Curl iOS Privacy Manifest

[naahmedea]

Hi Team, I was wondering if there is going to be any support for privacy manifests with Apple requiring curl to provide one as it uses the API mentioned in this doc-> https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api?language=objc

Could some one please help?

[naahmedea]

Also, Let me know if if the below reason should be declared as part of curl privacy manifest file?

1. 0A2A.1 Declare this reason if your third-party SDK is providing a wrapper function around file timestamp API(s) for the app to use, and you only access the file timestamp APIs when the app calls your wrapper function. This reason may only be declared by third-party SDKs. This reason may not be declared if your third-party SDK was created primarily to wrap required reason API(s).
   Information accessed for this reason, or any derived information, may not be used for your third-party SDK’s own purposes or sent off-device by your third-party SDK.

2. 35F9.1 Declare this reason to access the system boot time in order to measure the amount of time that has elapsed between events that occurred within the app or to perform calculations to enable timers. Information accessed for this reason, or any derived information, may not be sent off-device. There is an exception for information about the amount of time that has elapsed between events that occurred within the app, which may be sent off-device.

[nickzman]

I think that’s about right. curl does use fstat() and mach_absolute_time() on iOS, two APIs that have unfortunately been abused for fingerprinting users, but as far as I can tell, curl only ever uses that information internally & doesn’t send it off-device.

@bagder may be able to make a more authoritative statement about this.

[naahmedea]

Sure, It would be great if you could tell us what to include in curl's privacy manifest file.

[Nithsua]

@nickzman How exactly are they using this API to fingerprint. Just curious mind, how can a clock API can be used for fingerprinting

[dfandrich]

I think that’s about right. curl does use fstat() and mach_absolute_time() on iOS, two APIs that have unfortunately been abused for fingerprinting users, but as far as I can tell, curl only ever uses that information internally & doesn’t send it off-device.

"curl -I file:///etc/passwd" can definitely send much fstat data off device, if the caller wants to do that.

[bagder]

We are assisting you. Right here.

[naahmedea]

Sure @bagder .

Currently, we are thinking of adding the below details in the cURL privacy manifest file, Could you please review and suggest to us if anything more to be added or removed?

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>NSPrivacyTracking</key>
	<false/>
	<key>NSPrivacyTrackingDomains</key>
	<array/>
	<key>NSPrivacyCollectedDataTypes</key>
	<array/>								
  	<key>NSPrivacyAccessedAPITypes</key>
        <array>
            <dict>
                <key>NSPrivacyAccessedAPIType</key>
                <string>NSPrivacyAccessedAPICategoryFileTimestamp</string>
                <key>NSPrivacyAccessedAPITypeReasons</key>
                <array>
                    <string>0A2A.1</string>
                </array>
            </dict>
            <dict>
                <key>NSPrivacyAccessedAPIType</key>
                <string>NSPrivacyAccessedAPICategorySystemBootTime</string>
                <key>NSPrivacyAccessedAPITypeReasons</key>
                <array>
                    <string>35F9.1</string>
                </array>
            </dict>
        </array>
</dict>
</plist>

[bagder]

Sorry, but I have no idea what those things mean.

[naahmedea]

@bagder No problem, Let me explain you what the above means.

Curl uses several APIs such as stats(), fstat(), lstat(), mach_absolute_time(), and statvs(). The Apple team requires third-party SDKs to specify the reasons for using these APIs in their code.
We have made some assumptions about these reasons below, which we would like you to review. You can take a look, confirm if our assumptions are correct, and let us know if anything needs to be added or removed.

0A2A.1 Declare this reason if your third-party SDK is providing a wrapper function around file timestamp API(s) for the app to use, and you only access the file timestamp APIs when the app calls your wrapper function. This reason may only be declared by third-party SDKs. This reason may not be declared if your third-party SDK was created primarily to wrap required reason API(s).
Information accessed for this reason, or any derived information, may not be used for your third-party SDK’s own purposes or sent off-device by your third-party SDK.

35F9.1 Declare this reason to access the system boot time in order to measure the amount of time that has elapsed between events that occurred within the app or to perform calculations to enable timers. Information accessed for this reason, or any derived information, may not be sent off-device. There is an exception for information about the amount of time that has elapsed between events that occurred within the app, which may be sent off-device.

For more detailed information about the reasons listed by the Apple team, please refer to their official documentation here:
https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api?language=objc

[jay]

asking libraries to meet apple [legal] requirements as a third party sdk is a service they should provide. no we don't send information off-device on our own.