Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

Apple Wants All iOS Apps to Use HTTPS by 2017

Apple announced this week at the company’s Worldwide Developers Conference (WWDC) that by the end of the year it wants all iOS applications in the official App Store to use secure HTTPS connections to communicate with their servers.

Apple announced this week at the company’s Worldwide Developers Conference (WWDC) that by the end of the year it wants all iOS applications in the official App Store to use secure HTTPS connections to communicate with their servers.

Application Transport Security (ATS) was introduced and enabled by default last year with the release of iOS 9.0 and OS X 10.11. The security feature is designed to protect connections between an app and its servers by enforcing the use of HTTPS.

iOS app developers can currently disable ATS, but Ivan Krstić, head of security engineering and architecture at Apple, announced at the WWDC that, by the end of 2016, all applications made available on the App Store will be required to use ATS.

“This is going to provide a great deal of real security for our users and the communications that your apps have over the network,” Krstić told developers.

Krstić clarified that apps will be required to use a secure TLS v1.2 channel, unless the data that is transferred is already-encrypted bulk data, such as in the case of media streaming.

Developers are concerned that their apps will no longer work if their own non-HTTPS domains are used to host the web servers. Others pointed out that some applications would simply not work with ATS due to the hardware that they’re using.

However, some noted that developers will still be able to publish their applications on the App Store even if they don’t use HTTPS, as long as they can provide a reasonable justification during the app review process.

Advertisement. Scroll to continue reading.

Google has strongly advocated for HTTPS and the company recently added a new section to its transparency report for monitoring its use on the world’s top 100 websites. However, last year, when Apple announced its plan to introduce ATS, Google published instructions on how to handle the feature for developers who wanted to use its Mobile Ads SDK in iOS apps.

Currently, 80 percent of the search giant’s advertising products use HTTPS, but the company noted that not all third party ad networks have adopted HTTPS, which could pose problems to developers. Google has advised users of its mobile ad SDK to create a plan for migrating towards ATS compliance, but provided them a “short term fix” while they transition.

Related: WordPress.com Pushes Free HTTPS to All Hosted Sites

Related: 95% of HTTPS Servers Vulnerable to Trivial Connection Hijacking

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.

Register

Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.

Register

Expert Insights

Related Content

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Critical security flaws expose Samsung’s Exynos modems to “Internet-to-baseband remote code execution” attacks with no user interaction. Project Zero says an attacker only needs...

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Mobile & Wireless

The February 2023 security updates for Android patch 40 vulnerabilities, including multiple high-severity escalation of privilege bugs.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Cybercrime

A digital ad fraud scheme dubbed "VastFlux" spoofed over 1,700 apps and peaked at 12 billion ad requests per day before being shut down.