Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

Apple Wants All iOS Apps to Use HTTPS by 2017

Apple announced this week at the company’s Worldwide Developers Conference (WWDC) that by the end of the year it wants all iOS applications in the official App Store to use secure HTTPS connections to communicate with their servers.

Apple announced this week at the company’s Worldwide Developers Conference (WWDC) that by the end of the year it wants all iOS applications in the official App Store to use secure HTTPS connections to communicate with their servers.

Application Transport Security (ATS) was introduced and enabled by default last year with the release of iOS 9.0 and OS X 10.11. The security feature is designed to protect connections between an app and its servers by enforcing the use of HTTPS.

iOS app developers can currently disable ATS, but Ivan Krstić, head of security engineering and architecture at Apple, announced at the WWDC that, by the end of 2016, all applications made available on the App Store will be required to use ATS.

“This is going to provide a great deal of real security for our users and the communications that your apps have over the network,” Krstić told developers.

Krstić clarified that apps will be required to use a secure TLS v1.2 channel, unless the data that is transferred is already-encrypted bulk data, such as in the case of media streaming.

Developers are concerned that their apps will no longer work if their own non-HTTPS domains are used to host the web servers. Others pointed out that some applications would simply not work with ATS due to the hardware that they’re using.

However, some noted that developers will still be able to publish their applications on the App Store even if they don’t use HTTPS, as long as they can provide a reasonable justification during the app review process.

Google has strongly advocated for HTTPS and the company recently added a new section to its transparency report for monitoring its use on the world’s top 100 websites. However, last year, when Apple announced its plan to introduce ATS, Google published instructions on how to handle the feature for developers who wanted to use its Mobile Ads SDK in iOS apps.

Advertisement. Scroll to continue reading.

Currently, 80 percent of the search giant’s advertising products use HTTPS, but the company noted that not all third party ad networks have adopted HTTPS, which could pose problems to developers. Google has advised users of its mobile ad SDK to create a plan for migrating towards ATS compliance, but provided them a “short term fix” while they transition.

Related: WordPress.com Pushes Free HTTPS to All Hosted Sites

Related: 95% of HTTPS Servers Vulnerable to Trivial Connection Hijacking

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

People on the Move

Digital executive protection services provider BlackCloak has appointed Ryan Black as CISO.

Joe Levy has been appointed Sophos' permanent CEO, and Jim Dildine has been named the company's CFO.

CISA executive assistant director for cybersecurity Eric Goldstein is leaving the agency after more than three years.

More People On The Move

Expert Insights

Related Content

Malware & Threats

Apple’s cat-and-mouse struggles with zero-day exploits on its flagship iOS platform is showing no signs of slowing down.

Mobile & Wireless

Samsung smartphone users warned about CVE-2023-21492, an ASLR bypass vulnerability exploited in the wild, likely by a spyware vendor.

Fraud & Identity Theft

A team of researchers has demonstrated a new attack method that affects iPhone owners who use Apple Pay and Visa payment cards. The vulnerabilities...

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Mobile & Wireless

Critical security flaws expose Samsung’s Exynos modems to “Internet-to-baseband remote code execution” attacks with no user interaction. Project Zero says an attacker only needs...

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Mobile & Wireless

Asus patched nine WiFi router security defects, including a highly critical 2018 vulnerability that exposes users to code execution attacks.