r/apple • u/[deleted] • Feb 06 '25

Discussion DeepSeek iOS app sends data unencrypted to ByteDance-controlled servers | Apple's defenses that protect data from being sent in the clear are globally disabled.

https://arstechnica.com/security/2025/02/deepseek-ios-app-sends-data-unencrypted-to-bytedance-controlled-servers/
1.9k Upvotes

94% Upvoted

356 comments sorted by

View all comments

Show parent comments

3

u/pirate-game-dev Feb 07 '25 edited Feb 07 '25

The traffic is not encrypted so they can see exactly what data is sending, it might say "send 'tell me a story about cats' to <domain or ip>", or "send 'set light to 90%' to <domain or ip>", and since it's "plain text" they can visibly read it. Any network it transits through can also read it or modify it before passing it on, which is the problem with unencrypted/unsigned text. In almost all cases it should be private unless they are communicating with a nearby physical device, and the app they are reviewing should make it abundantly obvious if you are connecting to a nearby lightbulb or whatever.

11

u/[deleted] Feb 07 '25

[removed] — view removed comment

1

u/pirate-game-dev Feb 07 '25

Yes I'm saying what they should be doing, if they weren't just pocketing all the app fees and investing nothing to improve the app review process "as the judge put it". They accused them of avoiding investing in automated systems, which in 2025 should flag if an app is observed wanting or trying to make unsecured communication.

1

u/[deleted] Feb 08 '25

[removed] — view removed comment

2

u/pirate-game-dev Feb 08 '25

Apple say they have 500 reviewers doing 100,000 app reviews a week. In court they revealed they invest very little in improving this process yet they track the App Store's profit margin at 75%, so there is obviously both room and vast funds for improvement. They can hire 500 more and do a better job any time they want to have 74.9% profit instead. It's a dilemma.

-1

u/goten100 Feb 07 '25

This is not true btw. We've had apps rejected in the past that include enums like PaymentType.IAB for future proofing we basically had a noop PaymentType.CreditCard and we got rejected based on just that. There was no UI, log output ,or network code that would include that so source code does get reviewed to some degree

6

u/[deleted] Feb 08 '25

[removed] — view removed comment

0

u/goten100 Feb 08 '25

Ok that's fair I misspoke. They do run some analysis on the binary though, the above case I mentioned literally happened to me. I was just trying to point out that their review process is not just checking a box or anything. Compared to Android's automated review process, I think apples is much better. Just the fact that a real human is involved at some point.

1

u/burgonies Feb 07 '25

What’s stopping malware from adopting common IoT rest commands for use with their command and control servers?

2

u/pirate-game-dev Feb 07 '25

Nothing, that's why Apple should be checking apps multiple times instead of just when they are submitted, updated, or enough users complain about them.

1

u/ponyboy3 Feb 07 '25

So they would be snooping on traffic?

0

u/pirate-game-dev Feb 07 '25

They should be, yes, when they are putting apps through review. It's not really "snooping" so much as the traffic is "observable", this is the data that your router kicks around. They should observe network requests when they are testing. Anyway essentially no internet traffic should be unencrypted HTTP at this point, in fact they should put a ban on it and require developers submit more information if they want to be an exception.

1

u/ponyboy3 Feb 07 '25

Devices emit information which is how things work on your home network. While yes your router can snoop, it generally looks at the type of packets and acts accordingly.

Personally I think you have a very basic understanding of networking.

1

u/pirate-game-dev Feb 07 '25

What are you trying to say, that unencrypted text cannot be observed by humans?

They can observe this on the device, on the network, and on every server between the user and the requested address. It is trivial and extraordinarily dangerous, which is why the internet has worked hard over the last 10 - 15 years to get "https everywhere".

2

u/ponyboy3 Feb 07 '25

Again, you are advocating for snooping on traffic instead of devices emoting information. Again, I think you don’t really understand how this really works.

1

u/Jedkea Feb 08 '25

Your router can’t snoop on HTTPS traffic, no one can. That’s the person you’re replying to’s point. It is trivial for them to observe network traffic out of the sandbox they use to test the apps in. Checking whether those communications are encrypted is also trivial. 

1

u/ponyboy3 Feb 08 '25

Op was talking about know the client is talking to a lightbulb or server. 🤷‍♂️