Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to submit an app to Apple’s App Store when it uses encryption

carouselapps.com

Post reply on HN
Print view View original

41–50 of 120 posts

Re: How to submit an app to Apple’s App Store when it uses encryption

#41

Post by metafunctor »

NamTaf wrote: post #36
metafunctor wrote: post #24

Earlier quoted context omitted.

It's whatever they mean by that word here: http://www.bis.doc.gov/index.php/policy-guidance/encryption/... If you're not sure, and don't want to risk it, either do the ERN or get a lawyer to tell you it's not needed.

I'm not disagreeing with you, I'm pointing out that querying a RESTful page with any of the C, R or U parts of the CRUD process would involve transacting information, so you basically need to keep it as HTTP. And that's why it's madness.

I don't disagree with you, either. But I'm pretty sure the legislative intent is to be able to thwart encryption in, say, instant messaging apps. Because terrorism, national security, etcetera. I don't agree with the means (it's futile), but being able to wiretap communications between people is the intent here as far as I can tell.

It's quite simple to implement an instant messaging app on top of CRUD, so "it's just CRUD" is not a valid counter against this type of politics.

Re: How to submit an app to Apple’s App Store when it uses encryption

#42

Post by Pharaoh2 »

aftbit wrote: post #40
chrischen wrote: post #32

Earlier quoted context omitted.

Encryptions is munitions. It is the modern day "arms" that that the spirit of the 2nd amendment to the US constitution was trying to protect as a fail-safe to an overreaching corrupted government. We don't need to bear arms anymore because we don't walk around dueling people at high noon anymore, but being an information based economy and information based society, encryption is the new gun in the wild world web.

We continue to need to bear arms of all sorts, equal to those that the military uses. As you pointed out, the purpose of the 2nd amendment was to avoid tyranny in a powerful central government. As long as the (federally funded & led) military uses firearms, responsible civilians _must_ also keep & bear them.

If that is so, then we have already lost. No firearm held by the citizens can compete with the firepower of the military of today.

The spirit of the amendment may have been in the right place and surely worked when the constitution was written but we live in a very different world now and if you still think the an armed citizenry will avoid tyranny, you need to go to youtube and see what the military can now do.

Re: How to submit an app to Apple’s App Store when it uses encryption

#43

Post by metafunctor »

joshavant wrote: post #26
eridius wrote: post #11

Earlier quoted context omitted.

That cannot possibly be true. I guarantee you virtually every REST app in the store uses HTTPS and none of them went through all of this. In the latest version of iOS you can't even load HTTP by default and must use HTTPS unless you put a special exception in your Info.plist. Everybody uses HTTPS, and nobody has to go through any of this. So either you asked the wrong question, misinterpreted the answer, or you simpl…

+1. I'm beginning to wonder if the ACTUAL policy Apple is trying enforce w.r.t. HTTPS is if you were to roll your own suite of encryption tools (i.e. as opposed to using the OS's TLS/SSL implementations). That would be far more reasonable. Especially considering, with iOS 9, HTTPS is now the default configuration for all traffic.

This is all pre-snowden, so I'd venture a guess that the ACTUAL reason is, well, NSA.

Re: How to submit an app to Apple’s App Store when it uses encryption

#44

Post by narsil »

huhtenberg wrote: post #39
pupeno wrote: post #2

Last year I learned that to publish an app in the App Store or Mac App Store, if it uses encryption of any kind and yes, HTTPS and SSL count, you need an Encryption Registration (ERN) from the US Bureau of Industry (BIS). Some people claim it's fine to lie to Apple, claim no use of encryption and get in the app store. I'd rather do it the right way. When I started the process of getting the ERN, I quickly notice it w…

Are you US-based?

The OP and his company are based in London.

Re: How to submit an app to Apple’s App Store when it uses encryption

#45

Post by Rafert »

pupeno wrote: post #2

Last year I learned that to publish an app in the App Store or Mac App Store, if it uses encryption of any kind and yes, HTTPS and SSL count, you need an Encryption Registration (ERN) from the US Bureau of Industry (BIS). Some people claim it's fine to lie to Apple, claim no use of encryption and get in the app store. I'd rather do it the right way. When I started the process of getting the ERN, I quickly notice it w…

This seems to be only for US based developers, I can't remember having to fill in more then a handful of radio buttons regarding crypto when I submitted an iOS app as a Dutch developer.

Re: How to submit an app to Apple’s App Store when it uses encryption

#46

Post by danieltillett »

comex wrote: post #35
metafunctor wrote: post #12

Not everything that "just uses HTTPS" necessarily needs ERN. Here's "note 4" which exempts a lot of apps: http://www.bis.doc.gov/index.php/policy-guidance/encryption/... A big part of our app was "sending, receiving, and storing information", so we weren't sure this exemption would apply to us. So, we did the ERN anyway, and it took a couple of days calendar time, and a couple of hours of working time, IIRC. By the w…

> Note 4: Category 5, Part 2 does not apply to items [...] meeting all of the following: > (a) The primary function or set of functions is not any of the following: [...] > ...... (3) Sending, receiving or storing information ( except in support of entertainment, mass commercial broadcasts, digital rights management or medical records management); (Emphasis mine.) Triple negative - now that's something. And DRM and t…

I would have thought that DRM is a loophole you can drive a truck through. As long as any of your data is of value, you can claim the reason for encryption is DRM. Even if you let the end user have access to all data, you could always send some sort of DRM heartbeat.

Re: How to submit an app to Apple’s App Store when it uses encryption

#47

Post by eps »

metafunctor wrote: post #13
Guvante wrote: post #4

Earlier quoted context omitted.

Were you using the built in web capabilities or embedding a library to handle the encryption? In theory Apple's methods for accessing HTTPS should be safe while embedding OpenSSL would not be (unless you linked to a shared object they deployed).

I don't think it matters where the encryption capability comes from. The iTunes Connect FAQ says: “If your app uses, accesses, implements or incorporates industry standard encryption algorithms other than those listed as exemptions under question 2, you need to submit for an ERN authorization. Examples of standard encryption are: AES, SSL, https.” There are a lot of exemptions, but only using Apple's HTTPS is not one…

> industry standard

What about custom crypto then?

Re: How to submit an app to Apple’s App Store when it uses encryption

#48

Post by threatofrain »

Pharaoh2 wrote: post #42
aftbit wrote: post #40

Earlier quoted context omitted.

We continue to need to bear arms of all sorts, equal to those that the military uses. As you pointed out, the purpose of the 2nd amendment was to avoid tyranny in a powerful central government. As long as the (federally funded & led) military uses firearms, responsible civilians _must_ also keep & bear them.

If that is so, then we have already lost. No firearm held by the citizens can compete with the firepower of the military of today. The spirit of the amendment may have been in the right place and surely worked when the constitution was written but we live in a very different world now and if you still think the an armed citizenry will avoid tyranny, you need to go to youtube and see what the military can now do.

I believe the right to bear arms has been interpreted not only to mean the individual right to own and operate firearms, but also the right to form militias, or paramilitary organizations.

It is unlikely for a paramilitary organization to compete with the armed forces, but in a state where the country is stressed and divided, I don't think the armed forces would stand as a fully united organization. However, while I do concede that my argument is weak, I also assert that it is not nil.

Re: How to submit an app to Apple’s App Store when it uses encryption

#49

Post by gulpahum »

danieltillett wrote: post #16

Great guide. If you are into these sort of guides of how to deal with the US government I have written a couple for the W8-BEN-E form [1] (you need this if you have any US customers) and also for registering to do business with the US government [2]. These are biased towards Australians, but they should be helpful for others too. 1. http://www.tillett.info/2015/06/20/how-to-complete-w-8ben-e-... 2. http://www.tillett…

US customers here must mean that if you sell directly to US customers. If you sell via App Store to end users in US, then this is not needed, because Apple will be your customer (Apple Luxembourg for Europeans), not the end user.
Post reply on HN