![](\"https:\/\/tctechcrunch2011.files.wordpress.com\/2017\/03\/apple-security-fingerprint.jpg?w=738\")
<\/p>\n<\/p>\n
Hey guess what? Apple has a new security whitepaper<\/a>! Apple only releases these things once every few years, and they represent the public\u2019s only window into how iPhones and other Apple products secure the massive amounts of data entrusted to them.<\/p>\n Even though Apple hasn\u2019t released a security whitepaper since September 2015 (or since iOS 9, if you prefer to measure time in software updates), there\u2019s not much earth-shattering new information in the latest edition, which covers iOS 10.<\/p>\n This is probably a good sign for users \u2014 the fact that Apple isn\u2019t making many changes to the basic security structure of the iPhone likely means\u00a0that Apple hasn\u2019t uncovered any major flaws in its product. The company puts significant resources into testing its own security and invites outside researchers to do the same through its bug bounty program.<\/p>\n But Apple has rolled out plenty of new features and products in the last few years, and the security whitepaper reflects that. Here are some of\u00a0the biggest new developments:<\/p>\n When Apple first debuted Touch ID,\u00a0it used customers\u2019 fingerprints\u00a0solely for unlocking iPhones and approving purchases in Apple-controlled environments like iTunes and iBooks. But starting in iOS 9, Apple opened up Touch ID to support biometric-approved logins for third-party app developers. The whitepaper gives us a small\u00a0update on the encryption key generation and storage that makes this possible:<\/p>\n With iOS 9 or later, developers can: By generating the codes on a one-time basis, Apple is able to offer access to Touch ID confirmations without re-using keys that could get stolen or leaked. This is similar in philosophy to the way that Apple Pay generates one-time transaction codes without transmitting\u00a0your actual credit card number.<\/p>\n In Apple offered details about how\u00a0HomeKit securely communicates with a user\u2019s\u00a0iPhone and the devices in his house while keeping his information private, even from Apple, in its last whitepaper, but there\u2019s one new tidbit about how it secures Apple TVs. Apple makes an effort to keep hackers away from your Apple TV by requiring two-factor authentication on iCloud accounts in order to provision the TVs:<\/p>\n The process to provision Apple TV for use with HomeKit is performed automatically when the user signs in to iCloud. The iCloud account needs to have two-factor authentication enabled. Apple TV and the owner\u2019s device exchange temporary Ed25519 public keys over iCloud. When the owner\u2019s device and Apple TV are on the same local network, the temporary keys are used to secure a connection over the local network using Station-to-Station protocol and per-session keys. This process uses authentication and encryption that is the same as that used between an iOS device and a HomeKit accessory. Over this secure local connection, the owner\u2019s device transfers the user\u2019s Ed25519 public-private key pairs to Apple TV. These keys are then used to secure the communication between Apple TV and the HomeKit accessories and also between Apple TV and other iOS devices that\u00a0are part of the HomeKit home.<\/p>\n<\/blockquote>\n After more than seven years on the market, Siri is pretty good at answering your questions \u2014 as long as those answers are contained within Apple apps. Siri can tell you the weather or schedule reminders, but she runs into trouble if you ask her to Venmo some cash to a family member.<\/p>\n The security whitepaper explains why: Apple is trying to follow the privacy rules users set in place for apps and not violate them with Siri requests:<\/p>\n Although Siri has access to iOS contacts and the device\u2019s current location, Siri checks the permission to access iOS-protected user data of the app containing the Extension to see if the app has access before providing that information to it. Siri passes only the relevant fragment of the original user query text to the extension. For example, if the app doesn\u2019t have access to iOS contacts, Siri won\u2019t resolve a relationship in a user request such as \u201cPay my mother $10 using PaymentApp.\u201d In this case, the Extension\u2019s app would only see \u201cmother\u201d through the raw utterance fragment being passed to it. However, if the app does have iOS contacts access, it would receive the iOS Contact information for the user\u2019s mother.<\/p>\n<\/blockquote>\n iOS 10 expands a developer tool called\u00a0ReplayKit, which makes it possible to live stream or record video from the iPhone\u2019s screen. Naturally, Apple\u2019s added privacy notifications to let customers know when their screens are being recorded and make sure they consent to the recording.<\/p>\n Originally impossible, recording and playback of iOS screens had been a popular feature available to jailbroken iPhones before it was added to iOS. Unsurprisingly, Apple has applied a logical but highly restricted scope to how the feature can be accessed.<\/p>\n Apple also ensures that users don\u2019t lose control of their recordings: \u201cThe movie file is written to a directory that\u2019s only accessible to ReplayKit\u2019s subsystems and is never accessible to any apps. This prevents recordings being used by third parties without the user\u2019s consent,\u201d the paper explains.<\/p>\n Apple Pay is available for web transactions in iOS 10 and most of the security architecture is what you\u2019d expect for a web-based payments system. Apple requires\u00a0websites to register and have their domain verified by Apple, and sites need to serve their content over an encrypted HTTPS connection.<\/p>\n But there is one cool feature that\u2019s new here \u2014 you can start a transaction on your laptop and finish it with your iPhone or Apple Watch. This transaction hand-off requires some interesting security wrangling that allows your credit card information to remain securely on your phone or watch:<\/p>\n In the case of Mac to iPhone or Apple Watch handoff, Apple Pay uses the end-to-end encrypted IDS protocol to transmit payment related information between the user\u2019s Mac and the authorizing device. IDS uses the user\u2019s device keys to perform encryption so no other device can decrypt this information, and the keys aren\u2019t available to Apple. Device discovery for Apple Pay handoff contains the type and unique identifier of the user\u2019s credit cards along with some metadata. The device-specific account number of the user\u2019s card isn\u2019t shared and it continues to remain stored securely on the user\u2019s iPhone or Apple Watch. Apple also securely transfers the user\u2019s recently used contact, shipping, and billing addresses over iCloud Keychain.<\/p>\n<\/blockquote>\n Apple was a bit slow to adopt a bug bounty, finally introducing one last year<\/a>. The program, which offers financial rewards to researchers who find security flaws in Apple software or hardware, was invitation-only at first, but Apple said it would slowly expand the list of invitees.<\/p>\n The bounty program gets a nod in the new whitepaper, which notes that hackers can participate even if they haven\u2019t received an invite. \u201cIn order to be eligible for an Apple Security Bounty, researchers are required to provide a clear report and working proof of concept. The vulnerability must affect the latest shipping iOS and where relevant the latest hardware. The exact payment amount will be determined after review by Apple,\u201d the paper explains.<\/p>\n There are a few other tweaks (helpfully highlighted on GitHub<\/a>), but that\u2019s everything major in this update.<\/p>\n Featured Image: Bryce Durbin\/TechCrunch<\/small><\/p>\n","protected":false},"excerpt":{"rendered":"Touch ID opened to developers<\/h2>\n
\n
\u2022 Generate and use ECC keys inside Secure Enclave. These keys can be protected by Touch ID. Operations with these keys are always done inside Secure Enclave after Secure Enclave authorizes the use. Apps can access these keys using Keychain through SecKey. SecKeys are just references to the Secure Enclave keys and the keys never leave Secure Enclave.<\/p>\n<\/blockquote>\nHomeKit\u00a0won\u2019t let your smart house spy on you<\/h2>\n
the dystopian future<\/s> our current reality, your smart TV might spy on you<\/a> or let someone else spy on you. Or your digital\u00a0assistant might testify against you<\/a>. Apple wants to avoid these scenarios with Apple TV and the rest of the HomeKit-enabled devices that make up its smart home<\/a> offerings.<\/p>\n\n
Siri\u2019s still clunky with third-party apps (but it\u2019s for your own good)<\/h2>\n
\n
New possibilities (and privacy) for live streaming<\/h2>\n
Start a payment on the computer, finish on your phone<\/h2>\n
\n
About that bug bounty\u2026<\/h2>\n
![\"\"](\"https:\/\/tctechcrunch2011.files.wordpress.com\/2017\/03\/apple-security-fingerprint.jpg?w=680\")
Hey guess what? Apple has a new security whitepaper! Apple only releases these things once every few years, and they represent the public’s only window into how iPhones and other Apple products secure the massive amounts of data entrusted to them. Read More<\/a><\/p>\n\n<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>\n<\/div>\n
<\/p>\n","protected":false},"author":5817,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[25],"tags":[59,66,26],"class_list":["post-337026","post","type-post","status-publish","format-standard","hentry","category-technology","tag-media","tag-techcrunch","tag-technology"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/337026","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/users\/5817"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/comments?post=337026"}],"version-history":[{"count":0,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/337026\/revisions"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/media?parent=337026"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/categories?post=337026"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/tags?post=337026"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}