I’m originally from Germany but I’ve been living in the UK for a few years. Yesterday I downloaded the Eurovision app and to my surprise the app greyed out the Germany option for the vote. I am not really interested in the music content but I was curious about the way in which they managed to tell where I was originally from. At the beginning I thought it was the App Store country I downloaded the app from (the German one). So I uninstalled the app, changed store (logging in with a different Apple ID registered on a different country store). Same thing. Then I tried VPNning to other counties, still the same. Does anyone know what they are using to determine the country of the phone owner? Can they access the IMEI? EAP-SIM authentication? This really caught my eye as I would be surprised if apps were allowed to access these kind of information.
-
1Does the app have/requested access to your location data?– nohillside ♦Commented May 19, 2019 at 17:00
-
Nope, no location data– MultiformeIngegnoCommented May 19, 2019 at 22:07
-
IP of your connection?– Bosque BillCommented May 21, 2019 at 19:04
-
2You're testing has been good, but another test you would need to do is to use a totally different device that's never had the Eurovision app installed on it and download it again, preferably from a different Apple ID and one that is associated with the UK store. (Although, now that Eurovision is over, would the app still allow voting?)– Monomeeth ♦Commented May 23, 2019 at 8:04
-
1Could it be based on the language of your iOS device?– JulesCommented May 24, 2019 at 12:51
1 Answer
As a Chinese living in strict censorship, I use proxy and apple id from various countries. And I often use MITM to capture packets to see the restrictions in the packet. I have to say, Apple’s Privacy Policy is doing a good job.
1、The app doesn't know which store you purchased and downloaded it from.
2、They can't access the IMEI and UUID directly from the system.
3、They may get your EAP-SIM authentication data from your isp. And your mac address is fixed every time you link wifi. Android is better in this case, you can generate a random mac address.
The most common situation I have experienced is that the app will get your carrier, which is the API provided in iOS. Tiktok Line Apple News even Apple Watch's ECG feature uses this method to identify the user's location. When your sim card is in the phone, whether you use data or Wi-Fi or even in flight mode, the app can get your carrier information.
Another possibility is that your device language is German, and your app will bring Accept-Language: XX-de
in your HTTP request header.
And if you use a device for a long time, companies with various apps on your phone may sell information to each other. Large advertising companies such as Google facebook they have enough information to generate a UUID for you.
-
Then they probably accessed EAP-SIM data: my sim is german and language phone is set to is English Commented May 29, 2019 at 17:07
-
@MultiformeIngegno In fact, I don't know much about EAP-SIM data. When your sim card is in the phone. Whether you use data or Wi-Fi or even in flight mode, the app can get your carrier information. Commented May 29, 2019 at 18:28