3 ms·
I'm far from an expert on this area, but I know there are exemptions many apps can qualify for. The most notable of these is that the encryption is limited to a
by rbritton 11y ago
I'm far from an expert on this area, but I know there are exemptions many apps can qualify for. The most notable of these is that the encryption is limited to authentication [1].
[1]: http://stackoverflow.com/questions/2135081/does-my-application-contain-encryption http://stackoverflow.com/questions/2135081/does-my-applicati...
- danieltillett 11y agoI would have thought this covered https.
- comex 11y agoI'm pretty sure "limited to authentication" means that the data is transmitted in the clear but covered by a signature. HTTPS actually encrypts, so it wouldn't count.
- rbritton 11y agoCould you not also argue that ongoing use of HTTPS after authenticating yourself with the server is to ensure the response is coming from who you intend (i.e., the server authenticating itself to you)?
- geofft 11y agoIANAL, but if you assume law matches cryptographic reality: there's such a thing as the NULL cipher, which most SSL stacks don't support (at least by default) because it's a big footgun. It will let you have traffic that's authenticated but not encrypted.
- pupeno 11y agoWhat would you rather do, argue with the US government or get an ERN and focus on your business? I know my answer ;)
- pupeno 11y agoI talked to a couple of people at Apple and they explicitly told me that use of HTTPS is not covered under the exception. I think that exception was designed to authenticate licences of software. Programs that phone home, get a toke, and decrypt it to verify you paid for it, but that's just a hypothesis.