Apple responds to privacy concerns over checking macOS apps' Developer ID certs over OCSP, ceases logging IP addresses, will launch encrypted protocol in 2021
The arc here started when Thursday's OCSP outage made visible something most Mac users never knew: macOS phones home a hash of every app launched, paired with the user's unencrypted IP address, to Apple's certificate-checking server — turning one slow Apple service into a system-wide lag and a privacy story overnight.
Security Embedded followed with a deep dive into the OCSP responder itself, arguing the mechanism is critical to macOS security but opaque. Apple's response — halting IP logging and committing to an encrypted protocol next year — is a direct concession to that scrutiny, arriving as a separate report shows Apple's own apps on Big Sur bypassing firewalls and VPNs.
First-order effects
Mac users running Developer ID-signed apps stop having their IP addresses logged by Apple during OCSP checks, effective immediately per Apple's announcement.
Apple takes on a public deadline it did not have before: shipping an encrypted OCSP protocol sometime in 2021, converting a quiet internal endpoint into a roadmap commitment.
Second-order effects
Security researchers and transparency advocates gain a proven playbook — an outage plus a technical writeup forced a policy change from Apple — which raises the bar for how the company explains other silent phone-home behaviors like the firewall-bypass finding.
Enterprise admins who route Mac traffic through inspection proxies now have to plan for OCSP traffic they cannot read once encryption lands, shifting the trust question from network visibility to Apple's own attestation.
Third-order effects
OS vendors' built-in verification services are becoming single points of both failure and surveillance: if the pattern holds, platform attestation channels will be pushed toward encrypted-by-default design and documented data practices rather than undocumented endpoints.
The episode strengthens the case that OS-level telemetry needs external auditability — regulators and standards bodies increasingly have concrete examples of critical infrastructure (certificate checks) doubling as user-tracking vectors.
The trend: Platform vendors' mandatory security-check infrastructure is being forced into the open, with outages and researcher writeups converting hidden phone-home channels into public commitments to encryption and logging limits.
Hey Apple users: If you're now experiencing hangs launching apps on the Mac, I figured out the problem using Little Snitch. It's trustd connecting to https://ocsp.apple.com/ Denying that connection fixes it, because OCSP is a soft failure. (Disconnect internet also fixes.) https:…
“Safely open apps on your Mac” > “Privacy protections” Adding: • A new encrypted protocol for Developer ID certificate revocation checks • Strong protections against server failure • A new preference for users to opt out of these security protections https://support.apple.com/...…
Apple says it will stop logging IP addresses (!), provide encryption for OCSP in the future, and include a preference for opting out of OCSP checks. This episode shows how blindly we trust powerful companies to do the right thing. Never let up, folks https://support.apple.com/...…
Apple's response to the Gatekeeper privacy concerns is interesting - for instance, Apple has announced that it has stopped *logging* IP addresses. It hasn't stopped sending them. And as we see w/ NSA among others, lots of room for lawyers to argue that storing isn't logging.
I didn't really care about the macOS OCSP thing (I'm fine with Apple knowing what signed apps I run, and revocation is hard) until I realized those checks are over plaintext. Broadcasting what apps you launch to the network in plaintext should not have passed privacy review.
OCSP updates: Apple stopped logging IP addresses, made the cache take longer to expire, won't associate data with individuals, and in the future, will make it opt-out and encrypted. Still, we're at the point where every launch of a program is logged. https://www.iphoneincanada.ca…
pretty reasonable tbh. quick response too. that first one is important, as mentioned by @FiloSottile the connection itself is understandable but really should be encrypted. https://twitter.com/...
This is a very welcome admission by Apple that the current system is deeply flawed, and the changes promised are solid improvements. But why does shit like this always have to be let out to back door with an obscure update to an Apple help site article? Anyway 👏. Sunlight!