Two-thirds of iOS apps disable ATS, an iOS security feature

guest · Jun 5, 2019

Two-thirds of iOS apps disable ATS, an iOS security feature
Three and a half years after its launch, ATS is still not widely adopted
June 5, 2019
https://www.zdnet.com/article/two-thirds-of-ios-apps-disable-ats-an-ios-security-feature/

Two-thirds of iOS apps do not use an Apple technology that can help them support and enforce encrypted communications, according to a report published today by cyber-security firm Wandera.

The company said it scanned over 30,000 iOS applications and found that 67.7% of the apps were disabling a default iOS security feature called ATS (App Transport Security) on purpose.
ATS was introduced with the release of iOS 9, released in September 2015, and works by blocking all HTTP connections between an app and its remote server.

In its report, Wandera says that only 27% of the 30,000 apps it scanned are currently using ATS to enforce encrypted communications and block plaintext HTTP connections.
Around 5.3% use ATS, but they disabled it granularly, for certain domains.
AD FRAMEWORKS RECOMMEND DISABLING ATS
According to Wandera, the reason why three years later the ATS security feature has seen little adoption appears to be that ad frameworks/networks often recommend in their documentation that iOS developers disable ATS inside apps
Click to expand...

https://developer.apple.com/library...InfoPlistKeyReference/Articles/CocoaKeys.html
NSAppTransportSecurity
On Apple platforms, a networking security feature called App Transport Security (ATS) is available to apps and app extensions, and is enabled by default.

It improves privacy and data integrity by ensuring your app’s network connections employ only industry-standard protocols and ciphers without known weaknesses. This helps instill user trust that your app does not accidentally leak transmitted data to malicious parties.
Click to expand...

Wandera: iOS app developers taking shortcuts on security

act8192 · Jun 5, 2019

mood said: ↑

Two-thirds of iOS apps disable ATS, an iOS security feature
Three and a half years after its launch, ATS is still not widely adopted
June 5, 2019
https://www.zdnet.com/article/two-thirds-of-ios-apps-disable-ats-an-ios-security-feature/
Wandera: iOS app developers taking shortcuts on security
Click to expand...

Neither zdnet nor Wandera articles list the affected applications. At least the commonly used ones. I'd think the users of iOS would benefit from some lists rather than very general categories.

Log in or Sign up

Two-thirds of iOS apps disable ATS, an iOS security feature

guest Guest

act8192 Registered Member

Log in or Sign up

Two-thirds of iOS apps disable ATS, an iOS security feature

guest Guest

act8192 Registered Member

Useful Searches