Apple announced this week at the company’s Worldwide Developers Conference (WWDC) that by the end of the year it wants all iOS applications in the official App Store to use secure HTTPS connections to communicate with their servers.
Application Transport Security (ATS) was introduced and enabled by default last year with the release of iOS 9.0 and OS X 10.11. The security feature is designed to protect connections between an app and its servers by enforcing the use of HTTPS.
iOS app developers can currently disable ATS, but Ivan Krstić, head of security engineering and architecture at Apple, announced at the WWDC that, by the end of 2016, all applications made available on the App Store will be required to use ATS.
“This is going to provide a great deal of real security for our users and the communications that your apps have over the network,” Krstić told developers.
Krstić clarified that apps will be required to use a secure TLS v1.2 channel, unless the data that is transferred is already-encrypted bulk data, such as in the case of media streaming.
Developers are concerned that their apps will no longer work if their own non-HTTPS domains are used to host the web servers. Others pointed out that some applications would simply not work with ATS due to the hardware that they’re using.
However, some noted that developers will still be able to publish their applications on the App Store even if they don’t use HTTPS, as long as they can provide a reasonable justification during the app review process.
Google has strongly advocated for HTTPS and the company recently added a new section to its transparency report for monitoring its use on the world’s top 100 websites. However, last year, when Apple announced its plan to introduce ATS, Google published instructions on how to handle the feature for developers who wanted to use its Mobile Ads SDK in iOS apps.
Currently, 80 percent of the search giant’s advertising products use HTTPS, but the company noted that not all third party ad networks have adopted HTTPS, which could pose problems to developers. Google has advised users of its mobile ad SDK to create a plan for migrating towards ATS compliance, but provided them a “short term fix” while they transition.
Related: WordPress.com Pushes Free HTTPS to All Hosted Sites
Related: 95% of HTTPS Servers Vulnerable to Trivial Connection Hijacking