprinting. I really wish it was illegal to stalk and surveil you this way. – pseudon Oct 11 '14 at 19:33
1

Tapping Settings > General > About > Diagnostics & Usage will allow you to choose between Automatically Send and Don't Send.

Turn off iCloud and don't use it at all on iPhone.

Settings > iCloud, then tap to turn on or off iCloud features

Also review Apple Legal/Privacy Page for full detailed information.

0

when it comes to privacy Apple is your biggest friend.

"if I have an Apple ID registered with my real name, address, etc. will Apple and/or iCloud always know all my browsing data, my emails, email passwords, etc.?"

simple answer: no. just no. In fact unlike most companies Apple can't even bypass your password or anything like that. They need your permission for everything.

"e.g. would using fake personal data help?" Don't do this, purely for the sake of getting future support. Like I said Apple can't access your data in any way without your permission

  • Absolutely, at Apple, security and privacy is of paramount importance. – Thomas Jones Oct 8 '14 at 8:57
  • Welcome to Ask Different, Elexion. – Thomas Jones Oct 8 '14 at 8:57
  • Hold on... are you being sarcastic? – BramleyAppleNewbie Oct 8 '14 at 18:50
  • Does this include when the NSA wants data Jeffery? – Fyrefly Oct 10 '14 at 17:49
  • If the NSA targeting you is seriously part of your threat model, you don't want a smartphone at all. I assume the gist of this question is: "How do I maintain control (manage my privacy and obscurity), and make my own choices about how much data I share, and with whom (which commercial providers)?" – pseudon Oct 11 '14 at 19:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .