Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to submit an app to Apple’s App Store when it uses encryption

carouselapps.com

Post reply on HN
Print view View original

31–40 of 120 posts

Re: How to submit an app to Apple’s App Store when it uses encryption

#31

Post by weinzierl »

At the same time Apple encourages the use of HTTPS with App Transport Security (ATS).

   Starting in iOS 9.0 and OS X v10.11, a new security feature 
   called App Transport Security (ATS) is available to apps and is 
   enabled by default. It improves the privacy and data integrity 
   of connections between an app and web services by enforcing 
   additional security requirements for HTTP-based networking 
   requests. Specifically, with ATS enabled, HTTP connections must 
   use HTTPS (RFC 2818). Attempts to connect using insecure HTTP 
   fail. Furthermore, HTTPS requests must use best practices for 
   secure communications.
https://developer.apple.com/library/ios/documentation/Genera...

Does that mean that in the future nearly every App will need the ERN?

Re: How to submit an app to Apple’s App Store when it uses encryption

#32

Post by chrischen »

NamTaf wrote: post #5
pupeno wrote: post #2

Last year I learned that to publish an app in the App Store or Mac App Store, if it uses encryption of any kind and yes, HTTPS and SSL count, you need an Encryption Registration (ERN) from the US Bureau of Industry (BIS). Some people claim it's fine to lie to Apple, claim no use of encryption and get in the app store. I'd rather do it the right way. When I started the process of getting the ERN, I quickly notice it w…

Holy crap that is a bureaucratic nightmare. Why does encryption even need to be registered in the first place? I don't see any point beyond the holdover of 'encryption is munitions' which is a pile of crap in the first place.

Encryptions is munitions. It is the modern day "arms" that that the spirit of the 2nd amendment to the US constitution was trying to protect as a fail-safe to an overreaching corrupted government.

We don't need to bear arms anymore because we don't walk around dueling people at high noon anymore, but being an information based economy and information based society, encryption is the new gun in the wild world web.

Re: How to submit an app to Apple’s App Store when it uses encryption

#33

Post by madeofpalk »

rosser wrote: post #19
madeofpalk wrote: post #7

Earlier quoted context omitted.

I think I remember reading that if you're using Apple's APIs and frameworks (like their builtins for HTTPS) then you don't need to go through this rigmarole.

From the screen shot of Apple's app submission: "Select yes even if your app is only utilizing the encryption available in iOS or OSX."

I've always interpreted "(ii) your app uses, accesses, implements or incorporates encryption for authentication only" as our uses cases for using HTTPS and thus said that I am exempt.

Re: How to submit an app to Apple’s App Store when it uses encryption

#34

Post by comex »

danieltillett wrote: post #18
rbritton wrote: post #15

Earlier quoted context omitted.

I'm far from an expert on this area, but I know there are exemptions many apps can qualify for. The most notable of these is that the encryption is limited to authentication [1]. [1]: http://stackoverflow.com/questions/2135081/does-my-applicati...

I would have thought this covered https.

I'm pretty sure "limited to authentication" means that the data is transmitted in the clear but covered by a signature. HTTPS actually encrypts, so it wouldn't count.

Re: How to submit an app to Apple’s App Store when it uses encryption

#35

Post by comex »

metafunctor wrote: post #12

Not everything that "just uses HTTPS" necessarily needs ERN. Here's "note 4" which exempts a lot of apps: http://www.bis.doc.gov/index.php/policy-guidance/encryption/... A big part of our app was "sending, receiving, and storing information", so we weren't sure this exemption would apply to us. So, we did the ERN anyway, and it took a couple of days calendar time, and a couple of hours of working time, IIRC. By the w…

> Note 4: Category 5, Part 2 does not apply to items [...] meeting all of the following:

> (a) The primary function or set of functions is not any of the following: [...]

> ...... (3) Sending, receiving or storing information (except in support of entertainment, mass commercial broadcasts, digital rights management or medical records management);

(Emphasis mine.)

Triple negative - now that's something. And DRM and the entertainment industry gets a special case, isn't that great?

Re: How to submit an app to Apple’s App Store when it uses encryption

#36

Post by NamTaf »

metafunctor wrote: post #24
NamTaf wrote: post #21

Earlier quoted context omitted.

Define information, since information traditionally is just the meaningful analysis of some data.

It's whatever they mean by that word here: http://www.bis.doc.gov/index.php/policy-guidance/encryption/... If you're not sure, and don't want to risk it, either do the ERN or get a lawyer to tell you it's not needed.

I'm not disagreeing with you, I'm pointing out that querying a RESTful page with any of the C, R or U parts of the CRUD process would involve transacting information, so you basically need to keep it as HTTP.

And that's why it's madness.

Re: How to submit an app to Apple’s App Store when it uses encryption

#37

Post by rdtsc »

NamTaf wrote: post #5
pupeno wrote: post #2

Last year I learned that to publish an app in the App Store or Mac App Store, if it uses encryption of any kind and yes, HTTPS and SSL count, you need an Encryption Registration (ERN) from the US Bureau of Industry (BIS). Some people claim it's fine to lie to Apple, claim no use of encryption and get in the app store. I'd rather do it the right way. When I started the process of getting the ERN, I quickly notice it w…

Holy crap that is a bureaucratic nightmare. Why does encryption even need to be registered in the first place? I don't see any point beyond the holdover of 'encryption is munitions' which is a pile of crap in the first place.

Because you might be exporting it to an un-friendly country.

Don't try to apply logic here -- "But can't they just compile openssl or just use Linux!? or some library..." -- this is government contracting and security world, regular logic doesn't work here.

Re: How to submit an app to Apple’s App Store when it uses encryption

#38

Post by eclipxe »

huac wrote: post #29
HappyTypist wrote: post #23

Earlier quoted context omitted.

I am confident that it is not true and the apple dev support rep you talked to have no idea what they were talking about.

you'd think that this is a pretty frequently asked question though, no? how could apple dev support personnel not understand/answer basic questions that affect a significant portion of apple devs?

No I think most devs don't interpret the rules as the OP does. Connecting to an https endpoint is clearly not what they mean here.

Re: How to submit an app to Apple’s App Store when it uses encryption

#39

Post by huhtenberg »

pupeno wrote: post #2

Last year I learned that to publish an app in the App Store or Mac App Store, if it uses encryption of any kind and yes, HTTPS and SSL count, you need an Encryption Registration (ERN) from the US Bureau of Industry (BIS). Some people claim it's fine to lie to Apple, claim no use of encryption and get in the app store. I'd rather do it the right way. When I started the process of getting the ERN, I quickly notice it w…

Are you US-based?

Re: How to submit an app to Apple’s App Store when it uses encryption

#40

Post by aftbit »

chrischen wrote: post #32
NamTaf wrote: post #5

Earlier quoted context omitted.

Holy crap that is a bureaucratic nightmare. Why does encryption even need to be registered in the first place? I don't see any point beyond the holdover of 'encryption is munitions' which is a pile of crap in the first place.

Encryptions is munitions. It is the modern day "arms" that that the spirit of the 2nd amendment to the US constitution was trying to protect as a fail-safe to an overreaching corrupted government. We don't need to bear arms anymore because we don't walk around dueling people at high noon anymore, but being an information based economy and information based society, encryption is the new gun in the wild world web.

We continue to need to bear arms of all sorts, equal to those that the military uses. As you pointed out, the purpose of the 2nd amendment was to avoid tyranny in a powerful central government. As long as the (federally funded & led) military uses firearms, responsible civilians _must_ also keep & bear them.
Post reply on HN