3 ms·

Remember Facebook offering people a few bucks to MITM their entire phone? Oh wait, that was on the official App store! And they didn't even ban them!

GeekyBear 4y ago
>Remember Facebook offering people a few bucks to MITM their entire phone? Oh wait, that was on the official App store! And they didn't even ban them! No, companies can apply for their own app signing key that allows them to create apps for their own in-house-only uses that completely bypass the App Store. Facebook used that enterprise signing key to install spyware on user's devices. This had nothing to do with the App Store, and Apple did revoke their signing key as a warning shot. >“We designed our Enterprise Developer Program solely for the internal distribution of apps within an organization,” the spokesperson said. “Facebook has been using their membership to distribute a data-collecting app to consumers, which is a clear breach of their agreement with Apple. Any developer using their enterprise certificates to distribute apps to consumers will have their certificates revoked, which is what we did in this case to protect our users and their data.” https://www.cnbc.com/2019/01/30/apple-says-facebook-violated-its-policies-with-its-research-app.html https://www.cnbc.com/2019/01/30/apple-says-facebook-violated...
- stefan_ 4y ago
  Please read carefully what you wrote. > that completely bypass the App Store [..] Apple did revoke their signing key Do you see it yet? There is no "bypassing the App Store". At the end of the day, the root of trust comes back to Apple. And, of course, they "revoked" it meaning they waited for a week or so and then Facebook had all their enterprise apps back. This isn't the treatment in store for you if you attempted this.
  - GeekyBear 4y ago
    Sorry, but bypassing the App Store and it's associated review process is exactly what Enterprise signing certificates do allow. Those apps are not distributed through the App Store. >Oh wait, that was on the official App store! Do you see it yet? :oP

GeekyBear 4y ago

>Remember Facebook offering people a few bucks to MITM their entire phone? Oh wait, that was on the official App store! And they didn't even ban them! No, companies can apply for their own app signing key that allows them to create apps for their own in-house-only uses that completely bypass the App Store. Facebook used that enterprise signing key to install spyware on user's devices. This had nothing to do with the App Store, and Apple did revoke their signing key as a warning shot. >“We designed our Enterprise Developer Program solely for the internal distribution of apps within an organization,” the spokesperson said. “Facebook has been using their membership to distribute a data-collecting app to consumers, which is a clear breach of their agreement with Apple. Any developer using their enterprise certificates to distribute apps to consumers will have their certificates revoked, which is what we did in this case to protect our users and their data.” https://www.cnbc.com/2019/01/30/apple-says-facebook-violated-its-policies-with-its-research-app.html https://www.cnbc.com/2019/01/30/apple-says-facebook-violated...

stefan_ 4y ago
Please read carefully what you wrote. > that completely bypass the App Store [..] Apple did revoke their signing key Do you see it yet? There is no "bypassing the App Store". At the end of the day, the root of trust comes back to Apple. And, of course, they "revoked" it meaning they waited for a week or so and then Facebook had all their enterprise apps back. This isn't the treatment in store for you if you attempted this.
- GeekyBear 4y ago
  Sorry, but bypassing the App Store and it's associated review process is exactly what Enterprise signing certificates do allow. Those apps are not distributed through the App Store. >Oh wait, that was on the official App store! Do you see it yet? :oP