Handling App Transport Security in iOS 9
googleadsdeveloper.blogspot.com
Handling App Transport Security in iOS 9
1–10 of 61 posts
Re: Handling App Transport Security in iOS 9
#2For Google, delivering ads takes priority over security best practices and customer privacy.
Edit: an unarguably true statement, fully supported by Google's own posting, begins to be downvoted.
Google could just as easily tell the ad networks to upgrade to HTTPS, but they have chosen to ask developers to reduce the security of their applications instead.
Re: Handling App Transport Security in iOS 9
#3Linkbaity title. Google is actually asking developers to add an exception for its third-party ad network, if the developers use Google ads in their apps, since Google can't guarantee all third-party ads will be TLS-enabled.
Re: Handling App Transport Security in iOS 9
#4Intentionally disabling security settings for your entire application just to allow advertising from companies who haven't upgraded their infrastructure seems quite user-hostile. Google is a big supporter for HTTPS, strong certificates, etc., but apparently only when it doesn't affect their bottom line. If Google told their advertising networks that they need to be using HTTPS or they won't be available for iOS users they would probably get secure connections up and running pretty quickly.
Re: Handling App Transport Security in iOS 9
#5[deleted]
Re: Handling App Transport Security in iOS 9
#6For Google, delivering ads takes priority over security best practices and customer privacy. Edit: an unarguably true statement, fully supported by Google's own posting, begins to be downvoted. Google could just as easily tell the ad networks to upgrade to HTTPS, but they have chosen to ask developers to reduce the security of their applications instead.
I kinda agree in this case - why couldn't a similar blog post have been written targeted at 3rd Party Advertisers, requesting that they serve all content over TLS?
I suspect I know the answer, but it quite clearly shows where their priorities lie.
Re: Handling App Transport Security in iOS 9
#7Linkbaity title. Google is actually asking developers to add an exception for its third-party ad network, if the developers use Google ads in their apps, since Google can't guarantee all third-party ads will be TLS-enabled.
For reference, the current HN title is "Google asks developers to disable App Transport Security preceeding iOS 9 launch", while the article's title is: "Handling App Transport Security in iOS 9".
Re: Handling App Transport Security in iOS 9
#8Linkbaity title. Google is actually asking developers to add an exception for its third-party ad network, if the developers use Google ads in their apps, since Google can't guarantee all third-party ads will be TLS-enabled.
Well, they are asking to disable security completely. It's not like their asking to be added to a whitelist - which is probably not feasible.
Re: Handling App Transport Security in iOS 9
#9Linkbaity title. Google is actually asking developers to add an exception for its third-party ad network, if the developers use Google ads in their apps, since Google can't guarantee all third-party ads will be TLS-enabled.
The instructions they give are not creating an exception for any particular ad servers or just for Google's servers; they're asking developers to enable NSAllowsArbitraryLoads, which disables the security features app-wide for any URL.
Re: Handling App Transport Security in iOS 9
#10For Google, delivering ads takes priority over security best practices and customer privacy. Edit: an unarguably true statement, fully supported by Google's own posting, begins to be downvoted. Google could just as easily tell the ad networks to upgrade to HTTPS, but they have chosen to ask developers to reduce the security of their applications instead.
They are first, and foremost, the worlds largest advertising company.
This is how they make their bottom line and it will come at the detriment of anything else.
however, they value reputation too- so it's likely this will be fixed in future. But let's not throw exaggerations around. Google are not "for the people" but they're not against them either. Google are the new lawnmower[0] except they generally do things we like right now.