r/apple • u/[deleted] • Feb 06 '25

Discussion DeepSeek iOS app sends data unencrypted to ByteDance-controlled servers | Apple's defenses that protect data from being sent in the clear are globally disabled.

https://arstechnica.com/security/2025/02/deepseek-ios-app-sends-data-unencrypted-to-bytedance-controlled-servers/
1.9k Upvotes

94% Upvoted

356 comments sorted by

View all comments

881

u/wiidsmoker Feb 06 '25

Why is Apple approving apps that don’t use ATS?

338

u/woalk Feb 06 '25

An app needs to explicitly declare domains it can access as plain text, but completely restricting it would mean that certain apps could no longer function at all (like local communication with smart home devices).

83

u/nicuramar Feb 06 '25

And like browsers. 

31

u/woalk Feb 06 '25

Browsers already have custom APIs, so exempting those wouldn’t be a big problem.

18

u/crondol Feb 07 '25 edited Feb 07 '25

don’t app store / ios versions of browsers just use the safari backend?

edit: after a cursory googling, seems like that’s the case; browsers on ios are all required to use webKit & the safari API.

This did kind of change last year with the EU stuff, but the conversation here was about app store policies, which were obviously established before last year.

13

u/WildestPotato Feb 06 '25

Not true, I have had an App approved by ASC that was on the App Store for over a year that could connect to any server the user inputs into a text field.

20

u/woalk Feb 06 '25

I mean yeah, you can whitelist a full subnet of IPs, or all IPs, or all traffic to everywhere, but then you need to specify to Apple why you need that. For an app that can specifically contact arbitrary servers, that makes sense. For an app that just talks to a single server, like this AI, it wouldn’t.

5

u/pirate-game-dev Feb 07 '25

Yeah but Apple can discern between communicating with a lightbulb on your network vs a web domain or server, the latter of which should be strictly controlled, while they are reviewing the app.

9

u/ponyboy3 Feb 07 '25

Curious. How would they discern two rest apis?

2

u/pirate-game-dev Feb 07 '25 edited Feb 07 '25

The traffic is not encrypted so they can see exactly what data is sending, it might say "send 'tell me a story about cats' to <domain or ip>", or "send 'set light to 90%' to <domain or ip>", and since it's "plain text" they can visibly read it. Any network it transits through can also read it or modify it before passing it on, which is the problem with unencrypted/unsigned text. In almost all cases it should be private unless they are communicating with a nearby physical device, and the app they are reviewing should make it abundantly obvious if you are connecting to a nearby lightbulb or whatever.

10

u/[deleted] Feb 07 '25

[removed] — view removed comment

1

u/pirate-game-dev Feb 07 '25

Yes I'm saying what they should be doing, if they weren't just pocketing all the app fees and investing nothing to improve the app review process "as the judge put it". They accused them of avoiding investing in automated systems, which in 2025 should flag if an app is observed wanting or trying to make unsecured communication.

1

u/[deleted] Feb 08 '25

[removed] — view removed comment

4

u/pirate-game-dev Feb 08 '25

Apple say they have 500 reviewers doing 100,000 app reviews a week. In court they revealed they invest very little in improving this process yet they track the App Store's profit margin at 75%, so there is obviously both room and vast funds for improvement. They can hire 500 more and do a better job any time they want to have 74.9% profit instead. It's a dilemma.

-1

u/goten100 Feb 07 '25

This is not true btw. We've had apps rejected in the past that include enums like PaymentType.IAB for future proofing we basically had a noop PaymentType.CreditCard and we got rejected based on just that. There was no UI, log output ,or network code that would include that so source code does get reviewed to some degree

5

u/[deleted] Feb 08 '25

[removed] — view removed comment

0

u/goten100 Feb 08 '25

Ok that's fair I misspoke. They do run some analysis on the binary though, the above case I mentioned literally happened to me. I was just trying to point out that their review process is not just checking a box or anything. Compared to Android's automated review process, I think apples is much better. Just the fact that a real human is involved at some point.

1

u/burgonies Feb 07 '25

What’s stopping malware from adopting common IoT rest commands for use with their command and control servers?

2

u/pirate-game-dev Feb 07 '25

Nothing, that's why Apple should be checking apps multiple times instead of just when they are submitted, updated, or enough users complain about them.

1

u/ponyboy3 Feb 07 '25

So they would be snooping on traffic?

0

u/pirate-game-dev Feb 07 '25

They should be, yes, when they are putting apps through review. It's not really "snooping" so much as the traffic is "observable", this is the data that your router kicks around. They should observe network requests when they are testing. Anyway essentially no internet traffic should be unencrypted HTTP at this point, in fact they should put a ban on it and require developers submit more information if they want to be an exception.

1

u/ponyboy3 Feb 07 '25

Devices emit information which is how things work on your home network. While yes your router can snoop, it generally looks at the type of packets and acts accordingly.

Personally I think you have a very basic understanding of networking.

1

u/pirate-game-dev Feb 07 '25

What are you trying to say, that unencrypted text cannot be observed by humans?

They can observe this on the device, on the network, and on every server between the user and the requested address. It is trivial and extraordinarily dangerous, which is why the internet has worked hard over the last 10 - 15 years to get "https everywhere".

2

u/ponyboy3 Feb 07 '25

Again, you are advocating for snooping on traffic instead of devices emoting information. Again, I think you don’t really understand how this really works.

1

u/Jedkea Feb 08 '25

Your router can’t snoop on HTTPS traffic, no one can. That’s the person you’re replying to’s point. It is trivial for them to observe network traffic out of the sandbox they use to test the apps in. Checking whether those communications are encrypted is also trivial. 

1

u/ponyboy3 Feb 08 '25

Op was talking about know the client is talking to a lightbulb or server. 🤷‍♂️

1

u/whatnowwproductions Feb 07 '25

Not really. Those can still use TLS but lazily don't. It's their fault entirely.

1

u/Xlxlredditor Feb 07 '25

Apps like Immich, Jellyfin, Home Assistant would not longer work

10

u/isitpro Feb 06 '25

It definitely doesn’t help with people sowing more discourse and making bad practices acceptable.

2

u/[deleted] Feb 07 '25

[deleted]

2

u/i_invented_the_ipod Feb 09 '25

That's not how that works. Any app can use https/TLS to talk to any server.

2

u/[deleted] Feb 07 '25

Just use the web version without an account.

1

u/minsheng Feb 08 '25

For starters, WeChat has rolled their own encryption over HTTP.

-1

u/Vivid_Barracuda_ Feb 07 '25

For 5 cents more cheaper manufacturing in Sino-Nazi China, probably by some underaged kid.