Apple announced this week at the company’s Worldwide Developers Conference (WWDC) that by the end of the year it wants all iOS applications in the official App Store to use secure HTTPS connections to communicate with their servers.
Application Transport Security (ATS) was introduced and enabled by default last year with the release of iOS 9.0 and OS X 10.11. The security feature is designed to protect connections between an app and its servers by enforcing the use of HTTPS.
iOS app developers can currently disable ATS, but Ivan Krstić, head of security engineering and architecture at Apple, announced at the WWDC that, by the end of 2016, all applications made available on the App Store will be required to use ATS.
“This is going to provide a great deal of real security for our users and the communications that your apps have over the network,” Krstić told developers.
Krstić clarified that apps will be required to use a secure TLS v1.2 channel, unless the data that is transferred is already-encrypted bulk data, such as in the case of media streaming.
Developers are concerned that their apps will no longer work if their own non-HTTPS domains are used to host the web servers. Others pointed out that some applications would simply not work with ATS due to the hardware that they’re using.
However, some noted that developers will still be able to publish their applications on the App Store even if they don’t use HTTPS, as long as they can provide a reasonable justification during the app review process.
Google has strongly advocated for HTTPS and the company recently added a new section to its transparency report for monitoring its use on the world’s top 100 websites. However, last year, when Apple announced its plan to introduce ATS, Google published instructions on how to handle the feature for developers who wanted to use its Mobile Ads SDK in iOS apps.
Currently, 80 percent of the search giant’s advertising products use HTTPS, but the company noted that not all third party ad networks have adopted HTTPS, which could pose problems to developers. Google has advised users of its mobile ad SDK to create a plan for migrating towards ATS compliance, but provided them a “short term fix” while they transition.
Related: WordPress.com Pushes Free HTTPS to All Hosted Sites
Related: 95% of HTTPS Servers Vulnerable to Trivial Connection Hijacking
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
- Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Zyxel Firewalls Hacked by Mirai Botnet
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations
- Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances
- OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers
Latest News
- Chrome 114 Released With 18 Security Fixes
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
- Breaking Enterprise Silos and Improving Protection
- Spyware Found in Google Play Apps With Over 420 Million Downloads
- Millions of WordPress Sites Patched Against Critical Jetpack Vulnerability
- Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery
- PyPI Enforcing 2FA for All Project Maintainers to Boost Security
- Personal Information of 9 Million Individuals Stolen in MCNA Ransomware Attack
