Google Also Exploiting Enterprise Certificates to Bypass iOS App Store for Data Collection [Update: Disabled]

[MacRumors]

Facebook is facing the wrath of Apple today for misusing an enterprise certificate meant for internal use to get Facebook users to sideload a data harvesting "Facebook Research" app that violates App Store policies, and as it turns out, Google has been doing the exact same thing.

According to TechCrunch, Google has been distributing an app called "Screenwise Meter" using the enterprise certificate installation method since 2012.

Google has been privately inviting users aged 18 and up (or 13 for those part of a family group) to download Screenwise Meter, an app that is designed to collect information on internet usage, including details on how long a site is visited to apps that are downloaded.

By asking Screenwise Meter users to download the app using an enterprise certificate, Google is able to bypass App Store rules that prevent apps from gathering this kind of data from iPhone users.

Apple just this morning revoked Facebook's enterprise certificate for this exact same activity, which has rendered all of Facebook's internal apps nonoperational and has created chaos at Facebook's headquarters. Facebook employees are not able to use any of the internal apps that they rely on to get work done.

The Screenwise Meter app that Google uses lets users earn gift cards for sharing their traffic and app data. It is part of Google's Cross Media Panel and Google Opinion Rewards programs that provide rewards to people for installing tracking software on their smartphones, web browsers, routers, and TVs.

According to TechCrunch, Google is more forthcoming about the kind of data that it's collecting than Facebook, but that doesn't change the fact that Google is using an app installation method that appears to violate Apple's enterprise certificate rules in the same way the Facebook Research app did.

Additionally, people who install these kinds of apps for rewards may not fully understand the extent of the data that's collected.

Putting the not-insignificant issues of privacy aside -- in short, many people lured by financial rewards may not fully take in what it means to have a company fully monitoring all your screen-based activity -- and the implications of what extent tech businesses are willing to go to to amass more data about users to get an edge on competitors, Google Screenwise Meter for iOS appears to violate Apple's policy.

Apple and Google have not yet commented on the Screenwise Meter app, but if Apple does decide that Google is also violating its enterprise rules, which clearly state that the enterprise program is for distributing internal employee apps only, Google too could see the enterprise certificate used for the Screenwise app revoked.

Apple could also punish Google in the same way that it punished Facebook by revoking all of the company's internal apps that use the same certificate.

Update: Google has issued an apology and has disabled its Screenwise Meter app on iOS devices. "The Screenwise Meter iOS app should not have operated under Apple's developer enterprise program -- this was a mistake and we apologize. We have disabled this app on iOS devices. This app is completely voluntary and always has been. We've been upfront with users about the way we use their data in this app, and we have no access to encrypted data in apps and on devices, and users can opt out of the program at any time."

Article Link: Google Also Exploiting Enterprise Certificates to Bypass iOS App Store for Data Collection [Update: Disabled]

 

[NT1440]

Didn’t take long for that shoe to drop.

It’s time for people to realize that the big players in tech are surveillance operations, full stop.

 

[teknikal90]

awkward.

Apple vs. the world.
Go Apple

 

[GreenPixel]

Alright Apple...apply the rules equally, please.

 

[Chrjy]

Blimey, are all these companies corrupt!

 

[chumps52]

It'll be interesting to see if their enterprise certificates are revoked too.

 

[AlumaMac]

Data Collectors gonna collect.

 

[ir_fuel]

Difference with Facebook:
Google pays Apple so Apple uses Google Search on the iOS platform.
This will be interesting.

 

[Chrjy]

It'll be interesting to see if their enterprise certificates are revoked too.

They have to revoke them....no doubt they will.

 

[motm95]

One of these companies will eventually birth the Matrix.

 

[ir_fuel]

And the question one needs to ask: does Android contain this kind of spyware out of the box?

 

[Jyby]

Science Rules!

 

[tekchic]

And the question one needs to ask: does Android contain this kind of spyware out of the box?

Do you REALLY need to ask that? Of course it does.

 

[KPandian1]

Not surprising that Google is doing this intentionally.

Just waiting to see what Apple does with this information - same issue, different criminals.

 

[Chrjy]

Lots of companies, including small businesses, exploit enterprise certificates... And why is that? Because AppStore rules are annoyingly restrictive..

Restrictive for good reason....

 

[twocents]

Blimey, are all these companies corrupt!

Rhetorical question but how do you think these companies got to where they are today? Playing fair and by the rules only rewards you with integrity which used to mean something

 

[gavroche]

Blimey, are all these companies corrupt!

I think the problem is that the corporate mindset is to *increase* profits. It doesn't matter how well they did this or last year. They are judged by increasing profits. So instead of sitting in their meetings being happy with however profitable they are... they have to sit there thinking of how they can make a little more.

 

[GreenPixel]

Lots of companies, including small businesses, exploit enterprise certificates... And why is that? Because AppStore rules are annoyingly restrictive..

Only annoying if you don't care about Apple's customer's privacy.

 

[dgdosen]

So - is there a list of apps that are violating this policy/installing these enterprise certs?

 

[NT1440]

Blimey, are all these companies corrupt!

I’m shocked, SHOCKED, that there is gambling in this establishment!

 

[cmaier]

Google is a great company and I, for one, welcome my certificate-using overlords.

 

[Chrjy]

Rhetorical question but how do you think these companies got to where they are today? Playing fair and by the rules only rewards you with integrity which used to mean something

It's my optimist side which hopes there might be good companies in the world....the optimist in me is starting to wane which I think is sad!

We need more optimism in this weird world we live in!

 

[ecschwarz]

Realistically, I know that it's impossible for me to do anything on the internet and not somehow interact with these companies, but the last few months (years?) have had me really questioning if I should go out of my way to avoid certain players as much as possible.

I got rid of Facebook a year ago and try not to be the "hey, I got rid of Facebook" person, but if it does come up, there's still people who seem shocked (as though I'm living without electricity or something like that). I never got locked into Gmail, but there's a few other Google services that I've been winding down over the years (the Hangouts changes have led me to move away from Google Voice and eventually think about deleting my account).

Recently, I watched Valley of the Boom on National Geographic Channel and it was a good look at a few of the '90s tech companies (really just a trip down memory lane) and it struck me that "evil" Microsoft of that era tended to be ruthless, but played much cleaner than some of companies today.

No company is perfect (certainly not Apple), but I feel like there's a point where one can opt-out of certain products/companies even if they're popular.

 

[EdT]

Wow, Google skirts the rules and collects and sells data without permission. I’m shocked, SHOCKED, I tell you.

And this means that they have violated their new motto: “Don’t get caught doing Evil”.

 

[coolfactor]

Alright Apple...apply the rules equally, please.

I really hope Apple has the balls to apply the rules equally. They definitely should. But since 2012 and this is just coming to light now? I have a feeling that Apple was aware of this and chose to ignore it. Time to step up and do the right thing... okay, Apple?