Apple finally turns HTTPS on for the App Store, fixing a lot of vulnerabilities
Early July 2012, I reported to Apple numerous vulnerabilities related to their App Store iOS app. Last week Apple finally issued a fix for it and turned on HTTPS for the App Store.
Context & Ripple Effects
Apple had previously prepared a fix for an iPhone browser security hole in 2010; the App Store change extends Apple’s security maintenance burden from the browser to a central distribution service. The reported flaws were disclosed to Apple in July 2012, making the delayed fix and HTTPS deployment a consequential hardening step for iOS software delivery.
First-order effects
- App Store traffic from iOS devices is encrypted, closing the reported vulnerabilities associated with the service and reducing exposure for Apple’s App Store users.
- Apple shifts the App Store from an unencrypted service path to HTTPS, making secure transport part of the store’s baseline operation.
Second-order effects
- Network intermediaries that could inspect or alter unencrypted App Store exchanges lose that opportunity, while Apple must operate and maintain HTTPS across a high-traffic distribution channel.
Third-order effects
- The move reinforces a security model in which mobile-platform operators are accountable not only for app review but also for protecting the delivery infrastructure that connects users to software.
The trend: Major mobile platforms are treating encrypted transport for core distribution services as foundational infrastructure rather than an optional security layer.