应用上架审核被认为追踪用户行为导致被拒,这块怎么破? - V2EX
iOS 开发实用技术导航
NSHipster 中文版
http://nshipster.cn/
cocos2d 开源 2D 游戏引擎
http://www.cocos2d-iphone.org/
CocoaPods
http://cocoapods.org/
Google Analytics for Mobile 统计解决方案
http://code.google.com/mobile/analytics/
WWDC
https://developer.apple.com/wwdc/
Design Guides and Resources
https://developer.apple.com/design/
Transcripts of WWDC sessions
http://asciiwwdc.com
Cocoa with Love
http://cocoawithlove.com/
Cocoa Dev Central
http://cocoadevcentral.com/
NSHipster
http://nshipster.com/
Style Guides
Google Objective-C Style Guide
NYTimes Objective-C Style Guide
Useful Tools and Services
Charles Web Debugging Proxy
Smore
junho
V2EX    iDev

应用上架审核被认为追踪用户行为导致被拒,这块怎么破?

  •  
  •   junho Apr 6, 2021 6943 views
    This topic created in 1872 days ago, the information mentioned may be changed or developed.

    应用本身已经上架了好几年,最近更新版本是被拒绝了,原因是苹果因为 APP 手机收集设备信息生成唯一 id 追踪用户。

    “We found in our review that your app collects user and device information to create a unique identifier for the user's device. Apps that fingerprint the user's device in this way are in violation of the Apple Developer Program License Agreement and are not appropriate for the App Store.

    Specifically, your app uses algorithmically converted device and usage data to create a unique identifier in order to track the user. The device information collected by your app may include some of the following: sysctl, serviceSubscriberCellularProviders, NSFileSystemSize, isoCountryCode, and NSProcessInfo.”

    关于设备唯一 id,app 本身用了 CFUUIDCreate 来创建唯一 ID 存在 keychain 里(原因是业务要求同一个账号只能在限定设备数量登录,多了就要用手机验证),然后用到的不少第三方库也是有用到这个函数。 然后上面提及的函数,也是有不少 SDK 使用了(例如极光一键登录、阿里推送、百度统计啥的)。 所以先回复了苹果这些函数都是基于合理的需求使用而非生成设备唯一 id,然后收到回复

    “We continue to find that your app collects user and device information to create a unique identifier for the user's device. Your app may be using some of the following API to create a unique identifier for the user's device: XX_FINGERPRINTING_METHODS_XX.”

    根据提示,根据 FINGERPRINTING 关键词搜了所有 SDK 都没发现类似的。这时候就很尴尬了,不清楚苹果判断的标准是啥,也不知道哪些 SDK (闭源的)是有问题的。

    有无相关经验的 V2 可以分享下如何处理?

    PS:我遇到的情况跟这篇文章基本一致 https://www.ithome.com/0/543/769.htm

    Supplement 1    Apr 6, 2021
    主要问题是苹果认为我使用了以下函数来获取设备信息然后生成追踪用户行为的唯一 ID:
    sysctl, serviceSubscriberCellularProviders, NSFileSystemSize, isoCountryCode, and NSProcessInfo
    Supplement 2    Apr 6, 2021
    列举下用到的 SDK:
    阿里推送、极光登录、百度统计、Bugly 、腾讯云播放器、UniApp
    Supplement 3    Apr 6, 2021
    估计是下面这个原因导致了:

    V5.3.1( 更新时间:2021-01-26 )

    新增百度 CAID 采集
    Supplement 4    Apr 8, 2021
    更新一下:
    移除了百度统计后就顺利过审了
    18 replies    2021-04-06 12:33:44 +08:00
    CoCoMcRee
        1
    CoCoMcRee  
       Apr 6, 2021
    把第三方 SDK 更新一下
    然后 设备唯一表示用这个库
    pod 'FCUUID'
    typetraits
        2
    typetraits  
       Apr 6, 2021
    所以为什么不写明 app 会追踪用户呢
    hstdt
        3
    hstdt  
       Apr 6, 2021 via iPhone
    CFUUID 和隐私没关系,感觉你找错方向了
    kera0a
        4
    kera0a  
       Apr 6, 2021 via iPhone
    我也用了,这玩意应该不能追踪吧?这也过不了审?
    icyalala
        5
    icyalala  
       Apr 6, 2021 via iPhone
    就是某个第三方 SDK 被苹果标记了,但是苹果不会明说,不然 SDK 就会针对性修改。
    zsyld
        6
    zsyld  
       Apr 6, 2021
    感觉仅仅用了 CFUUIDCreate 是没问题的,
    问题是你同时收集了‘sysctl, serviceSubscriberCellularProviders, NSFileSystemSize, isoCountryCode, and NSProcessInfo’
    很像前几天的热搜百度 头条之类的搞的什么 CAID ??
    junho
        7
    junho  
    OP
       Apr 6, 2021
    @icyalala 我觉得是,但是就是不知道是哪个用到的 SDK 搞这幺蛾子。。。苹果也没明说,反正就是让我移除跟踪代码后才能提交审核
    PhanKiap
        8
    PhanKiap  
       Apr 6, 2021
    发个 ipa 出来看一看。
    junho
        9
    junho  
    OP
       Apr 6, 2021
    @zsyld 多谢提醒,我搜了下所有 SDK 的符号表,发现都有百度统计这个 SDK 都有使用到苹果提到的函数,联想到百度的尿性,emmmm
    momo07
        10
    momo07  
       Apr 6, 2021
    获取 IDFA 要获得用户的许可,不获取许可直接拿会被拒。
    mirari
        11
    mirari  
       Apr 6, 2021
    楼主有没有接入百青藤、优量汇之类的广告 SDK ?
    loginbygoogle
        12
    loginbygoogle  
       Apr 6, 2021
    各种推送各种联盟都是垃圾
    liaoyaoheng
        13
    liaoyaoheng  
       Apr 6, 2021   1
    说你有问题就整改呗。
    murmur
        14
    murmur  
       Apr 6, 2021
    百度统计那真的是隐私收集,没毛病
    Jirajine
        15
    Jirajine  
       Apr 6, 2021 via Android
    不如干脆直接拉黑 SDK,直接告诉你你的程序中含有恶意代码,恶意代码为 xxx sdk 。
    cairnechen
        16
    cairnechen  
       Apr 6, 2021
    我没太懂,我感觉你列举的这些 sdk 都用了生产唯一 id 的方法,为啥只有百度统计被揪出来了
    junho
        17
    junho  
    OP
       Apr 6, 2021
    @cairnechen 苹果没有指明是哪个 SDK 有问题,我觉得百度统计有问题是因为它明确使用了 CAID (这也是最近苹果和国内某些大厂闹矛盾的原因)
    littiefish
        18
    littiefish  
       Apr 6, 2021 via iPhone   2
    @junho 没有指明就会自我阉割,对用户来说是好事
    About     Help     Advertise     Blog     API     FAQ     Solana     5828 Online   Highest 6679       Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 89ms UTC 06:20 PVG 14:20 LAX 23:20 JFK 02:20
    Do have faith in what you're doing.
    ubao msn snddm index pchome yahoo rakuten mypaper meadowduck bidyahoo youbao zxmzxm asda bnvcg cvbfg dfscv mmhjk xxddc yybgb zznbn ccubao uaitu acv GXCV ET GDG YH FG BCVB FJFH CBRE CBC GDG ET54 WRWR RWER WREW WRWER RWER SDG EW SF DSFSF fbbs ubao fhd dfg ewr dg df ewwr ewwr et ruyut utut dfg fgd gdfgt etg dfgt dfgd ert4 gd fgg wr 235 wer3 we vsdf sdf gdf ert xcv sdf rwer hfd dfg cvb rwf afb dfh jgh bmn lgh rty gfds cxv xcv xcs vdas fdf fgd cv sdf tert sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf shasha9178 shasha9178 shasha9178 shasha9178 shasha9178 liflif2 liflif2 liflif2 liflif2 liflif2 liblib3 liblib3 liblib3 liblib3 liblib3 zhazha444 zhazha444 zhazha444 zhazha444 zhazha444 dende5 dende denden denden2 denden21 fenfen9 fenf619 fen619 fenfe9 fe619 sdf sdf sdf sdf sdf zhazh90 zhazh0 zhaa50 zha90 zh590 zho zhoz zhozh zhozho zhozho2 lislis lls95 lili95 lils5 liss9 sdf0ty987 sdft876 sdft9876 sdf09876 sd0t9876 sdf0ty98 sdf0976 sdf0ty986 sdf0ty96 sdf0t76 sdf0876 df0ty98 sf0t876 sd0ty76 sdy76 sdf76 sdf0t76 sdf0ty9 sdf0ty98 sdf0ty987 sdf0ty98 sdf6676 sdf876 sd876 sd876 sdf6 sdf6 sdf9876 sdf0t sdf06 sdf0ty9776 sdf0ty9776 sdf0ty76 sdf8876 sdf0t sd6 sdf06 s688876 sd688 sdf86