7 ms·
It was always a nice way to force my customers to implement HTTPS, the threat of Apple rejecting or removing the app. It's pretty easy to implement and inexpens
by dep_b 10y ago
It was always a nice way to force my customers to implement HTTPS, the threat of Apple rejecting or removing the app. It's pretty easy to implement and inexpensive so why people still don't do it is a complete mystery to me.
- 0x0 10y agoI think you also have to register with some US government body to obtain crypto export licenses yearly. Even if the app just uses the iOS https connection classes!
- stepanhruda 10y agoNo you don't.
- deleted 10y ago[deleted]
- 0x0 10y agoIt used to be like that, but it seems like this was changed in the last month?! http://stackoverflow.com/a/40919650 http://stackoverflow.com/a/40919650 For all the downvoters on my parent post: This blog from last year said something else: https://pupeno.com/2015/12/15/legally-submit-app-apples-app-store-uses-encryption-obtain-ern/ https://pupeno.com/2015/12/15/legally-submit-app-apples-app-... Edit: Downvote me all you want, but the OP asked why people just didn't implement HTTPS and I have first hand knowledge of several apps that chose to not implement HTTPS because the legal work required around crypto export licenses was too much to be worth it.
- stepanhruda 10y agoIt was always exempt because you weren't shipping your own crypto implementation. Apple has to comply when shipping iOS. Those apps were not shipping HTTPS for a non-reason. This recent change only made the wording clearer in iTunes Connect.
- 0x0 10y agoThe uncertainty around phrasing like "uses encryption" certainly would require spending expensive lawyer hours to ensure the app would be in the clear. Certainly not a "non-reason".
- jtdowney 10y agoI've spent time with lawyers on specifically this topic. It is about who is distributing the crypto code. There is also an exemption for open source crypto code. On iOS you definitely do not need to register your app if it is just using the built in HTTPS functionality. Hire your own lawyers if you're really worried about it though.
- SunboX 10y agoThink of IoT Devices. For example, Sony's NEX Cameras have a build in HotSpot. You connect your phone to it and you have remote control to your camera. This has no HTTPS by now. Apple would break all those remote control apps. And it can't be fixed by releasing a new app version, because you also have to update the cameras.
- dep_b 10y agoA good start would be a warning about insecure connections being made by the app.
- droopybuns 10y agoThey had a method for whitelisting vanilla http domains in the app plists. It wasnt going to eliminate http. It was going to push general app transport to TLS by default. Apple seems to have wildly varying execution. Some things they do are great. Other times their behavior is shockingly erratic.
- creeble 10y agoIt can't even be fixed then because TLS certs aren't possible for LAN connections (or at least not validate-able, which means the same thing).
- n0d3d3v 10y agoTLS certs are about to be possible for LAN connections with Beame.io's open source SDK, though
- mrpippy 10y agoThere are allowances made for local networking. From the Info.plist key reference (https://developer.apple.com/library/content/documentation/General/Reference/InfoPlistKeyReference/Articles/CocoaKeys.html#//apple_ref/doc/uid/TP40009251-SW54 https://developer.apple.com/library/content/documentation/Ge...): App Transport Security (ATS) applies only to connections made to public host names. The system does not provide ATS protection to connections made to: * Internet protocol (IP) addresses * Unqualified host names * Local hosts employing the .local top-level domain (TLD) To connect to an unqualified host name or to a .local domain, you must set the value of the NSAllowsLocalNetworking key to YES.
- brians 10y agoPrincipally? Reliance on cloud service origins without TLS support. Amazon still has some from acquisitions, for example.