Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Handling App Transport Security in iOS 9

googleadsdeveloper.blogspot.com

Post reply on HN
Print view View original

21–30 of 61 posts

Re: Handling App Transport Security in iOS 9

#21

Post by uxp »

gress wrote: post #14
stavros wrote: post #3

Linkbaity title. Google is actually asking developers to add an exception for its third-party ad network, if the developers use Google ads in their apps, since Google can't guarantee all third-party ads will be TLS-enabled.

Google is not asking for an exception. They are asking developers to disable the security feature entirely. Google can guarantee all third party ads will be TLS enabled simply by not making this request. Edit: true statements of fact downvoted again

> Google can guarantee all third party ads will be TLS enabled simply by not making this request.

This is the crux. Google can force all third parties that display ads through their service to support TLS, but instead they're asking the other guy, the client, to change their product.

Re: Handling App Transport Security in iOS 9

#22

Post by mtgx »

alexbock wrote: post #9
stavros wrote: post #3

Linkbaity title. Google is actually asking developers to add an exception for its third-party ad network, if the developers use Google ads in their apps, since Google can't guarantee all third-party ads will be TLS-enabled.

The instructions they give are not creating an exception for any particular ad servers or just for Google's servers; they're asking developers to enable NSAllowsArbitraryLoads, which disables the security features app-wide for any URL.

NSA -- coincidence?! I think not.

Re: Handling App Transport Security in iOS 9

#23

Post by marbletiles »

blowski wrote: post #17
gress wrote: post #2

For Google, delivering ads takes priority over security best practices and customer privacy. Edit: an unarguably true statement, fully supported by Google's own posting, begins to be downvoted. Google could just as easily tell the ad networks to upgrade to HTTPS, but they have chosen to ask developers to reduce the security of their applications instead.

I downvoted you and will explain why. Very often there are trade-offs between security, usability, financial gain, and various other factors. If security and customer privacy should always win absolutely, then the easiest way to achieve that would be to disable the internet. The reality is that Google has decided that the damage to their bottom line (and the bottom line of the publishers who benefit financially from…

He didn't say "every time" (in the version I'm looking at). He said they chose profit over security (implying in this instance) and I think that's valid.

Re: Handling App Transport Security in iOS 9

#24

Post by uxp »

cromwellian wrote: post #20

Seems they're between a rock and a hard place. When Google proposed HTTPS everywhere, a number of people took exception because not all content has sensitive data needing protection. I guess the real question is whether an HTTP call to load an ad copy is sensitive content. I think you can make an argument that it is sensitive content, because if I were monitoring your connection, and everything was encrypted, but I s…

We've moved passed the idea that only sensitive content needs to be transported over SSL/TLS.

https://www.amnesty.org/en/latest/campaigns/2015/04/7-reason...

https://www.aclu.org/blog/you-may-have-nothing-hide-you-stil...

http://www.ted.com/talks/glenn_greenwald_why_privacy_matters

http://falkvinge.net/2012/07/19/debunking-the-dangerous-noth...

https://en.wikipedia.org/wiki/Nothing_to_hide_argument

Re: Handling App Transport Security in iOS 9

#25

Post by hamedh »

cromwellian wrote: post #20

Seems they're between a rock and a hard place. When Google proposed HTTPS everywhere, a number of people took exception because not all content has sensitive data needing protection. I guess the real question is whether an HTTP call to load an ad copy is sensitive content. I think you can make an argument that it is sensitive content, because if I were monitoring your connection, and everything was encrypted, but I s…

Ad networks haven't supported HTTPS fully on the web either, not just iOS. In fact, Google says you will earn less with just HTTP

"If you do decide to convert your HTTP site to HTTPS, please be aware that because we remove non-SSL compliant ads from the auction, thereby reducing auction pressure, ads on your HTTPS pages might earn less than those on your HTTP pages." [0]

I wouldn't be surprised if many app developers put in this exception because at the end of the day, they will hurt too if ads stop showing up.

[0] https://support.google.com/adsense/answer/10528?hl=en

Re: Handling App Transport Security in iOS 9

#27

Post by boo_radley »

This is a gross misinterpretation of what Google wrote which is : 1) Changes are coming 2) Here is best practice for app devs-- use https everywhere. 3) If you can't use https right now, figure it out soon 4) During the tranision, people are going to fuck up. To deal with these fuck ups gracefully, you can enable NSAllowsArbitraryLoads while we get our partners sorted out.

Re: Handling App Transport Security in iOS 9

#29

Post by MrGando »

I'm pretty sure Google will eventually enforce HTTPs for their third party ad-networks. The problem is that a lot of those guys live in the Paleolithic era regarding security, google needs their inventory, so it's not as simple as just saying: "dude you're going down if you don't do HTTPs now".

And it's also easy to just say "google should just suck it up and take their losses and just do HTTPS". You have to think that a lot of games rely on Google having a big ad inventory to monetize (and it's their only revenue model).

I don't work at Google, but do work in ad-tech. The HTTPS only move by Apple is great and will make a lot of things better... But it's going to take a while.

PS: Check prices of CDNs with SSL... They are also expensive.

Re: Handling App Transport Security in iOS 9

#30

Post by DannyBee »

Ignoring that it seems like the "fix" in this blog post is a really bad idea, I find it immensely funny that folks think this kind of thing is some high level decision somewhere or something deliberate and well thought out, and not "a developer relations person who got asked to make a blog post about the solution he gave some customer"

Not that you shouldn't hold companies responsible, mind you, but everything everywhere is not some company (no matter who it is Google, Apple, etc) deliberately trying to screw you with some motive and purpose and grand conspiracy for how to achieve it in mind. Most wrong/dumb things are usually just simply random people being wrong or not thinking things through on the internet[1]

I guess a lot of folks have never worked at any mid-size or large companies :)

[1] The large company comment also applies to the possible retort that they should know better.A lot of large companies have 100's of "official" blogs. I'm sure corp comm/security/whoever would love to just have 1 they have to watch. But such a thing is not really the world.

Post reply on HN