Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to submit an app to Apple’s App Store when it uses encryption

carouselapps.com

Post reply on HN
Print view View original

51–60 of 120 posts

Re: How to submit an app to Apple’s App Store when it uses encryption

#51

Post by danieltillett »

gulpahum wrote: post #49
danieltillett wrote: post #16

Great guide. If you are into these sort of guides of how to deal with the US government I have written a couple for the W8-BEN-E form [1] (you need this if you have any US customers) and also for registering to do business with the US government [2]. These are biased towards Australians, but they should be helpful for others too. 1. http://www.tillett.info/2015/06/20/how-to-complete-w-8ben-e-... 2. http://www.tillett…

US customers here must mean that if you sell directly to US customers. If you sell via App Store to end users in US, then this is not needed, because Apple will be your customer (Apple Luxembourg for Europeans), not the end user.

Yes this is true, but lots of people sell directly to US customers. As soon as you do you have problems :)

Re: How to submit an app to Apple’s App Store when it uses encryption

#52

Post by asherkin »

robert_foss wrote: post #50

How does this apply to non-US based app publishers? Am I legally exporting crypto from the US if am not in the US?

Yes, this is explained in Apple's FAQ on the issue - they have servers that are distributing your app from the US, thus you are exporting crypto from the US.

Re: How to submit an app to Apple’s App Store when it uses encryption

#53

Post by chrischen »

threatofrain wrote: post #48
Pharaoh2 wrote: post #42

Earlier quoted context omitted.

If that is so, then we have already lost. No firearm held by the citizens can compete with the firepower of the military of today. The spirit of the amendment may have been in the right place and surely worked when the constitution was written but we live in a very different world now and if you still think the an armed citizenry will avoid tyranny, you need to go to youtube and see what the military can now do.

I believe the right to bear arms has been interpreted not only to mean the individual right to own and operate firearms, but also the right to form militias, or paramilitary organizations. It is unlikely for a paramilitary organization to compete with the armed forces, but in a state where the country is stressed and divided, I don't think the armed forces would stand as a fully united organization. However, while I…

If you really wanted to oppose the government you'd encrypt your communications. Clearly that's s greater threat since government so vehemently wants to deny that (it's in their self interest to increase their power).

Re: How to submit an app to Apple’s App Store when it uses encryption

#54

Post by xedarius »

weinzierl wrote: post #31

At the same time Apple encourages the use of HTTPS with App Transport Security (ATS). Starting in iOS 9.0 and OS X v10.11, a new security feature called App Transport Security (ATS) is available to apps and is enabled by default. It improves the privacy and data integrity of connections between an app and web services by enforcing additional security requirements for HTTP-based networking requests. Specifically, with…

This is a really interesting point, I was caught out by this during an update. All of a sudden my REST client broke. Took a little digging to find out Apple had enabled HTTPS by default.

Given this, it would seem odd that you would need to apply for an ERN (is this true for app outside of the US?)

Re: How to submit an app to Apple’s App Store when it uses encryption

#55

Post by [deleted] »

madeofpalk wrote: post #33
rosser wrote: post #19

Earlier quoted context omitted.

From the screen shot of Apple's app submission: "Select yes even if your app is only utilizing the encryption available in iOS or OSX."

I've always interpreted "(ii) your app uses, accesses, implements or incorporates encryption for authentication only" as our uses cases for using HTTPS and thus said that I am exempt.

[deleted]

Re: How to submit an app to Apple’s App Store when it uses encryption

#56

Post by Ntrails »

aftbit wrote: post #40
chrischen wrote: post #32

Earlier quoted context omitted.

Encryptions is munitions. It is the modern day "arms" that that the spirit of the 2nd amendment to the US constitution was trying to protect as a fail-safe to an overreaching corrupted government. We don't need to bear arms anymore because we don't walk around dueling people at high noon anymore, but being an information based economy and information based society, encryption is the new gun in the wild world web.

We continue to need to bear arms of all sorts, equal to those that the military uses. As you pointed out, the purpose of the 2nd amendment was to avoid tyranny in a powerful central government. As long as the (federally funded & led) military uses firearms, responsible civilians _must_ also keep & bear them.

When everyone has guns, the police have to have guns. Not only that, they're scared. All The Time. Traffic stop? Might have a gun. Stop and search? Might have a gun.

One fuck up and you've got death, permanent pain, or some other outcome that's pretty fucking unpalatable. (I assume that at least cops in the US have gold plated health insurance...?)

Here is my question. How much of the problem endemic to US police is on account of a culture of fear. Citizens should not fear the police, but that works both ways.

I'm just spitballing here.

Re: How to submit an app to Apple’s App Store when it uses encryption

#57

Post by rimantas »

profmonocle wrote: post #17
eridius wrote: post #11

Earlier quoted context omitted.

That cannot possibly be true. I guarantee you virtually every REST app in the store uses HTTPS and none of them went through all of this. In the latest version of iOS you can't even load HTTP by default and must use HTTPS unless you put a special exception in your Info.plist. Everybody uses HTTPS, and nobody has to go through any of this. So either you asked the wrong question, misinterpreted the answer, or you simpl…

It's quite likely they don't enforce it very well. I specifically asked them if using NSURLConnection (the standard, built-in URL library before NSURLSession) to access a URL over HTTPS qualified under the registration requirements. They told me, in no uncertain terms, that using any cryptography, including cryptography built into the operating system, meant I needed to register if I wanted to export the app outside…

Well, all apps in App Store are encrypted/signed. So they literally all use cryptography in that sense. Does not make sense.

Re: How to submit an app to Apple’s App Store when it uses encryption

#58

Post by vbezhenar »

madeofpalk wrote: post #33
rosser wrote: post #19

Earlier quoted context omitted.

From the screen shot of Apple's app submission: "Select yes even if your app is only utilizing the encryption available in iOS or OSX."

I've always interpreted "(ii) your app uses, accesses, implements or incorporates encryption for authentication only" as our uses cases for using HTTPS and thus said that I am exempt.

Unless you are using HTTPS with NULL encryption algorithm, your bytes are encrypted and decrypted, so it's not "authentication only". I think that you can use NULL encryption algorithm and in this case only authentication will be performed. But I'm not sure that standard library will allow to use this algorithm.

Re: How to submit an app to Apple’s App Store when it uses encryption

#59

Post by weddpros »

rosser wrote: post #19
madeofpalk wrote: post #7

Earlier quoted context omitted.

I think I remember reading that if you're using Apple's APIs and frameworks (like their builtins for HTTPS) then you don't need to go through this rigmarole.

From the screen shot of Apple's app submission: "Select yes even if your app is only utilizing the encryption available in iOS or OSX."

In that case, simply saving a file would also count as encryption now, since iOS devices are encrypted...

Re: How to submit an app to Apple’s App Store when it uses encryption

#60

Post by fpgeek »

rimantas wrote: post #57
profmonocle wrote: post #17

Earlier quoted context omitted.

It's quite likely they don't enforce it very well. I specifically asked them if using NSURLConnection (the standard, built-in URL library before NSURLSession) to access a URL over HTTPS qualified under the registration requirements. They told me, in no uncertain terms, that using any cryptography, including cryptography built into the operating system, meant I needed to register if I wanted to export the app outside…

Well, all apps in App Store are encrypted/signed. So they literally all use cryptography in that sense. Does not make sense.

I suspect the distinction is that the cryptography for encrypting and signing apps is done by Apple (and they've done all the paperwork for themselves).
Post reply on HN