
Safari is sending every search query to Apple - MrGando
https://gist.github.com/landonf/04c25e83687fe0867892
======
cmelbye
This is inaccurate alarmism. It shouldn't be surprising that the search bar
makes autocomplete requests to Apple as you type. The address, phone number,
and map link that popped up when you typed in the name of a local business,
for example, didn't just appear out of thin air.

However, it seemed suspicious to me that Apple would make it impossible, as
the author claims, to type in the Safari address bar without sending queries
to Apple. So, I fired up Charles proxy to confirm my suspicions.

When using Safari default settings, typing in the address bar resulted in a
few requests to Apple and Google autocomplete APIs. Then, I turned off
"Include search engine suggestions" and "Include Spotlight Suggestions" in
Safari search preferences. (Safari -> Preferences -> Search)

As I initially believed, no requests were sent whatsoever when typing in the
address bar after those settings were disabled. Can we put out our pitchforks
yet, or am I missing something?

~~~
bo1024
It's not at all inaccurate.

Might be alarmism, I don't know. But I think it just demonstrates the ways in
which users' expectations about privacy are mismatched with the products they
use. For example, your average non-tech-savvy user would never realize that an
important privacy setting is in a search setting marked "suggestions".

It's hard to say more without seeing the text of Apple's Privacy Documentation
that is referred to at the top of the article.

~~~
jsmthrowaway
> For example, your average non-tech-savvy user would never realize that an
> important privacy setting is in a search setting marked "suggestions".

Is this not clear enough?

[http://i.imgur.com/i1Zq3E4.png](http://i.imgur.com/i1Zq3E4.png)

~~~
ljfuller
Apparently not :-)

Those instructions disable "Spotlight Results" only in Spotlight-as-in-
desktop-Spotlight.

------
thought_alarm
The author of this post is confused about Safari and Spotlight privacy
settings.

Spotlight search suggestions are a major new advertised feature in OS X and
iOS.

To disable Spotlight Search Suggestions in Safari, open the Safari preferences
and de-select "Search > Include Spotlight Suggestions".

To disable Spotlight Search Suggestions in the system Spotlight search menu,
open the System Preferences and de-select "Spotlight -> Spotlight
Suggestions".

~~~
mitchty
Yep that looks to be spot on based on tcpdumps, although it would be nice to
be made aware of this change in the release notes maybe.

------
adamcarson
Tim Cook last month:

“Our business is not based on having information about you. You’re not our
product ... I think everyone has to ask, how do companies make their money?
Follow the money. And if they’re making money mainly by collecting gobs of
personal data, I think you have a right to be worried.”

“We take a very different view of this than a lot of other companies have. Our
view is, when we design a new service, we try not to collect data,”

“We’re not in that business. I’m offended by lots of it. And so, I think
people have a right to privacy.”

[http://blogs.wsj.com/digits/2014/09/15/apples-cook-your-
data...](http://blogs.wsj.com/digits/2014/09/15/apples-cook-your-data-is-not-
our-business/)

~~~
onewaystreet
This doesn't contradict that. Spotlight provides web search results, how do
people think that works?

~~~
gumby
According to TFA, "In Yosemite, all Safari web searches are sent to not only
the search engine you've selected ... but _also_ to Apple..."

So as you say Spotlight web searches have to contact some sort of search
engine, but I don't know of a legitimate reason why Apple should need to know
about them _as well_.

~~~
Alphasite_
Safari also shows the top spotlight search result iirc.

------
ekianjo
The thing about Apple is the positive bias they always get on HN. In these
comments:

> Is there ANY evidence that Apple is collecting data.

> I'm not sure it's a contradiction either, more of an omission, he doesn't
> specifically address search data in that interview

> Doesn't seem like a data collection initiative. It seems more like a
> complementary search engine

> Do they do autocompletion suggestions like Chrome? That would seem like a
> good reason to collect this data.

> I actually personally don't mind sending my search data to Apple

It's just amazing. When Microsoft, Google or anyone else does it, it's EVIL
and there's no other way to look at it, but when Apple does it, it's somehow
perfectly OK, because, you know, they are _the good guys_.

~~~
madeofpalk
I guess this is where the confirmation bias comes in.

As someone who would consider themselves to be a realistic 'Apple apologist'
(I like Apple, as a company and their products, and tend to assume the
positive for everything they do), I see a large negative bias against Apple on
HN.

~~~
ekianjo
Probably it depends where you come from. If you always spend time on MacFans
kind of forums, then yeah, I guess the HN crowd can sound pretty negative to
Apple. But in comparison with other stories out there on HN, I feel Apple
always gets away with better feedback no matter what they do.

------
wilg
Post seems to indicate that the wrong "Spotlight Suggestions" was unchecked.
One in System Preferences (which the post mentions disabling), and one in
Safari itself (that the post does not mention).

I would expect the one in System Preferences to disable suggestions in the
system-wide search only, and the one in Safari to disable suggestions in
Safari only.

Screenshots of the two options:
[http://imgur.com/a/TWDxy](http://imgur.com/a/TWDxy)

------
dmethvin
Google and Microsoft do this too when you enable real-time searching via the
address bar, but both are pretty good at letting you know it happens. Doesn't
Safari have some kind of first-run experience where the user gets some notice
on this?

~~~
bane
Google and Microsoft also run search engines.

~~~
jfoster
Perhaps Apple internally already consider themselves a search engine. This
might only be a temporary misalignment of user experience and data being sent
to Apple.

~~~
andy_ppp
Without the requisite user data or some fantastic and soon to be copied
algorithm I would expect their search experience to start off about as well as
Apple Maps.

You can bet they are going to build it though and it'll look nice.

~~~
jfoster
That might depend on whether they learnt anything from the Apple Maps debacle.
They might approach something like that much more tactfully the next time they
try it.

With the right expertise on the team and some decent exposure to real users
prior to the wide release, they may be able to deliver something that people
enjoy using. The micro-features that delight users are something that Apple
has traditionally done well, and are also the type of thing that go a long way
in a product like a search engine.

------
declan
Assuming that Apple _does_ disclose this adequately -- meaning they'd be
legally in the clear -- I'd still want to know the answers to: How do I delete
the records of my searches saved on Apple's serves? (Google lets me delete my
search history.) How do I randomize my unique ID? How many FedGov or
state/local agencies have showed up demanding info on which users searched for
"dirty bombs" or "how to join Al Qaeda?" Does Apple always require a warrant?
Etc.

Separately, Kevin McArthur (author of the Pro PHP book) is reporting this
evening on Twitter that Spotlight is harvesting user locations after updating
to Yosemite, apparently before the opt-out option is presented:
[https://twitter.com/KevinSMcArthur/status/523975643340353537](https://twitter.com/KevinSMcArthur/status/523975643340353537)
[https://twitter.com/KevinSMcArthur/status/523977472627335168](https://twitter.com/KevinSMcArthur/status/523977472627335168)

~~~
itg
>How do I delete the records of my searches saved on Apple's serves? (Google
lets me delete my search history.)

Google deletes the search history you see but everything is still stored on
the servers.

~~~
declan
[https://support.google.com/websearch/answer/465?hl=en](https://support.google.com/websearch/answer/465?hl=en)
"When you delete items from your Search History, they are no longer associated
with your Google Account."

Whether you think that's sufficient or not, at least I have the option. And
the last octet in my IP address is automatically modified after 9 months and
deleted after 18 months even if I don't do anything. If you can tell me how I
can do the same thing with Apple's search log files, and what Apple's IP
address retention policy for its search log files, I'd be much obliged...

------
rorydh
The DuckDuckGo guys are not gonna be happy...

~~~
thought_alarm
Sending your searches to DuckDuckGo is OK because they're committed to
protecting your privacy.

Sending your searches to Apple is bad because... they're also committed to
protected your privacy but they're Apple so it's a big conspiracy.

~~~
Sir_Cmpwn
You may have missed the point. Sending them to DDG is OK because the user
_intended to send them to DDG_. That was the entire purpose of the user's
searching experience to begin with. Apple being strung into it is different -
the user doesn't need Apple's involvement to complete the search.

~~~
thought_alarm
DuckDuckGo Search Suggestions and Spotlight Search Suggestions are separate
features in Safari. Either can be enabled or disabled by the user in the
Safari settings.

------
axotty
I use Little Snitch to monitor and control all my outbound traffic. I've
noticed a lot more requests to Apple's servers with Yosemite than with
Mavericks.

------
itazula
Might this be for sharing one's browsing history across devices? This seems
like old news: [http://www.tekrevue.com/safari-sync-browser-
history/](http://www.tekrevue.com/safari-sync-browser-history/) Perhaps that
type of syncing can be turned off? (I don't have Yosemite installed, so I
don't know.)

------
orng
Simple workaround: don't use safari. Long term solution: don't by Apple
products. Or at least don't run their software.

~~~
pserwylo
Not quite sure why you got down voted. I bought an iPod nano several years
ago, because I quite liked the hardware/software that Apple made. However when
I found out that they intentionally broke compatibility with 3rd party music
software that isn't iTunes, I made the decision to never buy Apple products
again.

I don't feel that I'm particularly missing out by making this decision
(although I am aware that many other vendors probably have similar ethical
problems associated with them).

~~~
ggreer
Can you link to an explanation of how Apple intentionally broke 3rd-party
syncing with iPod Nanos? I don't know what kerfuffle you're referencing.

~~~
makomk
It's long enough ago that a lot of the technical information has dropped off
the web (or in some cases been DMCAed offline by Apple[1]), but the short
answer is they started authenticating the iPod Nano music database using a
cryptographic MAC with a per-device key derived using a secret algorithm.
Without the key, third-party software couldn't add or remove songs. They've
got more aggressive about it with each generation too; for the 5th gen iPod
Nano the code to generate the key had the same kind of obfuscation as their
actual DRM code[2], and there's no open source support for the 6th gen because
it's just too hard to reverse-engineer.

[1] [http://yro.slashdot.org/story/08/11/20/201246/apple-dmcas-
ip...](http://yro.slashdot.org/story/08/11/20/201246/apple-dmcas-ipodhash-
project)

[2]
[https://web.archive.org/web/20080901013029/http://www.bluwik...](https://web.archive.org/web/20080901013029/http://www.bluwiki.com/go/Itunes_obfuscation)

------
shekyboy
Doesn't seem like a data collection initiative. It seems more like a
complementary search engine. Apple spotlight search is trying to find other
contextual results which may not come back from typical search engines. For
example: Apps, Music etc.

I am sure you can directly search on google or duckduckgo to avoid that.

~~~
aikah
Whatever they do,as long as they make it clear it is fine.I think that's an
important thing users should be made aware of.It's not a big scandal but it's
good practice whenever a soft does that to have the user's explicit consent.

For instance IDEs often ask if they can submit anonymous datas to a server
from the software.

------
jonym
Disabling "Include Spotlight Suggestions" in Safari Preferences seems to make
it stop.

~~~
ajross
FTA: _In Yosemite, all Safari web searches are sent to not only the search
engine you 've selected (e.g., Google, DuckDuckGo), but also to Apple, even if
you've disabled "Spotlight Suggestions"_

~~~
threeseed
It's because the author is completely wrong.

Disable the Smart Search features in Safari and it won't send anything to
Apple.

------
miles
Here's a tweet from Edward Marczak back in June about this behavior:

[https://twitter.com/marczak/status/481818945318428673](https://twitter.com/marczak/status/481818945318428673)

with a recommendation to block api.smoot.apple.com.

~~~
chockablock
That seems to be about Spotlight searches, not web searches using Safari.

(And arguably seems like a worse behavior to me, as my Spotlight search terms
are often for private info I'm trying to locate on my disk.)

~~~
thought_alarm
If you're concerned about your privacy, you should look at System Preferences
> Spotlight > About Spotlight Suggestions and Privacy:

About Spotlight Suggestions & Privacy

When you use Spotlight, your search queries, the Spotlight Suggestions you
select, and related usage data will be sent to Apple. Search results found on
your Mac will not be sent. If you have Location Services on your Mac turned
on, when you make a search query to Spotlight the location of your Mac at that
time will be sent to Apple. Searches for common words and phrases will be
forwarded from Apple to Microsoft's Bing search engine. These searches are not
stored by Microsoft. Location, search queries, and usage information sent to
Apple will be used by Apple only to make Spotlight Suggestions more relevant
and to improve other Apple products and services.

If you do not want your Spotlight search queries and Spotlight Suggestions
usage data sent to Apple, you can turn off Spotlight Suggestions. Simply
deselect the checkboxes for both Spotlight Suggestions and Bing Web Searches
in the Search Results tab in the Spotlight preference pane found within System
Preferences on your Mac. If you turn off Spotlight Suggestions and Bing Web
Searches, Spotlight will search the contents of only your Mac.

You can turn off Location Services for Spotlight Suggestions in the Privacy
pane of System Preferences on your Mac by clicking on “Details” next to System
Services and then deselecting “Spotlight Suggestions”. If you turn off
Location Services on your Mac, your precise location will not be sent to
Apple. To deliver relevant search suggestions, Apple may use the IP address of
your Internet connection to approximate your location by matching it to a
geographic region.

Information collected by Apple will be treated in accordance with Apple’s
Privacy Policy, which can be found at www.apple.com/privacy.

~~~
miles
_If you 're concerned about your privacy, you should look at System
Preferences > Spotlight > About Spotlight Suggestions and Privacy_

The problem is that even after disabling it there, Spotlight still attempts to
phone home. Here's a screenshot with "Spotlight Suggestions" and "Bing Web
Searches" disabled in System Preferences with a Little Snitch window showing
an attempted connection while searching:
[http://imgur.com/w09aNpz](http://imgur.com/w09aNpz)

------
maximumoverload
It's good that Google doesn't log your Google searches with Google Chrome.

------
privong
I wonder if the same behavior is present for the browser in iOS 8. If they
have done this on the desktop, it seems plausible they would also have done
the same on their mobile platform.

~~~
err4nt
I upgraded to ios8 and the two most buggy, crashy apps are iMessage, and
Safari, which have rendered my daily use of the device nearly useless. I gave
the hardest time copy/pasting URLs from mobile safari into iMessage, it often
pastes in something from days ago instead, no matter how many times I re-copy
things I'm other apps.

I want my device to 'just work' like it did when I bought it, updates
shouldn't feel like downgrades

------
lumberjack
Any speculation on what they might be using this data for?

~~~
thought_alarm
[http://www.apple.com/osx/better-apps/](http://www.apple.com/osx/better-apps/)

See "Safari: A more intelligent way to search."

------
alex4nder
Out of the corner of my eye, I read that as: Safari is sending every search
query to an Apple //c. Everything started making sense.

------
jake223
A few years ago there was a minor scandal about microsoft's Bing "stealing"
google results through the internet explorer search box. It seems strange that
apple would have that kind of motivations, given that they don't have a search
engine of their own... Here's the accusatory blog post google made:
[http://googleblog.blogspot.com/2011/02/microsofts-bing-
uses-...](http://googleblog.blogspot.com/2011/02/microsofts-bing-uses-google-
search.html)

------
robryan
Do they do autocompletion suggestions like Chrome? That would seem like a good
reason to collect this data.

------
fnord0
couldn't one just flood this with false positives? looks like a POST to
'api.smoot.apple.com' in JSON format. I'd suspect random entries would make
the overall data collected alot less useful...

~~~
madeofpalk
I'm going to assume that Apple (well, the engineers there) are at least as
smart as you and had previously taken this into consideration.

------
epicfail
This appears to just be Safari syncing with your iCloud Account across all
your iCloud enabled devices. That would be why the data is getting sent to
Apple.

------
danielparks
Lovely. I haven't got Yosemite, yet, but I wonder what happens when you
disable api.smoot.apple.com (say via /etc/hosts)?

~~~
johnpowell
I did earlier and there is no noticeable difference in Safari.

------
steeve
So nowadays Apple is posing itself as the champion of privacy, and yet they
pull this shit...

------
coffeedrinker
Safari private browsing is broken too. Just private browse, quit safari,
reopen safari and then check in the preferences on the privacy tab and see the
cookies, etc.

