Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to submit an app to Apple’s App Store when it uses encryption

carouselapps.com

Post reply on HN
Print view View original

101–110 of 120 posts

Re: How to submit an app to Apple’s App Store when it uses encryption

#101

Post by NamTaf »

aftbit wrote: post #40
chrischen wrote: post #32

Earlier quoted context omitted.

Encryptions is munitions. It is the modern day "arms" that that the spirit of the 2nd amendment to the US constitution was trying to protect as a fail-safe to an overreaching corrupted government. We don't need to bear arms anymore because we don't walk around dueling people at high noon anymore, but being an information based economy and information based society, encryption is the new gun in the wild world web.

We continue to need to bear arms of all sorts, equal to those that the military uses. As you pointed out, the purpose of the 2nd amendment was to avoid tyranny in a powerful central government. As long as the (federally funded & led) military uses firearms, responsible civilians _must_ also keep & bear them.

Most other first-world nations would disagree with you.

Re: How to submit an app to Apple’s App Store when it uses encryption

#102

Post by NamTaf »

ryandrake wrote: post #82
NamTaf wrote: post #5

Earlier quoted context omitted.

Holy crap that is a bureaucratic nightmare. Why does encryption even need to be registered in the first place? I don't see any point beyond the holdover of 'encryption is munitions' which is a pile of crap in the first place.

Bureaucratic nightmare? Don't you think that's an exaggeration? Sure, the government's web site UX is atrocious, but at the end of the day, it's just a couple of web forms and E-mail verification, similar to signing up for any web site. Try to legally immigrate to the U.S. and then come back and tell me that this web site is a "bureaucratic nightmare".

I agree that US migration processes are a bureaucratic nightmare also. I don't think it's an exaggeration when I phrase the term as 'overly unnecessary bureaucratic process that causes people incredible frustration'.

Note that the OP said that the list was the effort of months of trying to understand and negotiate the system. Just because it appears to be 'a couple of web forms and email verification', it's in no way similar to signing up for a web site because it's behind so much opacity. You can't judge the effort involved in producing something simply by its final output.

Re: How to submit an app to Apple’s App Store when it uses encryption

#103

Post by NamTaf »

metafunctor wrote: post #41
NamTaf wrote: post #36

Earlier quoted context omitted.

I'm not disagreeing with you, I'm pointing out that querying a RESTful page with any of the C, R or U parts of the CRUD process would involve transacting information, so you basically need to keep it as HTTP. And that's why it's madness.

I don't disagree with you, either. But I'm pretty sure the legislative intent is to be able to thwart encryption in, say, instant messaging apps. Because terrorism, national security, etcetera. I don't agree with the means (it's futile), but being able to wiretap communications between people is the intent here as far as I can tell. It's quite simple to implement an instant messaging app on top of CRUD, so "it's just…

I understand the intent, my point is that there's very few situations where you are not transmitting information if you have any connectivity whatsoever, so the law appears overly ambiguous and far-reaching. It should be more specific about its aims.

Re: How to submit an app to Apple’s App Store when it uses encryption

#104

Post by pupeno »

perlpimp wrote: post #61
rdtsc wrote: post #37

Earlier quoted context omitted.

Because you might be exporting it to an un-friendly country. Don't try to apply logic here -- "But can't they just compile openssl or just use Linux!? or some library..." -- this is government contracting and security world, regular logic doesn't work here.

what if I am working in un-friendly country trying to import it to friendly countries via the App Store?

For exporting to friendly countries via App Store, you'll need an ERN. I'm not sure if the App Store will accept submission from unfriendly countries. It depends which one I guess.

Re: How to submit an app to Apple’s App Store when it uses encryption

#105

Post by pupeno »

yuhong wrote: post #22
NamTaf wrote: post #5

Earlier quoted context omitted.

Holy crap that is a bureaucratic nightmare. Why does encryption even need to be registered in the first place? I don't see any point beyond the holdover of 'encryption is munitions' which is a pile of crap in the first place.

It was even worse before 2010, which was why Evernote used 64-bit RC2 encryption.

Throughout the process I found left-overs from the previous processes and yes, it looked much worse. The worst part for me is that there were steps in the process than though simple, they were not defined anywhere and thus it required me calling various departments to ask for clarifications.

Re: How to submit an app to Apple’s App Store when it uses encryption

#106

Post by pupeno »

rbritton wrote: post #15
pupeno wrote: post #2

Last year I learned that to publish an app in the App Store or Mac App Store, if it uses encryption of any kind and yes, HTTPS and SSL count, you need an Encryption Registration (ERN) from the US Bureau of Industry (BIS). Some people claim it's fine to lie to Apple, claim no use of encryption and get in the app store. I'd rather do it the right way. When I started the process of getting the ERN, I quickly notice it w…

I'm far from an expert on this area, but I know there are exemptions many apps can qualify for. The most notable of these is that the encryption is limited to authentication [1]. [1]: http://stackoverflow.com/questions/2135081/does-my-applicati...

I talked to a couple of people at Apple and they explicitly told me that use of HTTPS is not covered under the exception. I think that exception was designed to authenticate licences of software. Programs that phone home, get a toke, and decrypt it to verify you paid for it, but that's just a hypothesis.

Re: How to submit an app to Apple’s App Store when it uses encryption

#107

Post by pupeno »

rbritton wrote: post #89
comex wrote: post #34

Earlier quoted context omitted.

I'm pretty sure "limited to authentication" means that the data is transmitted in the clear but covered by a signature. HTTPS actually encrypts, so it wouldn't count.

Could you not also argue that ongoing use of HTTPS after authenticating yourself with the server is to ensure the response is coming from who you intend (i.e., the server authenticating itself to you)?

What would you rather do, argue with the US government or get an ERN and focus on your business? I know my answer ;)

Re: How to submit an app to Apple’s App Store when it uses encryption

#108

Post by pupeno »

eridius wrote: post #11
profmonocle wrote: post #10

Earlier quoted context omitted.

Back when I was doing hobbyist iOS development (2009-ish) I asked Apple developer support about this, and they said it does. Worst part is it doesn't matter if you use a built-in system library like NSURLSession. Simply accessing an HTTPS URL from inside your app triggers this requirement. Some people say the paperwork is easy to fill out yourself, but I was a college student and the legalese scared the crap out of m…

That cannot possibly be true. I guarantee you virtually every REST app in the store uses HTTPS and none of them went through all of this. In the latest version of iOS you can't even load HTTP by default and must use HTTPS unless you put a special exception in your Info.plist. Everybody uses HTTPS, and nobody has to go through any of this. So either you asked the wrong question, misinterpreted the answer, or you simpl…

This is true, and I think a lot of this applications are breaking the rules. You can easily claim your app doesn't use encryption and Apple will accept it. They don't check to see whether it does or doesn't use encryption. But should something happen, Apple is clear of guilt because they asked you and you would be the one producing a false statement.

I read a lot of blog posts and looked at a lot of information and there's a general advice of "just pretend not to use encryption" or "https doesn't count" which is just wishful thinking from people that didn't want to use ERN and when you go dig deep enough it doesn't hold any water.

Re: How to submit an app to Apple’s App Store when it uses encryption

#109

Post by pupeno »

profmonocle wrote: post #17
eridius wrote: post #11

Earlier quoted context omitted.

That cannot possibly be true. I guarantee you virtually every REST app in the store uses HTTPS and none of them went through all of this. In the latest version of iOS you can't even load HTTP by default and must use HTTPS unless you put a special exception in your Info.plist. Everybody uses HTTPS, and nobody has to go through any of this. So either you asked the wrong question, misinterpreted the answer, or you simpl…

It's quite likely they don't enforce it very well. I specifically asked them if using NSURLConnection (the standard, built-in URL library before NSURLSession) to access a URL over HTTPS qualified under the registration requirements. They told me, in no uncertain terms, that using any cryptography, including cryptography built into the operating system, meant I needed to register if I wanted to export the app outside…

They don't enforce it at all. Not even the US BIS really looks at your application to approve it as far as I can tell, because mine was approved instantly. They do have a lot of checks to make sure the record of your company and app are somewhat well formed.

When it comes to Apple, they don't check for this, they just want you to be on the record with either an ERN or the claim of no encryption, so that it's not their fault if the US government comes and says "hey, about all those apps you are exporting, are they using munition-level tech?"

Re: How to submit an app to Apple’s App Store when it uses encryption

#110

Post by pupeno »

rimantas wrote: post #57
profmonocle wrote: post #17

Earlier quoted context omitted.

It's quite likely they don't enforce it very well. I specifically asked them if using NSURLConnection (the standard, built-in URL library before NSURLSession) to access a URL over HTTPS qualified under the registration requirements. They told me, in no uncertain terms, that using any cryptography, including cryptography built into the operating system, meant I needed to register if I wanted to export the app outside…

Well, all apps in App Store are encrypted/signed. So they literally all use cryptography in that sense. Does not make sense.

First, if all your app does is download encrypted information and decrypt it, you might be covered under one of the exceptions.

Obviously the App Store is using HTTPS, so it's not. The App Store is a program by Apple and I'm sure Apple has an ERN to cover their asses.

Post reply on HN