Handling App Transport Security in iOS 9(googleadsdeveloper.blogspot.com) |
Handling App Transport Security in iOS 9(googleadsdeveloper.blogspot.com) |
---
[Google] are first, and foremost, the worlds largest advertising company. This is how they make their bottom line and it will come at the detriment of anything else. however, they value reputation too- so it's likely this will be fixed in future. But let's not throw exaggerations around. Google are not "for the people" but they're not against them either. Google are the new lawnmower[0] except they generally do things we like right now. [0] https://youtu.be/-zRN7XLCRhc?t=2084
I guess the real question is whether an HTTP call to load an ad copy is sensitive content. I think you can make an argument that it is sensitive content, because if I were monitoring your connection, and everything was encrypted, but I suddenly saw lots of ads for Ashley Madison and cheating sites, I might conclude that you had been researching those in the past even if I couldn't see your other traffic.
A better way would just to let the ad networks fix it. You can bet that after iOS9 ships, if they see a massive drop in ad traffic, they'll be burning the midnight oil to fix it ASAP.
I mean, iOS9 betas have been out for a long time, so it's not like they haven't had time to prepare.
https://www.amnesty.org/en/latest/campaigns/2015/04/7-reason...
https://www.aclu.org/blog/you-may-have-nothing-hide-you-stil...
http://www.ted.com/talks/glenn_greenwald_why_privacy_matters
http://falkvinge.net/2012/07/19/debunking-the-dangerous-noth...
https://citizenlab.org/2014/08/cat-video-and-the-death-of-cl...
The public at large doesn't care or understand unless they're banking or porning, and I'm not sure about the banking.
Telecoms, shareholders, advertisers, governments, and criminals are actively opposed.
We have a ways to go.
"If you do decide to convert your HTTP site to HTTPS, please be aware that because we remove non-SSL compliant ads from the auction, thereby reducing auction pressure, ads on your HTTPS pages might earn less than those on your HTTP pages." [0]
I wouldn't be surprised if many app developers put in this exception because at the end of the day, they will hurt too if ads stop showing up.
1. Imposes cost on people serving content even if they think the content doesn't need it in terms of machine resources.
2. Imposes an extra cost on people serving content, in the form of SSL certs. ("Why do I need to pay for this when I'm just hosting a plain vanilla homepage!?!?")
3. The PHK rant.
My point is, not everyone believes that every request should be encrypted (I do), and Google has face criticism on both sides of the fence from purists who believe HTTPS somehow takes away some of the original freedom and centralizes the Web a bit more by requiring cert-authorities.
And how many apps will forever more have NSAllowsArbitraryLoads enabled because a) Google can't get all their ad partners to switch and b) because devs don't remember to go switch it back off?
Not that I agree they should offer that option, because of course there is no such thing as "gracefully degrading" security.
Not that you shouldn't hold companies responsible, mind you, but everything everywhere is not some company (no matter who it is Google, Apple, etc) deliberately trying to screw you with some motive and purpose and grand conspiracy for how to achieve it in mind. Most wrong/dumb things are usually just simply random people being wrong or not thinking things through on the internet[1]
I guess a lot of folks have never worked at any mid-size or large companies :)
[1] The large company comment also applies to the possible retort that they should know better.A lot of large companies have 100's of "official" blogs. I'm sure corp comm/security/whoever would love to just have 1 they have to watch. But such a thing is not really the world.
Isn't your willingness to throw your colleague under a bus like this just as much a statement about Google culture as the original post?
This is a new restriction and setting on an OS that won't be released widely for months. When fully functioning this setting doesn't downgrade the security of an app, but simply breakingly blocks behaviors that aren't compliant.
Google advises you to start all new apps as HTTPS only, but to add this exclusion to have existing behavior of legacy applications, at least in the short term while they continue migrating the entire ad network to HTTPS.
There is an enormous amount of overreaction and, dare I say, hysteria throughout this thread, and you would think that Google just disabled SSL on the device or something, versus offered an approach for apps to continue doing what they're doing, presumably with the developer understanding the consequences.
And it's also easy to just say "google should just suck it up and take their losses and just do HTTPS". You have to think that a lot of games rely on Google having a big ad inventory to monetize (and it's their only revenue model).
I don't work at Google, but do work in ad-tech. The HTTPS only move by Apple is great and will make a lot of things better... But it's going to take a while.
PS: Check prices of CDNs with SSL... They are also expensive.
Then if you flip NSAllowsArbitraryLoads to true you will have to justify in the app review process why your app is needing that.
And something tells me that 'making arbitrary insecure connections to ad delivery platforms' is not going to be a valid reason. You may be rejected for that. Or there may at least be a big fat warning on the app store page that says 'beware this app talks to random insecure servers'.
It is a big win for users and the fight against lawless surveillance. Go Apple!
---
I.e. they know it sucks, and are working on something better.
If it was my decision, I'd allow disabling App Transport Security if your app is something like a browser or an RSS client, were you need to connect to servers not under your control.
If you need to disable it to make ads work, I'd reject it.
Edit: an unarguably true statement, fully supported by Google's own posting, begins to be downvoted.
Google could just as easily tell the ad networks to upgrade to HTTPS, but they have chosen to ask developers to reduce the security of their applications instead.
This is how they make their bottom line and it will come at the detriment of anything else.
however, they value reputation too- so it's likely this will be fixed in future. But let's not throw exaggerations around. Google are not "for the people" but they're not against them either. Google are the new lawnmower[0] except they generally do things we like right now.
I suspect I know the answer, but it quite clearly shows where their priorities lie.
Very often there are trade-offs between security, usability, financial gain, and various other factors. If security and customer privacy should always win absolutely, then the easiest way to achieve that would be to disable the internet.
The reality is that Google has decided that the damage to their bottom line (and the bottom line of the publishers who benefit financially from using their ad system) is greater than the likely damage of making this change. I can't say whether or not their right, but it's silly to pretend that Google simply said "Security or profit? Profit every time!".
Saying it's "unarguably true" doesn't make it so.
[0] http://ste.vn/2015/06/10/configuring-app-transport-security-...
Google can guarantee all third party ads will be TLS enabled simply by not making this request.
Edit: true statements of fact downvoted again
This is the crux. Google can force all third parties that display ads through their service to support TLS, but instead they're asking the other guy, the client, to change their product.
Why can'g google be more specific about the domains on which to allow insecure http traffic? Because their SDK loads content from arbitrary ad delivery platforms.
You mean, then the specific ad is broken, as long as its ad router isn't fixed to use https?
And when all your impression pixels are refused because of insecure content warnings (because your server is serving over https), your impressions stats dive harder than a lead zeppelin.
What's broken is the total lack of standardization for any of these companies, which makes sense given that most of these guys are slinging diet pills and brain supplements to the LCD; Great devs don't usually gravitate to industries like that.