I don't presume to stop them from doing whatever they're permitted to do, so instead I ask myself:
"Should I uninstall the apps mentioned as their presence leaks information about me, or should I uninstall Twitter for spying on my device?"
Initially I thought that I use Twitter, so that must be high value... I'll delete the other apps. Then, looking through the list it occurs to me that as this expands I'd need to uninstall everything else except Twitter to render their spying useless.
Now I feel that the best solution is a very simple one: Uninstall Twitter and use the web version instead.
I guess that's not the outcome they want to be steering people towards.
Edit: The web version feels like a very old iOS app. This isn't necessarily a bad thing, it's fast and snappy.
My current twitter install on android doesn't have the feature to disable it yet, which means that i have to follow an upgrade path that includes updating -> toggling flight mode -> opening the app (if that works) and then toggling the setting.
I cannot disable it from the web interface, or this is put under a very obtrusive description.
Example: Game app has buttons on a website to play specific levels with some special powerup, so you can link to it just like a website but in the app play the level and bypass the main screen etc.
It is a bit like DNS hosts within the devices but the only problem is it is not standard and there is no listing so it is more like old school file type or port claiming, there may be clashes/name collisions.
This is so that after auth the Facebook app has a URL to fast app switch back to and handle the authentication result.
From their help center [https://support.twitter.com/articles/20172069]
How will I know this feature is turned on for my account? We will notify you about this feature being turned on for your account by showing a prompt letting you know that to help tailor your experience, Twitter uses the apps on your device. Until you see this prompt, this setting is turned off and we are not collecting a list of your apps.
So, they collect the data first, and then they prompt the user telling them what they have done. This is the opposite of privacy friendly.
How do I turn this feature off and remove my data from Twitter?
Note carefully the overloaded meaning of the word Twitter here. Do they mean the Twitter app, or the Twitter service, or Twitter as a company? Grammatically and meaning-wise, the first one is the only one that makes sense. Which is very alarming...
Because it means, after they "remove" your data from the app, they still have your data. Or does it? It's not completely clear, which is part of the problem. The help text reads one way (no worries, you can delete your data) on a quick reading, but a completely different way on a careful reading.
You can easily adjust the setting that allows Twitter to collect a list of apps on your mobile device. Once you turn off the setting, we will remove your app graph data from Twitter and stop future collection.
Again, one has to wonder what they mean by "remove your app graph data from Twitter." Call me paranoid but to me this reads like weasel words and they still keep a copy of your data, just not on Twitter, whatever they mean by that.
So to recap, the really bad known thing here is they collect the data first, and ask permission later. The possibly really bad unknown thing is maybe they keep the data even after you think you are asking them to get rid of it, while trying to make it appear that they don't.
1. There is no API abuse or sneakiness happening here. They are just using a known, unrestricted API: https://developer.apple.com/library/ios/Documentation/UIKit/...:
2. Perhaps the API should be restricted?
I don't know how I feel about it. I don't know if I care if Twitter knows what other apps I have installed. This API is what allows Tweetbot to open links in Chrome, and I'd hate for that to disappear.
Maybe Apple can update the API to prompt the user and store that permission for each app?
But how you and I feel isn't the point. Each user will have their own feelings about their privacy, and they should have the ability to control their own information in the way they prefer, with prior consent and opt-in, not opt-out once the data is already taken.
It could be blocked via a permission as well (and just look like the target app is not installed.)
This is a sincere question, from their point of view what exactly are they doing and why?
that is, if Twitter links to "App X", Twitter needs to know if it can open App X directly or if it needs to direct the user to some website for App X instead.
i'd blame Apple for making this a notorious pain in the ass before i blamed Twitter for trying to fix it.
I'm really curious what the Apple AppStore review team has to say about this.
They won't be able to see what is going on unless the start the app under Instruments and document how many calls to this function are made.
I would also think they are doing run time profiling, if only to catch private API usage via NSSelectorFromString. Maybe they can add a test for excessive canOpenURL calls now.
Or maybe they don't care about this and more apps will do this kind of snooping going forward.
Tweetbot: https://gist.github.com/genadyo/295a5e8f0d743f57137f#file-gi...
Twitterrific: https://gist.github.com/genadyo/295a5e8f0d743f57137f#file-gi...
Twitterfon: https://gist.github.com/genadyo/295a5e8f0d743f57137f#file-gi...
Echofon: https://gist.github.com/genadyo/295a5e8f0d743f57137f#file-gi...
Am sure there are others.
Legitimate uses would be things like checking if you have Google Chrome installed and giving you the option to open urls in Chrome instead of Safari.
Assuming this list is accurate, many people might wonder why they need to know if you have Angry Birds Star Wars II installed.
But the thing is that URL schemes are very convenient in some cases.
One possible solution could be that you have to include all the URLs your app intends to open in its plist file. So if you're going to list hundreds then they can go ahead and reject those apps. But this wouldn't provide perfect privacy.
So my guess is that URL schemes will be yanked soon and all developers will be forced to use extensions for inter-app communication.
[1] - https://developer.apple.com/library/ios/documentation/Founda...:
[Update: OK, wow, yes I see, Twitter themselves announced the tracking: https://support.twitter.com/articles/20172069]
There are legitimate uses for this information in an app, such as for when a user is given the chance to tweet about a high score from a game, for example, and the app URL for the game could be used to get them back into the game app after they finish in the Twitter app.
I'm not saying this is the case (I don't know). It would be interesting to see whether all the apps in the list have some way that they interact with the Twitter app.
