Apple announced this week at the company’s Worldwide Developers Conference (WWDC) that by the end of the year it wants all iOS applications in the official App Store to use secure HTTPS connections to communicate with their servers.
Application Transport Security (ATS) was introduced and enabled by default last year with the release of iOS 9.0 and OS X 10.11. The security feature is designed to protect connections between an app and its servers by enforcing the use of HTTPS.
iOS app developers can currently disable ATS, but Ivan Krstić, head of security engineering and architecture at Apple, announced at the WWDC that, by the end of 2016, all applications made available on the App Store will be required to use ATS.
“This is going to provide a great deal of real security for our users and the communications that your apps have over the network,” Krstić told developers.
Krstić clarified that apps will be required to use a secure TLS v1.2 channel, unless the data that is transferred is already-encrypted bulk data, such as in the case of media streaming.
Developers are concerned that their apps will no longer work if their own non-HTTPS domains are used to host the web servers. Others pointed out that some applications would simply not work with ATS due to the hardware that they’re using.
However, some noted that developers will still be able to publish their applications on the App Store even if they don’t use HTTPS, as long as they can provide a reasonable justification during the app review process.
Google has strongly advocated for HTTPS and the company recently added a new section to its transparency report for monitoring its use on the world’s top 100 websites. However, last year, when Apple announced its plan to introduce ATS, Google published instructions on how to handle the feature for developers who wanted to use its Mobile Ads SDK in iOS apps.
Currently, 80 percent of the search giant’s advertising products use HTTPS, but the company noted that not all third party ad networks have adopted HTTPS, which could pose problems to developers. Google has advised users of its mobile ad SDK to create a plan for migrating towards ATS compliance, but provided them a “short term fix” while they transition.
Related: WordPress.com Pushes Free HTTPS to All Hosted Sites
Related: 95% of HTTPS Servers Vulnerable to Trivial Connection Hijacking
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data
- Barracuda Urges Customers to Replace Hacked Email Security Appliances
- Google Patches Third Chrome Zero-Day of 2023
- ChatGPT Hallucinations Can Be Exploited to Distribute Malicious Code Packages
- AntChain, Intel Create New Privacy-Preserving Computing Platform for AI Training
- Several Major Organizations Confirm Being Impacted by MOVEit Attack
- Verizon 2023 DBIR: Human Error Involved in Many Breaches, Ransomware Cost Surges
- Ransomware Group Used MOVEit Exploit to Steal Data From Dozens of Organizations
Latest News
- Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data
- North Korean Hackers Blamed for $35 Million Atomic Wallet Crypto Theft
- Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions
- Barracuda Urges Customers to Replace Hacked Email Security Appliances
- Android’s June 2023 Security Update Patches Exploited Arm GPU Vulnerability
- BBC, British Airways, Novia Scotia Among First Big-Name Victims in Global Supply-Chain Hack
- Sysdig Introduces CNAPP With Realtime CDR
- Stay Focused on What’s Important
