Handling App Transport Security in iOS 9 • Hacker News Board

Re: Handling App Transport Security in iOS 9

#41

Post by mtgx » Thu, Aug 27, 2015, 4:48 PM UTC

uxp wrote: post #24

cromwellian wrote: post #20

Seems they're between a rock and a hard place. When Google proposed HTTPS everywhere, a number of people took exception because not all content has sensitive data needing protection. I guess the real question is whether an HTTP call to load an ad copy is sensitive content. I think you can make an argument that it is sensitive content, because if I were monitoring your connection, and everything was encrypted, but I s…

We've moved passed the idea that only sensitive content needs to be transported over SSL/TLS. https://www.amnesty.org/en/latest/campaigns/2015/04/7-reason... https://www.aclu.org/blog/you-may-have-nothing-hide-you-stil... http://www.ted.com/talks/glenn_greenwald_why_privacy_matters http://falkvinge.net/2012/07/19/debunking-the-dangerous-noth... https://en.wikipedia.org/wiki/Nothing_to_hide_argument

It's also a security issue (in all cases), regardless of the privacy implications:

https://citizenlab.org/2014/08/cat-video-and-the-death-of-cl...

Re: Handling App Transport Security in iOS 9

#42

Post by MrGando » Thu, Aug 27, 2015, 4:49 PM UTC

jakobegger wrote: post #18

I wonder if the App Store Review team will check that setting? I've had a Mac App rejected because sandbox restrictions weren't narrow enough. If it was my decision, I'd allow disabling App Transport Security if your app is something like a browser or an RSS client, were you need to connect to servers not under your control. If you need to disable it to make ads work, I'd reject it.

No, they won't be rejecting apps based on that setting. They know this is a progressive measure, and maybe some day in the future they will... but if you watch this year's WWDC session on this topic, it's pretty clear that they won't be rejecting anyone.

Re: Handling App Transport Security in iOS 9

#43

Post by MrGando » Thu, Aug 27, 2015, 4:49 PM UTC

alexbock wrote: post #9

stavros wrote: post #3

Linkbaity title. Google is actually asking developers to add an exception for its third-party ad network, if the developers use Google ads in their apps, since Google can't guarantee all third-party ads will be TLS-enabled.

The instructions they give are not creating an exception for any particular ad servers or just for Google's servers; they're asking developers to enable NSAllowsArbitraryLoads, which disables the security features app-wide for any URL.

Can you imagine how many servers would they have to actually add exceptions for?

Re: Handling App Transport Security in iOS 9

#44

Post by acqq » Thu, Aug 27, 2015, 4:55 PM UTC

uxp wrote: post #19

dijit wrote: post #13

Earlier quoted context omitted.

I'm going to copy my comment from below verbatim because that one is being downvoted and this one isn't despite saying the same thing. --- [Google] are first, and foremost, the worlds largest advertising company. This is how they make their bottom line and it will come at the detriment of anything else. however, they value reputation too- so it's likely this will be fixed in future. But let's not throw exaggerations…

At my last job, we did something similar to what iOS 9 is now doing, where we migrated a survey engine to serve all forms over https. There was high fiving and champagne all around the engineers desks, while media was freaking out that their impressions took the sharpest reverse-hockey-stick in the world. Ad networks are seriously the worst when it comes to https traffic. Given the dozens of redirects and pixel injec…

> Given the dozens of redirects and pixel injections and iframes slapped into a media page, it's nearly impossible to serve secure traffic since it only takes one network to downgrade the https request to http and then the page is "broken".

You mean, then the specific ad is broken, as long as its ad router isn't fixed to use https?

Re: Handling App Transport Security in iOS 9

#45

Post by gress » Thu, Aug 27, 2015, 4:58 PM UTC

cromwellian wrote: post #20

Seems they're between a rock and a hard place. When Google proposed HTTPS everywhere, a number of people took exception because not all content has sensitive data needing protection. I guess the real question is whether an HTTP call to load an ad copy is sensitive content. I think you can make an argument that it is sensitive content, because if I were monitoring your connection, and everything was encrypted, but I s…

Who is "between a rock and a hard place"? Google, or the ad networks?

Re: Handling App Transport Security in iOS 9

#46

Post by alanh » Thu, Aug 27, 2015, 5:15 PM UTC

uxp wrote: post #19

dijit wrote: post #13

Earlier quoted context omitted.

I'm going to copy my comment from below verbatim because that one is being downvoted and this one isn't despite saying the same thing. --- [Google] are first, and foremost, the worlds largest advertising company. This is how they make their bottom line and it will come at the detriment of anything else. however, they value reputation too- so it's likely this will be fixed in future. But let's not throw exaggerations…

At my last job, we did something similar to what iOS 9 is now doing, where we migrated a survey engine to serve all forms over https. There was high fiving and champagne all around the engineers desks, while media was freaking out that their impressions took the sharpest reverse-hockey-stick in the world. Ad networks are seriously the worst when it comes to https traffic. Given the dozens of redirects and pixel injec…

Who or what exactly do you refer to as “media”? Is this what this company called their advertising division?

Re: Handling App Transport Security in iOS 9

#47

Post by e28eta » Thu, Aug 27, 2015, 5:17 PM UTC

inversionOf wrote: post #32

DannyBee wrote: post #30

Ignoring that it seems like the "fix" in this blog post is a really bad idea, I find it immensely funny that folks think this kind of thing is some high level decision somewhere or something deliberate and well thought out, and not "a developer relations person who got asked to make a blog post about the solution he gave some customer" Not that you shouldn't hold companies responsible, mind you, but everything everyw…

Ignoring that it seems like the "fix" in this blog post is a really bad idea This is a new restriction and setting on an OS that won't be released widely for months. When fully functioning this setting doesn't downgrade the security of an app, but simply breakingly blocks behaviors that aren't compliant. Google advises you to start all new apps as HTTPS only, but to add this exclusion to have existing behavior of leg…

I think you're wrong on the timing of iOS 9 being widely released. I think regular users are likely to have it within the month, and adoption should be faster than ever.

Re: Handling App Transport Security in iOS 9

#48

Post by sctb » Thu, Aug 27, 2015, 5:21 PM UTC

stavros wrote: post #3

Linkbaity title. Google is actually asking developers to add an exception for its third-party ad network, if the developers use Google ads in their apps, since Google can't guarantee all third-party ads will be TLS-enabled.

We reverted the submitted title from “Google asks Ads SDK users to disable App Transport Security preceeding iOS 9” to that of the article.

Re: Handling App Transport Security in iOS 9

#49

Post by gress » Thu, Aug 27, 2015, 6:17 PM UTC

DannyBee wrote: post #30

Ignoring that it seems like the "fix" in this blog post is a really bad idea, I find it immensely funny that folks think this kind of thing is some high level decision somewhere or something deliberate and well thought out, and not "a developer relations person who got asked to make a blog post about the solution he gave some customer" Not that you shouldn't hold companies responsible, mind you, but everything everyw…

Nobody is talking about conspiracies here - just that this decision demonstrates Google's priorities.

Isn't your willingness to throw your colleague under a bus like this just as much a statement about Google culture as the original post?

Re: Handling App Transport Security in iOS 9

#50

Post by Karunamon » Thu, Aug 27, 2015, 6:35 PM UTC

gress wrote: post #45

cromwellian wrote: post #20

Seems they're between a rock and a hard place. When Google proposed HTTPS everywhere, a number of people took exception because not all content has sensitive data needing protection. I guess the real question is whether an HTTP call to load an ad copy is sensitive content. I think you can make an argument that it is sensitive content, because if I were monitoring your connection, and everything was encrypted, but I s…

Who is "between a rock and a hard place"? Google, or the ad networks?

I'm guessing Google, but they have enough power in the market that they could probably say "start serving HTTPS if you want your ads seen" and the networks would jump.