Apple draws cloudy line on use of root certs in mobile apps

Last week's removal of several apps from Apple's store leaves questions over the use of root certs

Apple's removal of several apps from its mobile store on Thursday shows the challenges iOS developers can face when app guidelines shift.

Among the apps removed was Choice, developed by the Palo Alto-based company Been. The app interrupted encrypted traffic streams sent to a handful of companies, including Facebook, Google, Yahoo and Pinterest, in order to block in-app ads.

Apple said the apps, which it did not name, used root digital certificates that could expose data to untrusted sources.

David Yoon, Been's co-founder, said in a phone interview Sunday that his company immediately updated Choice in order to remove the root certificate from users' devices.

Yoon said he is awaiting approval of a modified version of Choice that has been submitted to Apple.

Apple approved Choice in June when it debuted with a root certificate, which the company does not forbid. Otherwise, it would not be possible for vendors like Choice to offer VPN services on Apple mobile devices.

Root certificates are not a security issue per se, but they do allow an app to initiate a new encrypted connection with a Web service and then view the traffic using its private key.

Choice used its root cert to gain visibility on Facebook, for example, which encrypts both its content and in-app ads with SSL/TLS (Secure Socket Layer/Transport Security Layer) encryption.

Choice can also block ads and third-party tracking mechanisms on any service that does not use SSL/TLS.

But many technology companies are moving to fully encrypted services, with both content and ads delivered over SSL/TLS. The move was prompted in part by extensive data gathering by U.S. spy agencies revealed by NSA leaker Edward Snowden.

Yoon said his company fully disclosed to users how it was blocking ads within a few SSL/TLS protected services and did not retain any traffic from users' devices. But he acknowledged Apple's public justification for removing Choice.

"To be fair, to get rid of the root cert is safer, but we didn't think we were being unsafe," Yoon said.

Still, Yoon said it's unclear  what kind of use cases of root certs would not be allowed in apps.

Yoon said his company has a small but growing following. More than 10,000 people had downloaded Choice, which has a business plan that goes beyond blocking ads and third-party trackers.

Choice has an "Earn" mode in which no ads at all are filtered out. In that mode, the plan is for Choice to collect some data -- such as what apps a person uses at what specific times -- which Been can monetize.

Yoon emphasized that users would be fully informed about the data the company collects and have to opt-in to the program.

The problem Yoon said he is aiming to solve is that users' online behavior is being widely tracked now by a variety of companies and advertising networks without their consent or compensation.

Earn intends to pay users for the data they give to Choice, a value exchange that doesn't exist in the online advertising market now, Yoon said.

"Your navigation across your phone is what's interesting to us," Yoon said. "You're giving it away for free, let us pay you for it. Or, don't let us see it."

If people use Earn for a day, they get 1,000 points. After 30 days and 30,000 points, they'd get US$20, for example, Yoon said.

If only a small number of people opted into Earn, Been would be able to create sample-based inferences that might be useful to other parties, similar to how Gallup and Nielsen work, Yoon said.

It's still early days for Been, which is a small, self-funded company. Yoon said it is just he a co-founder, Sang Shin, and three or four part-time employees.

But he's been working on Choice for a couple of years and believes over the next five years there will be growing interest in paying users directly for their data.

"We are trying to make data more expensive for people so you can own it," he said. 

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

Crucial Ballistix Elite 32GB Kit (4 x 8GB) DDR4-3000 UDIMM

Learn more >

Gadgets & Things

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Family Friendly

Lexar® JumpDrive® S57 USB 3.0 flash drive 

Learn more >

Stocking Stuffer

Plox Star Wars Death Star Levitating Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?