Safari on iOS, which only used Google Safe Browsing for malicious site warnings earlier, now says it may also use Tencent Safe Browsing, which can log IPs
This morning brings new and exciting news from the land of Apple. It appears that, at least on iOS 13, Apple is sharing some portion …
A Few Thoughts on Cryptographic EngineeringMatthew Green
Safari users in mainland China on iOS 13 now have URL-prefix hashes and IP addresses flowing to Tencent instead of Google, making Tencent Safe Browsing's IP-logging capability a live privacy exposure for that population.
Users outside China face ambiguity about which provider is active on their device, since iOS 13's settings language ('may also use') does not clearly scope the Tencent path — the confusion Apple's clarification was meant to resolve.
Second-order effects
Apple's response was architectural rather than contractual: starting with iOS 14.5 it proxies Safe Browsing through its own servers, cutting Google and Tencent out of direct contact with user data — a template competitors now have to match.
Google is moving the other direction, planning to bring Chrome's Enhanced Safe Browsing to iOS, which expands URL tracking on Apple's own platform and sets up a privacy-vs-protection contrast inside Safari's home turf.
Third-order effects
Safe-browsing telemetry is becoming a structural privacy battleground: browser vendors either internalize the data path through their own proxies or absorb scrutiny over third-party IP logging, and Apple's proxy move signals which way the market leader is resolving it.
Region-specific threat-intel partners — Tencent for mainland China — look like the emerging template for serving security features under data-localization constraints, with the provider chosen by jurisdiction rather than by user consent.
The trend: Browser security is being restructured around who can see browsing telemetry, with Apple pulling the Safe Browsing data path in-house while regional partners like Tencent fill jurisdictional gaps.
Apple: “The actual URL of a website you visit is never shared with a safe browsing provider and the feature can be turned off.” https://twitter.com/...
Lols 😬😬😬 “It increasingly feels like Apple is two different companies: one that puts the freedom of its users first, and another that treats its users very differently. Maybe Apple feels it can navigate this split personality disorder and still maintain its integrity. ” https:/…
“It appears that, at least on iOS 13, Apple is sharing some portion of your web browsing history with the Chinese conglomerate Tencent.” https://blog.cryptographyengineering.co m/ ... $AAPL
iOS 13 forces people to choose between privacy and security with little info: (a) see fraudulent website warnings but share data with Google and Chinese conglomerate Tencent, or (b) not share data but not see warnings either. https://blog.cryptographyengineering.co m/ ...
‘...we have another example of Apple making significant modifications to its privacy infrastructure, largely without...announcement’ https://blog.cryptographyengineering.co m/ ...
I'm sure this is fine for me personally (localized to mainland Chinese users, maybe?) but it's still not a great move to pull in the middle of all that's going on. Especially silently. https://twitter.com/...
Hopping over to the Github you can see it only does this for users of mainland China, for the same reasons you use Alibaba DNS resolving there and not 1.1.1.1 or 8.8.8.8 (they don't work.) Tencents SafeBrowsing is used by all IM apps there. https://github.com/... https://twitter.…
Apple won't snoop on your private data to show you targeted ads, but they'll do one better and let foreign governments do some targeted snooping instead. https://twitter.com/...
Google Safe Browsing does a solid job detecting malicious or fraudulent websites. I have no idea why you'd also need Tencent Safe Browsing. https://twitter.com/...
The problem here is sending URLs to 3rd party services. Tencent, a China based company, is not trustworthy, so does Google. There are many proofs that Google is an evil company and not trustworthy. https://twitter.com/...
I have long advocated for Apple to reinvent the web using a more private, secure, and ethical architecture. They're going in the wrong direction. https://twitter.com/...
While your data is on a Chinese server: “No communication from or to China will be exempted. There will be no secrets. No VPNs. No private or encrypted messages. No anonymous online accounts. No trade secrets. No confidential data.” http://bit.ly/2IOdpIH
Whenever Apple announces some minor new privacy feature, they do it onstage with a hundred reporters clapping. But when they want to send all your browsing data to a server in China? You only find out by reading the fine print.