Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to submit an app to Apple’s App Store when it uses encryption

carouselapps.com

Post reply on HN
Print view View original

91–100 of 120 posts

Re: How to submit an app to Apple’s App Store when it uses encryption

#91

Post by fulafel »

hundchenkatze wrote: post #78
rewqfdsa wrote: post #70

Don't you wish you hadn't surrendered software distribution authority to a single faceless corporate party? When nobody tried to demand bullshit crypto paperwork? Remember when you could distribute software yourself without getting threatened[1]? Remember when platform vendors didn't take a 30% cut of everything you earned just because they wrote an OS? Not even Microsoft was that evil. I hope you enjoy the world you…

This is unrelated to Apple and it's AppStore. Even if you sold this on your own, you'd be subject to the same rules. https://www.bis.doc.gov/index.php/policy-guidance/encryption

No, most people wouldn't.

Re: How to submit an app to Apple’s App Store when it uses encryption

#92

Post by Spooky23 »

jemfinch wrote: post #80
Spooky23 wrote: post #72

Earlier quoted context omitted.

This classification might by a blessing in disguise. The supreme court disagrees with you (see District of Columbia vs. Heller) re your need to bear firearms. But if encryption is the new firearm, that might be an important ruling for crypto.

> The supreme court disagrees with you (see District of Columbia vs. Heller) re your need to bear firearms. He's talking about his need to bear firearms. SCOTUS in Heller was talking about his right to bear firearms. There's no disagreement here at all.

I read it as the following:

- I don't need firearms.

- I need encryption, as it is the equivalent of a weapon in the information age.

- I have a right to bear arms

- The Feds consider encryption to be a munition.

If these assumptions are true, I think you can make an argument that wielding strong encryption is conceptually equivalent to having a rifle.

Re: How to submit an app to Apple’s App Store when it uses encryption

#93

Post by geofft »

rbritton wrote: post #89
comex wrote: post #34

Earlier quoted context omitted.

I'm pretty sure "limited to authentication" means that the data is transmitted in the clear but covered by a signature. HTTPS actually encrypts, so it wouldn't count.

Could you not also argue that ongoing use of HTTPS after authenticating yourself with the server is to ensure the response is coming from who you intend (i.e., the server authenticating itself to you)?

IANAL, but if you assume law matches cryptographic reality: there's such a thing as the NULL cipher, which most SSL stacks don't support (at least by default) because it's a big footgun. It will let you have traffic that's authenticated but not encrypted.

Re: How to submit an app to Apple’s App Store when it uses encryption

#94

Post by geofft »

eclipxe wrote: post #38
huac wrote: post #29

Earlier quoted context omitted.

you'd think that this is a pretty frequently asked question though, no? how could apple dev support personnel not understand/answer basic questions that affect a significant portion of apple devs?

No I think most devs don't interpret the rules as the OP does. Connecting to an https endpoint is clearly not what they mean here.

On advice of counsel, or on the intuition that the US government's laws about crypto cannot possibly be that dumb? Because yes, the laws are in fact that dumb.

Re: How to submit an app to Apple’s App Store when it uses encryption

#95

Post by geofft »

eclipxe wrote: post #14
eridius wrote: post #11

Earlier quoted context omitted.

That cannot possibly be true. I guarantee you virtually every REST app in the store uses HTTPS and none of them went through all of this. In the latest version of iOS you can't even load HTTP by default and must use HTTPS unless you put a special exception in your Info.plist. Everybody uses HTTPS, and nobody has to go through any of this. So either you asked the wrong question, misinterpreted the answer, or you simpl…

Thank you! It is definitely a misinterpretation. Apple makes https mandatory now and there is no way every developer would have to go through this process.

Why do you say there's no way? This is US law, not Apple's policy, and US law is fully capable of being that dumb. (Whether Apple allows developers to lie to Apple and violate US law is beside the point.)

Debian's archive software used to send an automated mail to the US government every time a new package is accepted, just in case it involves crypto:

https://github.com/Debian/dak/blob/master/templates/process-...

(Looks like the government told them "Okay, okay, we don't care" at some point, but that was what they determined their legal obligation was after consulting with lawyers about what the law actually said.)

Re: How to submit an app to Apple’s App Store when it uses encryption

#96

Post by geofft »

eridius wrote: post #11
profmonocle wrote: post #10

Earlier quoted context omitted.

Back when I was doing hobbyist iOS development (2009-ish) I asked Apple developer support about this, and they said it does. Worst part is it doesn't matter if you use a built-in system library like NSURLSession. Simply accessing an HTTPS URL from inside your app triggers this requirement. Some people say the paperwork is easy to fill out yourself, but I was a college student and the legalese scared the crap out of m…

That cannot possibly be true. I guarantee you virtually every REST app in the store uses HTTPS and none of them went through all of this. In the latest version of iOS you can't even load HTTP by default and must use HTTPS unless you put a special exception in your Info.plist. Everybody uses HTTPS, and nobody has to go through any of this. So either you asked the wrong question, misinterpreted the answer, or you simpl…

> That cannot possibly be true. I guarantee you virtually every REST app in the store uses HTTPS and none of them went through all of this.

Then they're breaking the law. Which is unsurprising, since the law is way more complicated than anyone expects, but unless you have a lawyer who has said "No, that's clearly not what the law means," you shouldn't expect that the law is sensible.

Re: How to submit an app to Apple’s App Store when it uses encryption

#98

Post by Guvante »

metafunctor wrote: post #13
Guvante wrote: post #4

Earlier quoted context omitted.

Were you using the built in web capabilities or embedding a library to handle the encryption? In theory Apple's methods for accessing HTTPS should be safe while embedding OpenSSL would not be (unless you linked to a shared object they deployed).

I don't think it matters where the encryption capability comes from. The iTunes Connect FAQ says: “If your app uses, accesses, implements or incorporates industry standard encryption algorithms other than those listed as exemptions under question 2, you need to submit for an ERN authorization. Examples of standard encryption are: AES, SSL, https.” There are a lot of exemptions, but only using Apple's HTTPS is not one…

Sounds like Apple is the cause here, since export restrictions don't apply to things that are never exported. If you aren't embedding the algorithm then your code is not exporting the algorithm.

Re: How to submit an app to Apple’s App Store when it uses encryption

#99

Post by danieltillett »

_up wrote: post #69
danieltillett wrote: post #46

Earlier quoted context omitted.

I would have thought that DRM is a loophole you can drive a truck through. As long as any of your data is of value, you can claim the reason for encryption is DRM. Even if you let the end user have access to all data, you could always send some sort of DRM heartbeat.

No loophole! It only count's if you exclusively need encryption for DRM. Not for other stuff like, to protect your users chat communication for example.

I don't see the word exclusively. If you had a chat application you could protect the user content by sending along a DRMed ping.

Re: How to submit an app to Apple’s App Store when it uses encryption

#100

Post by goatkcd »

skykooler wrote: post #73
Spooky23 wrote: post #72

Earlier quoted context omitted.

This classification might by a blessing in disguise. The supreme court disagrees with you (see District of Columbia vs. Heller) re your need to bear firearms. But if encryption is the new firearm, that might be an important ruling for crypto.

Same idea as in http://xkcd.com/504

Yeah and the same as http://goatkcd.com/504/sfw
Post reply on HN