Checklist 141: Security Privacy and WWDC

This week, we aren’t tackling an organized list as such — more like a rundown of a ton of events in a free-ranging discussion! We’re talking about WWDC, of course, the Worldwide Developers Conference Apple hosted this week. It’s an annual event where Apple often makes its big software announcements for the year and lays out the road ahead for the company’s technology. We’re looking at some of the security moves Apple made and some of the exciting upcoming changes and new developments. Buckle up — we’ve got a lot to discuss!

Opening a Hole for Parental Control

Just about everything that happened at WWDC had some security angle to it, but our first topic for today is actually something of a follow-up related to a story we covered a few weeks ago concerning parental control apps. You might remember there was a bit of a disagreement between Apple and the developers of those apps. The New York Times reported that Apple had begun to remove or restrict the functionality of parental control software following the release of its Screen Time feature in last year’s iOS 12. 

However, Apple’s response was a simple one: these companies used “enterprise technology” to track sensitive information and data generated by kids using their iOS devices. Apple said, “We do not think it is OK for any apps to help data companies track or optimize advertising of kids.” That technology is known as Mobile Device Management, or MDM, which allows large companies to track and manage devices distributed to their employees. 

Now it seems that Apple is changing course, though not without some caveats — it’s not as though the company has suddenly abandoned its privacy ideals especially as they apply to children. MacRumors reports that Apple used WWDC as an opportunity to make changes to its guidelines for the app review process. These guidelines now give the green light to MDM-powered parental control apps — if they can meet their conditions. Let’s look at what the new directive says, then we’ll break it down:

You must make a clear declaration of what user data will be collected and how it will be used on an app screen before any user action to purchase or otherwise use the service. MDM apps must not violate local laws. Apps offering MDM services may not sell, use, or disclose to third parties any data for any purpose, and must commit to this in their privacy policy. Apps that do not comply with this guideline will be removed from the App Store and you may be removed from the Apple Developer Program.

Is this a surprising change? No — not exactly, especially once you remember that Apple still faces an antitrust investigation into the fairness of the App Store. The company likely wants to promote a level playing field, even though users are more likely to use first-party apps to start with, and Apple does have a history of tweaking its guidelines to respond to new use cases. Understanding that disallowing all parental control apps could be seen as anticompetitive, and needing to balance that pressure with the desire to safeguard user privacy, are likely the conditions that led to this policy change. 

With that said, how Apple will police these new apps and make sure they are not violating the data policy remains to be seen. In the past, the company has said that it has little insight or control into how enterprises use MDM to manage devices — and we know that there will be at least a few ne’er-do-wells who will try to sneak unscrupulous parental control apps into the store. In other words, the vigilance of third parties or an angry parent going to the press will likely be the primary check on these concerns — it simply seems difficult to police.

One more change: the new guidelines also offer a new option for parental control apps, saying that “approved providers” will gain access to permissions for the usage of Apple’s personal VPN APIs. That’s a lot of alphabet soup, right? Here’s what it means: it’s a new feature that should allow apps communicating parental control data to do so over encrypted channels from end to end, so that bad guys can’t snoop and steal personally identifiable information. 

Apple Kicks Tracking and Third-Party Ads Out of “Kids” Apps

Next up, sticking with the kids theme, we have word from Engadget that says some of the other changes outlined for developers this week at WWDC are new limits on tracking and ads in apps designed for kids. Kind of hard to believe that wasn’t a thing already, right? Analytical tools that developers could use to develop a tracking profile and ads supplied by third-party networks are now verboten for kids apps. 

Now, it’s not 100% clear yet precisely how Apple will police this — presumably, this means only apps that go into the specific “Kids” category on the App Store. However, could it also apply to games rated for kids, as opposed to those with teen or adult ratings? That’s not yet clear, though it would undoubtedly be a welcome change considering how many games come packed full of advertisements. 

Why hasn’t Apple done this before over ten years of iOS releases? That’s not clear either, though it could be related to the company’s overall greater push towards highlighting their commitment to privacy. Maybe it also has something to do with the upcoming release of Apple Arcade — or maybe not.  Either way, it’s a good step forward.

Going one step further, Engadget goes on to say that Apple will also bar app developers from including in-app purchases and even links to external websites unless they’re locked down in an area only the child’s parent can enter. Parents could previously approve purchases, but now it seems parents will have to be the ones who make purchases within the app — which is an interesting new feature. 

Apple Focuses on Privacy

Throughout the presentation on Monday, there were lots of moments when Apple hit on privacy —let’s touch on a few more of them, such as new location protections.

Apple says that apps using your location will now need to ask for permission more often to maintain that access, so apps can’t continually know where you are even when you might think that feature is off. iOS will send out these background tracking alerts to let you know when something isn’t behaving the way you might have expected. Likewise, iOS will include new Wi-Fi and Bluetooth protections aimed at stopping apps from using a user’s surroundings, such as nearby wireless network SSIDs, to track them. 

Remember back when companies like Uber were getting in all kinds of trouble for tracking users all the time and using that information for less than ethical purposes? This feature will put the final nail in the coffin of that practice — hopefully. These are excellent steps forward nonetheless.

The next new feature introduced at WWDC is a login process called “Sign-In with Apple.” Think about how many websites you can visit that allow you to sign in and create an account using your existing account with Google or Facebook. It’s convenient, but it’s also a privacy problem. Well, Cupertino thinks they’ve come up with a solution: use your Apple ID to sign in, but without letting the third-party service ever actually see your Apple ID email address. 

Here’s how it works: if you choose to hide your email from third parties while using Sign-In with Apple, the company automatically creates an anonymous email address that forwards mail to your actual inbox. The third party only ever sees that randomized, single-use email — every site you sign in using your Apple ID goes to a unique email. When you don’t want any more email from that site, you can close the account, and that’s that. 

Most people agree this is a fantastic step forward, though it is only as good as the company providing it — that is, Apple. While Apple is focused on privacy and positive user experiences today, will that always be the case? We can certainly hope so, but these concerns are far down the line; for now, we can hope that privacy is a baked-in principle to Apple as a company. And let’s be real: anything that allows you instantly put a stop to unwanted emails from a site you logged into one time six months ago is a good thing.

Apple is taking this opportunity seriously, too. According to Apple Insider, Sign In with Apple will be an alternative for consumers. For developers that want to use third-party sign-in solutions in their app, it will be mandatory. In fact, Apple suggests that the Sign In with Apple button be the very first option in any list of sign-in choices.

Some security experts pointed out that it isn’t a perfect solution. For example, these services will still receive your IP address. If you are not using a VPN, this could be a useful tool for tracking a user. Ray Walsh, an expert interviewed by Engadget, said that Apple was removing only one piece of the puzzle from the equation — in other words, a good step, but maybe not the best one. Walsh recommends that users skip third-party logins altogether by simply using a burner email and a secure password to log in to services directly. 

Ultimately, it comes down to who you want to trust. Hopefully, Apple sticks to its word here.

Apple’s HomeKit also saw two new privacy-focused features announced during the company’s wide-ranging keynote. 

First up: HomeKit Secure Video. Tired of hearing all the stories about how unauthorized third parties might be able to watch through a smart home security camera? Apple wants to give you some peace of mind by partnering with creators of home security cameras to provide video coverage of your property that only you can see. Apple says the video is “analyzed” in the home, then encrypted and uploaded to iCloud, where ten days of security clips remain available for just the authorized user to view. These clips won’t count against your limit, no matter how much storage you do or don’t have in iCloud. Apple says that Logitech, Netatmo, and Eufy will be among the early adopters here.

HomeKit for Routers is coming, too, which will provide automatically managed firewalls that block off home IoT devices one by one, preventing them from suffering a hack or a breach if a bad guy breaks into your home network. Watch for products from Linksys, Eero, and Spectrum that employ this useful technology.