Apple’s App Store Stubbornness May Be iOS’s Greatest Security Vulnerability

Apple is in the business of selling great user experiences that offer more in “use value” than they charge in “cash value”. No consumers were mislead or fooled about the nature of Apple’s walled garden eco-system. Apple’s curated eco-system is a key feature of the iPhone that consumers factor in when considering its value proposition. To take this feature away from hundreds of millions of consumers who paid for it would be stealing.

Apple has sold over a billion iOS devices and consistently ranks #1 in customer satisfaction. If you believe the App Store isn’t “competitive”, what do you base that on?

Consider the services the App Store provides:

  • In app licensing system.
  • Web hosting for software downloads.
  • Automated one button software install and update.
  • Online E-commerce integration.
  • Payment processing in hundreds of countries including tax compliance.
  • Software review and code signing to help protect users from malware.
  • Marketing exposure as part of one-stop searchable software library.
  • Developer tools and documentation for writing and publishing platform software.
  • Created software platform with huge addressable market.
  • Ongoing support of large and expanding software eco-system.

80% of the apps in the App Store are free and pay no commission beyond $100/year to be a member of Apple’s Developer program.

You can’t get all these services for less than 10-15% unless you pay to design, build, and maintain some of them yourself. I’ve been selling Mac software on the web since 1998 and had to build my own store to accept credit cards and send out registration keys before most others existed.

There are several areas where Apple needs to do better to play fair based on their current size and market power. In my view, breaking the single curated App Store model is missing the point and would be shooting iPhone users in the foot.

3 Likes

Rich: Maybe I’m missing something here, after all I’m not a security guru, but would I be right in saying that, in a world where there were alternative app stores and sideloading was possible, then the only people at risk would be the people who used them? In other words buying an Apple device and only using the Apple app store would be as safe an option as it is today.

If that is correct, would not a potential / appropriate Apple response be: if you want to stay safe, we have your back, but if you want to play Russian Roulette then feel free?

The (a?) problem would be if the app that you really, absolutely, unavoidably, desperately must have was only available on a competing store and not on the Apple one. My contention would be that the vast majority of ordinary users would stay with the Apple store, inertia if nothing else :innocent:, so if the developer of that absolutely essential app would have an incentive to release it on the Apple store.

1 Like

Israeli firms have found ways to compromise the security of both iOS and Android phones without the user needing to download an app. The question is whether it’s easier to compromise an Android phone than an iOS phone in general, even if the Android owner only uses apps downloaded from the trusted Android store. It seems like there is a natural experiment in progress as a result of the differing security models. That is, the answer to your question might be in the real-life experience of Android phone users who are security conscious.

This fails the “My Mom” test – what would happen to my elderly mother when screen pops up asking her to authorize side-loading? Not good things.

But I’ll ask again, of everyone in this thread: as a consumer, what specific problem is this causing you? What are you missing because Apple won’t let you side load?

Yes, I accept that, but think about the warning that pops up in eg Google Chrome when you try to go to an “insecure” web site. I could imagine a similar thing built in to the Apple ecosystem which asks “are you really, really sure you want to do this?”

Or Apple could stay with no side loading and my Mom would have one less thing that confused her and possibly caused problems.

Absolutely, but by the sounds of it that’s not an option going forward.

Nothing has passed yet.

It’s the social engineering- people are fooled constantly to disable security controls on their computers today. With the scale of iPhones this becomes a much worse issue.

1 Like

To add- people click through those warnings all the time. Last year I had to clean the Macs of both an older relative and a friend of my wife. Both of them said “I was so stupid” but they did it anyway.

Humans are… mushy.

1 Like

Remember when Napster was a free file sharing site? It had the record, and other, industries quaking in their boots over lost revenue, and people were using it despite the fact that it also became a haven for malware. The US and other governments defanged it because of copyright infringements, not because of the rampant malware. People were willing to take the risk for freebies. A huge % of its membership, literally millions and millions across the globe, took the risk, regardless of the security issues.

Steve Jobs was able to totally upend the way music was sold with the introduction of iTunes and iPod. A very big reason for the success of iTunes was that it was a very safe and secure app, and one that you could trust your credit card with.

2 Likes

Did you even look at the article and tweets?

One developer that is clearly fraudulent is responsible for 3 of the top grossing apps as well as 3 of the top free apps. But we’re not just talking about it being widespread, which it is. We’re also talking about the fact that Apple refuses to protect its users in its walled guard from the predatory practices of these sorts of developers when they are reported.

Both of these facts are important in a discussion where people are lauding Apple for doing such a good job preventing these sorts of apps and protecting the users.

3 Likes

It’s never been particularly dangerous to download an MP3, which is almost exclusively what Napster was used for. Such scare tactics about how big, bad and scary Napster was came directly from the mouths of the abusive media companies. So you quoting them in this context only further erodes your position in the eyes of anybody who actually used Napster at the time. FUD is not an argument.

1 Like

I’m not a big defender of Apple’s app review process, which I think is still struggling from growing pains and lack of focus on Apple’s part (I don’t believe Apple is malicious in how they handle the reviews, but their inconsistency is a side effect of their lack of organization and poor planning), but I can’t say app review is utterly useless or that side loading is a good idea.

Case in point is I just finished watching Showtime’s “Super-Pumped” series about the rise and fall of Uber. Now I’d heard most of the leaked information about Uber’s slimy business practices before the series, but there was a scene in the show that depicted Apple threatening to kick Uber out of the App Store, which would have killed the company. I don’t know how much truth there was in that, but it was interesting, because Uber managed to circumvent (i.e. fool) Apple’s review process by doing sleazy tactics like incorporating a geofence in their app so that if the app was running near Cupertino it would behave well, but once it was outside of that circle, it would suck user’s data and track them, etc. against Apple’s rules. Once Apple caught onto this, Uber had to clean up their act or go out of business.

Then there’s the case of Facebook who famously abused enterprise certificates to enable side-loading of a privacy-violating app onto iPhones.

These are giant companies doing everything they can to skirt Apple’s rules that protect us users from abuse – can you imagine what those companies would do if Apple wasn’t there to stop them? And what about the zillions of tiny companies who have even less to lose than the giants?

App review isn’t perfect, but it does catch and prevent a lot of bad behavior. Side loading eliminates that completely. Companies like Facebook would soon push their users to download the “official” app on their own website and who knows what that app would do with no one to regulate it.

The bottom line is that it is a handful of developers and politicians who are complaining about Apple’s “monopoly,” not users. Users are quite happy with the status quo (and those who aren’t can switch to Android).

5 Likes

If I could name one thing that could definitely be better, it’s subscription to digital services plus payments for digital goods in third party apps. You cannot purchase Kindle books within the Kindle app or the Amazon app (though you can if you go to Amazon’s web site in a browser.) At least for now, you cannot subscribe to Netflix within the Netflix app, or to YouTube TV within its app. Issues like this are not, to quote @silbey, “my mom” friendly.

There are probably other issues, such as Microsoft’s game streaming service. It seems silly to require running in a browser rather than within an app.

I’m not sure that I am saying that. At least for me, what I am saying is that I think that Apple does a better job of this (for the average user particularly) than I fear a third-party App Store would or that side-loading would for users. (Saying that, the Amazon App Store for Android I remember being fine.)

When I search in the App Store, Googe’s app always comes up first when I search for Google Calendar, Gmail, or Google Drive. Dropbox’s app always comes up first when I search for Dropbox (even when I misspell it “Dripbox”). For the one billion users of the App Store, including “my mom”, that’s good enough. Yes, Apple can and should do better. But they do well enough I think.

3 Likes

I did! That’s why I asked the question.

What’s also important is knowing how widespread the problem, both absolutely and comparatively. Every large complex system is going to have failures. The issue is whether the system is better or worse than other, different systems. So, again my question: how widespread are situations like this?

1 Like

@siLBey, not @sibley, but that’s a good example. I have to say though, I do like the centralization of subscriptions that gives — managing through Apple simplifies things a lot.

That was my thought if government overrules common sense and forces the issue…but the App Store use should be an either or situation….and if you switch stores the apps from the other store get deleted. You either have the walled garden with Apple’s approved apps or ypu have the other one and only out of the box Apple apps and those won’t get updated since you’re not in Apple’s store. And which store you’re using gets reported back to Apple with the AppleID it pertains to…so that Apple can say tough nuggies if you get screwed by the other store. One would have to be able to go back and forth between stores to get originally installed Apple apps to update but every time you switch all other apps from the other store get deleted with their data…that way the chance of iOS contamination gets minimized.

In other words…allow 3rd party stores but make it hard to switch back and forth and make it explicitly known and agreed to by the user that you’re on your own.

You’re right of course…and government should not be sticking their noses into the business practices of a not a monopoly company anyway…but unfortunately people of a certain political persuasion won’t be able to help them selves and will pass such laws and regulations. They might be eventually tossed out as unconstitutional or whatever the equivalent in the EU is or China or whatever…but Apple should be ahead of the game in having a pre figured out answer to this problem.

OK, this is veering dangerously into political territory, and I’ll be deleting posts in that vein.

1 Like