Apple iOS 14.5 will hide Safari users’ IP from Google’s Safe Browsing

[UK Sentinel]

Another privacy improvement from Cupertino

Apple’s forthcoming iOS 14.5 release, currently in beta, will conceal the IP address of Safari web surfers from Google’s Safe Browsing service, integrated into Safari to spot fraudulent websites.

On Wednesday, Maciej Stachowiak, head of WebKit engineering at Apple, confirmed the change via Twitter, stating that “in the new iOS beta, Safari does indeed proxy the service via Apple servers to limit the risk of information leak.”

That means when Safari users visit a website with Safe Browsing active, their IP addresses will be associated with an Apple domain rather than their internet service provider or corporate network. Google would normally have access to this information from those using Safe Browsing-enabled applications, depending on the specific API used, but now won’t for mobile Safari users.

That’s something of a privacy improvement – another notch in the privacy belt for iOS 14, alongside previously disclosed App Tracking Transparency and app privacy labels.

But don’t get too excited. Google still has access to plenty of online data via ads, web tracking widgets, scripts, authentication tokens, searches, applications, and the like. It’s not as if Apple made Bing the default search engine for all its software and hardware.

This is not the same sort of privacy broadside against the digital ad industry that App Tracking Transparency has been. The Register understands Google and Apple coordinated this change and it isn’t expected to alter the effectiveness of the service.

Nor is it obvious whether IP privacy is enough to justify activating Safe Browsing, which mobile Safari users can do via the Fraudulent Website Warning button in the browser’s Settings menu.

Safe for most things
Google’s Safe Browsing service provides a way for applications to check whether websites in Google’s Search Index have been previously identified as malicious. In its early form, it was “kind of a privacy nightmare,” as Matthew Green, associate professor of computer science at Johns Hopkins University, described it in a 2019 blog post. The service initially transmitted browser users’ IP addresses, the full URL visited, and set a tracking cookie.

The Safe Browsing API has improved since then in that there’s now an alternative to the URL-exposing Lookup API: The Update API allows client software (like Safari) to download an encrypted Safe Browsing list of 32-bit prefixes of SHA256 hashes (256-bits) derived from bad URLs to match against a 32-bit hash prefix of the URL the user aims to visit.

Then, if there’s a match – which may correspond with multiple full hashes – the browser transmits the matched prefix to Google’s servers, which return a list of SHA256 hashes that contain the matched prefix to test against a full hash of the requested URL.

“The problem is that Safe Browsing ‘Update API’ has never been exactly ‘safe,'” said Green in his blog post. “Its purpose was never to provide total privacy to users, but rather to degrade the quality of browsing data that providers collect.”

Other security researchers have expressed similar reservations, noting that the API’s approach – a technique called k-anonymity – can be defeated.

Green said the privacy community had reconciled itself to the tradeoffs, allowing that Google might glean more information from those implementing and using Safe Browsing in exchange for reducing potential exposure to fraudulent or malicious websites.

But he was less sanguine about Apple’s disclosure in 2019 that the company was sending the same information to Tencent in China, where privacy risks are magnified due to limits on political speech.

As Apple explains in its macOS Safari help documentation, “Before you visit a website, Safari may send information calculated from the website address to Google Safe Browsing to check if the website is fraudulent. If you have China mainland set as your region in the Language & Region pane of System Preferences, Safari may also use Tencent Safe Browsing to do this check.”

 

Source: https://www.theregister.com/2021/02/12/apple_safe_browing/

Share the knowledge

In a completely sane world, madness is the only freedom (J.G.Ballard).

You need to login in order to vote

[UK Sentinel]

Follow On.

Apple’s upcoming iOS 14.5 release will ship with a feature that will re-route all Safari’s Safe Browsing traffic through Apple-controlled proxy servers as a workaround to preserve user privacy and prevent Google from learning the IP addresses of iOS users.

The new feature, spotted by a Reddit user earlier this week and covered in a report from 8-bit, has been formally confirmed by Maciej Stachowiak, Head of Webkit Engineering at Apple.

The new feature will work only when users activate the “Fraudulent Website Warning” option in the iOS Safari app settings.

This enables support for Google’s Safe Browsing technology in Safari. The Safe Browsing technology works by taking an URL the user is trying to access, sending the URL in an anonymized state to Google’s Safe Browsing servers, where Google accesses the site and scans for threats.

If malware, phishing forms, or other threats are found on the site, Google tells the user’s Safari browser to block access to the site and show a fullscreen red warning.

While years ago, when Google launched the Safe Browsing API, the company knew what sites a user was accessing; in recent years, Google has taken several steps to anonymize data sent from user’s devices via the Safe Browsing feature.

But while Google has anonymized URL strings, by sending the link in a cropped and hashed state, Google still sees the IP address from where a Safe Browsing check comes through.

Apple’s new feature basically takes all these Safe Browsing checks and passes them through an Apple-owned proxy server, making all requests appear as coming from the same IP address.

Many would call the move useless, as Google would still be unable to see what URL the user was checking, but the feature is consistent with other measures Apple has been taking lately, focusing on improving its users’ privacy.

Many of these features have often encroached and disturbed Google’s huge presence in the user analytics and tracking sector.

This includes pioneering broad anti-tracking features in Safari, and forcing app makers to add “privacy labels” to their App Store listings, a requirement that Google has mysteriously avoided by simply not updating any of its apps since last year.

iOS 14.5 is currently in beta and is expected to be released in the coming months.

Apple vs Google, who has the greater  trust 

 

 

https://www.zdnet.com/article/apple-will-proxy-safe-browsing-traffic-on-ios-14-5-to-hide-user-ips-from-google/

Share the knowledge

In a completely sane world, madness is the only freedom (J.G.Ballard).

You need to login in order to vote

[Author]

Posts