Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to submit an app to Apple’s App Store when it uses encryption

carouselapps.com

Post reply on HN
Print view View original

21–30 of 120 posts

Re: How to submit an app to Apple’s App Store when it uses encryption

#21

Post by NamTaf »

metafunctor wrote: post #20
eridius wrote: post #11

Earlier quoted context omitted.

That cannot possibly be true. I guarantee you virtually every REST app in the store uses HTTPS and none of them went through all of this. In the latest version of iOS you can't even load HTTP by default and must use HTTPS unless you put a special exception in your Info.plist. Everybody uses HTTPS, and nobody has to go through any of this. So either you asked the wrong question, misinterpreted the answer, or you simpl…

It is true. There are a lot of exemptions, and not all uses of HTTPS require export registration. However, if your app's main purpose has anything to with information security or sending/receiving/storing information, then you probably need ERN.

Define information, since information traditionally is just the meaningful analysis of some data.

Re: How to submit an app to Apple’s App Store when it uses encryption

#22

Post by yuhong »

NamTaf wrote: post #5
pupeno wrote: post #2

Last year I learned that to publish an app in the App Store or Mac App Store, if it uses encryption of any kind and yes, HTTPS and SSL count, you need an Encryption Registration (ERN) from the US Bureau of Industry (BIS). Some people claim it's fine to lie to Apple, claim no use of encryption and get in the app store. I'd rather do it the right way. When I started the process of getting the ERN, I quickly notice it w…

Holy crap that is a bureaucratic nightmare. Why does encryption even need to be registered in the first place? I don't see any point beyond the holdover of 'encryption is munitions' which is a pile of crap in the first place.

It was even worse before 2010, which was why Evernote used 64-bit RC2 encryption.

Re: How to submit an app to Apple’s App Store when it uses encryption

#23

Post by HappyTypist »

pupeno wrote: post #2

Last year I learned that to publish an app in the App Store or Mac App Store, if it uses encryption of any kind and yes, HTTPS and SSL count, you need an Encryption Registration (ERN) from the US Bureau of Industry (BIS). Some people claim it's fine to lie to Apple, claim no use of encryption and get in the app store. I'd rather do it the right way. When I started the process of getting the ERN, I quickly notice it w…

I am confident that it is not true and the apple dev support rep you talked to have no idea what they were talking about.

Re: How to submit an app to Apple’s App Store when it uses encryption

#24

Post by metafunctor »

NamTaf wrote: post #21
metafunctor wrote: post #20

Earlier quoted context omitted.

It is true. There are a lot of exemptions, and not all uses of HTTPS require export registration. However, if your app's main purpose has anything to with information security or sending/receiving/storing information, then you probably need ERN.

Define information, since information traditionally is just the meaningful analysis of some data.

It's whatever they mean by that word here: http://www.bis.doc.gov/index.php/policy-guidance/encryption/...

If you're not sure, and don't want to risk it, either do the ERN or get a lawyer to tell you it's not needed.

Re: How to submit an app to Apple’s App Store when it uses encryption

#26

Post by joshavant »

eridius wrote: post #11
profmonocle wrote: post #10

Earlier quoted context omitted.

Back when I was doing hobbyist iOS development (2009-ish) I asked Apple developer support about this, and they said it does. Worst part is it doesn't matter if you use a built-in system library like NSURLSession. Simply accessing an HTTPS URL from inside your app triggers this requirement. Some people say the paperwork is easy to fill out yourself, but I was a college student and the legalese scared the crap out of m…

That cannot possibly be true. I guarantee you virtually every REST app in the store uses HTTPS and none of them went through all of this. In the latest version of iOS you can't even load HTTP by default and must use HTTPS unless you put a special exception in your Info.plist. Everybody uses HTTPS, and nobody has to go through any of this. So either you asked the wrong question, misinterpreted the answer, or you simpl…

+1.

I'm beginning to wonder if the ACTUAL policy Apple is trying enforce w.r.t. HTTPS is if you were to roll your own suite of encryption tools (i.e. as opposed to using the OS's TLS/SSL implementations).

That would be far more reasonable. Especially considering, with iOS 9, HTTPS is now the default configuration for all traffic.

Re: How to submit an app to Apple’s App Store when it uses encryption

#27

Post by kalleboo »

jevinskie wrote: post #25

If I inform everyone that their iOS app uses AES, SHA-1, and RSA at the lowest level (codesign and Fairplay DRM), does everyone have to register? I think a plain reading of the question poised by Apple would require a "Yes" answer.

There's an exception in the law for DRM

Re: How to submit an app to Apple’s App Store when it uses encryption

#28

Post by weinzierl »

NamTaf wrote: post #5
pupeno wrote: post #2

Last year I learned that to publish an app in the App Store or Mac App Store, if it uses encryption of any kind and yes, HTTPS and SSL count, you need an Encryption Registration (ERN) from the US Bureau of Industry (BIS). Some people claim it's fine to lie to Apple, claim no use of encryption and get in the app store. I'd rather do it the right way. When I started the process of getting the ERN, I quickly notice it w…

Holy crap that is a bureaucratic nightmare. Why does encryption even need to be registered in the first place? I don't see any point beyond the holdover of 'encryption is munitions' which is a pile of crap in the first place.

Some say that this kind of policy is coming back.

   Crypto Wars Part II 
   The Empires Strike Back 
   Kurt Opsahl Deputy Executive Director of the EFF
https://media.ccc.de/v/32c3-7386-crypto_wars_part_ii#video

There is no first part of this specific talk. The talk is only called "Part II" because of the Crypto Wars of the nineties.

If you are interested in the "Part I" history

https://en.wikipedia.org/wiki/Bernstein_v._United_States

is a good starter.

Re: How to submit an app to Apple’s App Store when it uses encryption

#29

Post by huac »

HappyTypist wrote: post #23
pupeno wrote: post #2

Last year I learned that to publish an app in the App Store or Mac App Store, if it uses encryption of any kind and yes, HTTPS and SSL count, you need an Encryption Registration (ERN) from the US Bureau of Industry (BIS). Some people claim it's fine to lie to Apple, claim no use of encryption and get in the app store. I'd rather do it the right way. When I started the process of getting the ERN, I quickly notice it w…

I am confident that it is not true and the apple dev support rep you talked to have no idea what they were talking about.

you'd think that this is a pretty frequently asked question though, no? how could apple dev support personnel not understand/answer basic questions that affect a significant portion of apple devs?
Post reply on HN