7 ms·

Reading through the linked docs, this API seems to specifically be for apps created by owners of WiFi hotspots to help users connect to those hotspots (https://

by paxys 3y ago

Reading through the linked docs, this API seems to specifically be for apps created by owners of WiFi hotspots to help users connect to those hotspots (https://developer.apple.com/documentation/networkextension/hotspot_helper https://developer.apple.com/documentation/networkextension/h...). > NEHotspotHelper allows your app to participate in the process of authenticating with hotspot networks, that is, Wi-Fi networks where the user must interact with the network to gain access to the wider Internet. > NEHotspotHelper is only useful for hotspot integration. There are both technical and business restrictions that prevent it from being used for other tasks, such as accessory integration or Wi-Fi based location. Before using NEHotspotHelper, you must first be granted a special entitlement (com.apple.developer.networking.HotspotHelper) by Apple. Which makes sense, but then why exactly are apps like WeChat and Alipay granted this entitlement?

iforgotpassword 3y ago
Because the Chinese market is too important. For wechat you can maybe argue that it's a "super app" and probably also can be used to connect to wifi hotspots, but for alipay I fail to come up with an explanation..
- physicles 3y ago
  Alipay is also pretty much an everything app (it also has its own ecosystem of mini-apps built on Alipay's platform). Except for the social aspect, it's nearly interchangeable with WeChat.
  - iforgotpassword 3y ago
    Ah I see. It's been a while thanks to the pandemic that I've been there, and even then preferred just doing wechat so I dont have to deal with even more stuff. At least for regular payment almost all places accepted both options.
  - BertoldVdb 3y ago
    You can buy hotspot access with Alipay (scan QR code -> connect), presumably thats why.
- paxys 3y ago
  The sensible move would really be to break up these "everything" apps. Sure WeChat may have a wifi service, but if it is being used by 0.01% of the user base then why is everyone else forced to approve the permissions? Creating a separate "WeChat Wifi Connector" takes zero extra effort on their part.
  - shkkmo 3y ago
    You don't have to break up the app, just require user opt in to enable the feature for the app.
gruez 3y ago
>API seems to specifically be for apps created by owners of WiFi hotspots to help users connect to those hotspots. VPN apps also seem to use it: https://github.com/pia-foss/mobile-ios/blob/4618b55161ec5b8ba51f8e284da88f67dc8a734c/PIA%20VPN/PIAHotspotHelper.swift#L72 https://github.com/pia-foss/mobile-ios/blob/4618b55161ec5b8b...
n2d4 3y ago
I don't know about Alipay, but afaict WeChat needs this feature for WeChat Wifi, which lets users connect to internet hotspots from their WeChat accounts https://mp.weixin.qq.com/s?__biz=MzI1NjA0NzQzOQ==&mid=2650265391&idx=1&sn=e24f6b2264b57ecccd2d0700541a83df&chksm=f22fd70fc5585e199ea8999df625e89193d8f6e4c6f154b6096d8ab5bbf87ab780141160cf55&scene=0&key=0153b628e79ca88b2694ec5a93ce962cfbdaa76194e003fb16eb2f59390ce91eb4125cb98cd5e2987fc1d73c8af9d72155c76c97ec993f0940db651f31222d39a6ddda28158d1d568659dbe0c87e10a2&ascene=0&uin=NjYwOTkzMjg0&devicetype=iMac+MacBookPro12%2C1+OSX+OSX+10.11.3+build(15D21)&version=12020010&nettype=WIFI&fontScale=100&pass_ticket=hoPMe53iGgox%2BVFql5cdbE58fMNT6oflj517YrF1%2Bc2jba65yvnLA3pPOBW62NVY https://mp.weixin.qq.com/s?__biz=MzI1NjA0NzQzOQ==&mid=265026...
- smith7018 3y ago
  I’m sure that’s valid but I’ve worked for mobile app companies and can guarantee features like this are added just to get the entitlement.
  - r00fus 3y ago
    Ah now I see - to get all the entitlements they create a super-app that happens to use those things. Then they can spy on us for our main use case
    - ccorcos 3y ago
      Seems like Apple should give users the ability to download an app while rejecting an entitlement.
      - Analemma_ 3y ago
        You can. iOS apps have to request individual permissions - I'm not sure about the specific level of granularity here, but you can deny location access while still letting the rest of the app run, and the app has to be able to deal with it.
        3y ago
vinay_ys 3y ago
Even if only genuine hotspot apps got the entitlement, it is not a user-friendly privacy-first design. Such API use should trigger a user-visible permission dialog before apps get background-notified and user should be able to select the one of "allow-once, allow while using, allow-in-background, never" and the app activity should show up in app privacy reports.
- TylerE 3y ago
  Not sure I agree - in fact pretty sure I don’t. Having lots of permission dialogs just trains users to mindlessly click yes on everything, because they just want to do the thing, not think about how the sausage is made.
  - ubercow13 3y ago
    So just don't have them, and don't let them think about it?
    - TylerE 3y ago
      I'm saying that a default of "ask every single time" is not good. For anyone.
_heimdall 3y ago
Its a more basic question to me, why do these apps need a special entitlement? Couldn't they ask users for permissions like any other app, presumably with a good reason to go along with it since location is needed for some features?
- gorbypark 3y ago
  Apple wants to gatekeep the feature for "legitimate" uses. If it was just another permission, random flashlight apps (as the joke goes) would ask for the permission and _n_% of people would just blindly accept it. Then, of course, Apple would get blamed for allowing random flashlight apps to track people's location. Of course this could all be done via the regular app review process, but Apple seems to have decided on a few permissions they want to keep super locked down (CarPlay is another, to avoid blame for when someone crashes while using some CarPlay app).
diebeforei485 3y ago
This is functionally a Location Services feature, so the user should grant location permissions to use this. I am not sure how it works in practice.
lxgr 3y ago
Apparently the entitlement is not required in a few other conditions, listed here [1] by Apple: 1. application is using CoreLocation API and has user's authorization to access precise location. [This seems harmless – the app already gets the precise location anyway here.] 2. application has used NEHotspotConfiguration API to configure the current Wi-Fi network. [This seems to be the scope of the article!] 3. application has active VPN configurations installed. [This one is quite surprising to me!] 4. application has active NEDNSSettingsManager configuration installed. [No idea what this is exactly, but it seems similar to the VPN one.] [1] https://developer.apple.com/forums/thread/679038 https://developer.apple.com/forums/thread/679038
Tigress8780 3y ago
These "super apps" get special treatment everywhere. Many phone manufacturers even automatically grant certain permissions when these apps are installed (the list is sometimes hard-coded into the system), since there are people who do not understand what is "permission", and they blame the phone manufacturer for not being able to use WeChat/Alipay.

by paxys 3y ago

iforgotpassword 3y ago

Because the Chinese market is too important. For wechat you can maybe argue that it's a "super app" and probably also can be used to connect to wifi hotspots, but for alipay I fail to come up with an explanation..

physicles 3y ago
Alipay is also pretty much an everything app (it also has its own ecosystem of mini-apps built on Alipay's platform). Except for the social aspect, it's nearly interchangeable with WeChat.
- iforgotpassword 3y ago
  Ah I see. It's been a while thanks to the pandemic that I've been there, and even then preferred just doing wechat so I dont have to deal with even more stuff. At least for regular payment almost all places accepted both options.
- BertoldVdb 3y ago
  You can buy hotspot access with Alipay (scan QR code -> connect), presumably thats why.
paxys 3y ago
The sensible move would really be to break up these "everything" apps. Sure WeChat may have a wifi service, but if it is being used by 0.01% of the user base then why is everyone else forced to approve the permissions? Creating a separate "WeChat Wifi Connector" takes zero extra effort on their part.
- shkkmo 3y ago
  You don't have to break up the app, just require user opt in to enable the feature for the app.

gruez 3y ago

>API seems to specifically be for apps created by owners of WiFi hotspots to help users connect to those hotspots. VPN apps also seem to use it: https://github.com/pia-foss/mobile-ios/blob/4618b55161ec5b8ba51f8e284da88f67dc8a734c/PIA%20VPN/PIAHotspotHelper.swift#L72 https://github.com/pia-foss/mobile-ios/blob/4618b55161ec5b8b...

n2d4 3y ago

I don't know about Alipay, but afaict WeChat needs this feature for WeChat Wifi, which lets users connect to internet hotspots from their WeChat accounts https://mp.weixin.qq.com/s?__biz=MzI1NjA0NzQzOQ==&mid=2650265391&idx=1&sn=e24f6b2264b57ecccd2d0700541a83df&chksm=f22fd70fc5585e199ea8999df625e89193d8f6e4c6f154b6096d8ab5bbf87ab780141160cf55&scene=0&key=0153b628e79ca88b2694ec5a93ce962cfbdaa76194e003fb16eb2f59390ce91eb4125cb98cd5e2987fc1d73c8af9d72155c76c97ec993f0940db651f31222d39a6ddda28158d1d568659dbe0c87e10a2&ascene=0&uin=NjYwOTkzMjg0&devicetype=iMac+MacBookPro12%2C1+OSX+OSX+10.11.3+build(15D21)&version=12020010&nettype=WIFI&fontScale=100&pass_ticket=hoPMe53iGgox%2BVFql5cdbE58fMNT6oflj517YrF1%2Bc2jba65yvnLA3pPOBW62NVY https://mp.weixin.qq.com/s?__biz=MzI1NjA0NzQzOQ==&mid=265026...

smith7018 3y ago
I’m sure that’s valid but I’ve worked for mobile app companies and can guarantee features like this are added just to get the entitlement.
- r00fus 3y ago
  Ah now I see - to get all the entitlements they create a super-app that happens to use those things. Then they can spy on us for our main use case
  - ccorcos 3y ago
    Seems like Apple should give users the ability to download an app while rejecting an entitlement.
    - Analemma_ 3y ago
      You can. iOS apps have to request individual permissions - I'm not sure about the specific level of granularity here, but you can deny location access while still letting the rest of the app run, and the app has to be able to deal with it.
      - 3y ago

vinay_ys 3y ago

Even if only genuine hotspot apps got the entitlement, it is not a user-friendly privacy-first design. Such API use should trigger a user-visible permission dialog before apps get background-notified and user should be able to select the one of "allow-once, allow while using, allow-in-background, never" and the app activity should show up in app privacy reports.

TylerE 3y ago
Not sure I agree - in fact pretty sure I don’t. Having lots of permission dialogs just trains users to mindlessly click yes on everything, because they just want to do the thing, not think about how the sausage is made.
- ubercow13 3y ago
  So just don't have them, and don't let them think about it?
  - TylerE 3y ago
    I'm saying that a default of "ask every single time" is not good. For anyone.

_heimdall 3y ago

Its a more basic question to me, why do these apps need a special entitlement? Couldn't they ask users for permissions like any other app, presumably with a good reason to go along with it since location is needed for some features?

gorbypark 3y ago
Apple wants to gatekeep the feature for "legitimate" uses. If it was just another permission, random flashlight apps (as the joke goes) would ask for the permission and _n_% of people would just blindly accept it. Then, of course, Apple would get blamed for allowing random flashlight apps to track people's location. Of course this could all be done via the regular app review process, but Apple seems to have decided on a few permissions they want to keep super locked down (CarPlay is another, to avoid blame for when someone crashes while using some CarPlay app).

diebeforei485 3y ago

This is functionally a Location Services feature, so the user should grant location permissions to use this. I am not sure how it works in practice.

lxgr 3y ago

Apparently the entitlement is not required in a few other conditions, listed here [1] by Apple: 1. application is using CoreLocation API and has user's authorization to access precise location. [This seems harmless – the app already gets the precise location anyway here.] 2. application has used NEHotspotConfiguration API to configure the current Wi-Fi network. [This seems to be the scope of the article!] 3. application has active VPN configurations installed. [This one is quite surprising to me!] 4. application has active NEDNSSettingsManager configuration installed. [No idea what this is exactly, but it seems similar to the VPN one.] [1] https://developer.apple.com/forums/thread/679038 https://developer.apple.com/forums/thread/679038

Tigress8780 3y ago

These "super apps" get special treatment everywhere. Many phone manufacturers even automatically grant certain permissions when these apps are installed (the list is sometimes hard-coded into the system), since there are people who do not understand what is "permission", and they blame the phone manufacturer for not being able to use WeChat/Alipay.