Researcher finds 76 popular iOS apps, including VICE News, are vulnerable to interception of TLS-protected data while in use
During the development of our web-based mobile app analysis service verify.ly, it was essential to have a clear understanding of the most common security issues which plague mobile applications today.
Context & Ripple Effects
Will Strafach's finding lands in a well-worn cycle of iOS app security research: back in 2015 a critical HTTPS bug opened some 25,000 iOS apps to eavesdropping, and in 2018 researchers caught [[a:933188|24 popular iOS apps shipping GPS, Bluetooth beacon, and Wi-Fi identifiers to data monetization firms]]. The new report adds a twist — the flaw sits inside apps' handling of TLS itself, so data meant to be protected in transit is exposed while the app is in use.
What makes it matter is the recurrence: like the TikTok clipboard-snooping cohort where most flagged apps kept the practice months later, these findings suggest disclosed mobile-app flaws are fixed slowly and unevenly, keeping researcher-built analysis services like verify.ly in demand.
First-order effects
- The 76 named apps' developers, including VICE News', face immediate pressure to ship TLS-validation fixes, since any user on a hostile network can intercept supposedly protected in-use traffic.
Second-order effects
- Enterprises and publishers vetting third-party apps gain leverage to demand proof of secure transport handling before deployment, pushing security testing from periodic audits toward continuous, service-based analysis of the kind verify.ly represents.
Third-order effects
- If the pattern holds — big disclosures followed by lagging patches across the 2015, 2018, and 2020 cohorts — app-store gatekeepers face structural pressure to automate transport-security checks at review time rather than relying on developer attestations after the fact.
The trend: iOS app security is settling into a researcher-disclosure-driven loop in which transport-layer flaws surface in waves and vendors patch them slowly enough to sustain an independent mobile-app analysis market.