Apple’s Safari tracking prevention tool is flawed, can compromise user privacy, Google says

Google engineers said a tool Apple developed to help users avoid web tracking is fundamentally flawed and creates more problems than it solves.

The Intelligent Tracking Prevention (ITP) feature on Apple’s Safari web browser, which is meant to block tracking software used by digital advertisers, can be abused to do the opposite, according to a paper released Wednesday by Google researchers. Google told Apple about the problem in August, and in December the iPhone maker published a blog post saying it had fixed the issues and thanking Google for its help.

But Wednesday’s paper concluded that the problems go beyond the issues that Apple addressed. Instead of making a big list of cookies to block, Apple’s ITP continuously learns what websites users visit and which kinds of cookies try to hitch a ride. Over time, this creates unique cookie-blocking algorithms for each web surfer that can be used to identify and track them, according to the paper.

“I can assure you that they still haven’t fixed these issues,” Justin Schuh, engineering director for Google’s Chrome browser, said on Twitter. Apple’s December blog post “didn’t disclose the vulnerabilities or appropriately credit the researchers,” he added. Apple said the bugs mentioned in the report were patched in December, but declined to comment further.

This is not the first time the two tech giants have clashed over privacy. Apple chief executive officer Tim Cook has criticised internet companies for collecting too much personal information, and last year Google researchers reported a two-year long vulnerability in the iPhone maker’s software.