Hacker News Reader

Comment by xgbi | Hacker News Reader

This does not sound like the Apple I know about.

I mean, these guys forced every app to be able to handle IPV6-only network operations last year. And this was after making all apps switch to 64 bits a bit earlier. Why did they back up off SSL?

I feel like this is kind of a turning point, where Apple, instead of driving the market with innovative APIs and having a vision, now tries to compromise and removes innovative features to keep its immense app market happy, and oblige for it.

What a let down, especially after a very nice 2016 year, where they stood against the FBI and published their open letter about privacy of their customers.

View on HN

> Why did they back up off SSL?

Go try and buy something on https://apple.com - you will once you go to view your cart you will be redirected to plain vanilla HTTP. There is no way around this. If they can't get their own SSL support in order...

Why is there no way around this? This is surprising to me and I'm super curious.

If I had to give them the benefit of the doubt, I'd guess that they feel that SSL has failed at fulfilling its intended purpose, and that they're working on a "superior" alternative which they plan to use for themselves and force all developers for their platforms to also use, in an attempt to encourage it to spread and supersede SSL.

The exchange of payment or authentication information is undoubtedly done over TLS so it's probably just not a priority. That said there seems to be some obvious security issues with it since a bad actor could, as far as I know, inject malicious javascript in the vanilla http page to do all kinds of fun stuff.

Yeah but the checkout button on the insecure cart page could be changed so that it instead points to http://www.apple-payment.com/... or any random malicious "checkout" page which then steals your CC. They've compromised the security of credit card details users will at some point enter by doing this. It's insane if that isn't a priority.

It also exposes all of your cookies for apple.com since not a single cookie is marked secure/HTTPS only.

>I mean, these guys forced every app to be able to handle IPV6-only network operations last year.

That's easy to answer. The US government has an IPv6 mandate. They have no such SSL mandate.

The US gov does mandate that products support IPv6, but they don't mandate that everything can work on v6-only networks.

The mandate comes from mobile carriers, some of whom desperately want to run networks where phones only get v6 addresses, and v4 traffic is tunneled through DNS64/NAT64.

And you don't think the government runs their own mobile networks in war zones? They definitely aren't relying on Zain.

While I agree with everything you said, here's an example of forced SSL being very hard to deal with.

Decentralized platform, needs to be connected to nodes. Each node can't get an SSL cert because we can't force everyone on a blockchain to get a domain name. It doesn't matter that there's SSL anyway because everything's signed by the server anyway. The data the client sends is also public, so the worst that can happen is an attacker blocks a transaction. This can also happen with SSL.

We could just distribute a cert with the node and hardcode it into our app, but then there's no point of SSL, we just published our private key.

Yes, this is kinda edge case.

Reply on news.ycombinator.com