Apple Sending User Data to Chinese Company for Fraudulent Website Warnings in Safari

[MacRumors]

Apple's Fraudulent Website Warning feature in Safari for iOS and Mac has come under scrutiny for using Chinese internet giant Tencent as one of its Safe Browsing providers.

The Safari feature has long sent data to Google Safe Browsing to cross-reference URLs against a blacklist and protect users against phishing scams and sites that attempt to push malware. However, it's unclear when Apple started sending user data to Tencent as well.

Apple notes in iOS that it sends some user IP addresses to Tencent, but most users are probably unaware of the fact. The mention can be found in the "About Safari & Privacy" screen, which is linked via small text under the Privacy & Security section in Settings -> Safari. The Fraudulent Website Warning feature also found here is enabled by default, so users aren't likely to know that their IP address may be logged unless they opt to view the information screen.

Apple's reference to Tencent has been found on devices running iOS 13, but some tweets suggest versions as early as iOS 12.2 also included the Chinese company as a safe browsing provider.

At this point, it's difficult to know for sure whether Apple users residing outside of China are having their data sent to Tencent, but the company appears to be mentioned on iPhones and iPads registered in the U.S. and the U.K., and possibly in other countries, too.

The privacy implications of shifting Safe Browsing to Tencent's servers are unknown, because Apple hasn't said much about it. However, according to Johns Hopkins University professor Matthew Green, a malicious provider could theoretically use Google's Safe Browsing approach to de-anonymize a user by linking their site requests.

Apple's relationship with the Chinese government has come in for increasing criticism lately, and that could make customers uneasy about Apple's links to Tencent, which is known to work closely with the Chinese Communist Party.

As such, Green believes users "deserve to be informed about this kind of change and to make choices about it. At very least, users should learn about these changes before Apple pushes the feature into production, and thus asks millions of their customers to trust them."

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Article Link: Apple Sending User Data to Chinese Company for Fraudulent Website Warnings in Safari

 

[iGeneo]

This should be fun ?

 

[iLoveDeveloping]

I don’t have an issue with them sending the website to them for a check but surely they don’t need my IP address. That seems overkill. Apple could easily write some code to check the website url without sending an IP address and return the request to the users device - maybe they just couldn’t be bothered. ¯\_(ツ)_/¯

 

[haruhiko]

Apple needs to clarify if this is only for mainland Chinese users since Google service is not available for them.

(Anyway, sending data to Google is not really that safe too. One should turn off the feature completely if it causes any concern for privacy.)

 

[KALLT]

It is a bit premature to suggest that user data is sent to China (as written in the headline). Is there any evidence that devices from outside of China access Tencent’s servers (and if so, where are these servers located?)?

I don’t have an issue with them sending the website to them for a check but surely they don’t need my IP address. That seems overkill. Apple could easily write some code to check the website url without sending an IP address and return the request to the users device - maybe they just couldn’t be bothered. ¯\_(ツ)_/¯

That’s unavoidable if the connection is made from the device to Google’s servers directly. The only way to avoid this is by putting a server in-between, e.g. a server maintained by Apple.

 

[berrymetal]

This past week has been a major turning point for me concerning my trust for Apple

 

[KidAKidB]

Apple needs to clarify if this is only for mainland Chinese users since Google service is not available for them.

(Anyway, sending data to Google is not really that safe too. One should turn off the feature completely if it causes any concern for privacy.)

It's for everyone and there's nothing unsafe about sending data to Google.

 

[Lionel Messi]

Here we go again...

 

[Heineken]

This past week has been a major turning point for me concerning my trust for Apple

I have said in the past that I have no reason not to trust Apple unless they give me one. Now i have.

 

[KidAKidB]

This past week has been a major turning point for me concerning my trust for Apple

This is what people have been saying for years... Apple doesn't truly care about privacy, it's all marketing to make up for the fact that they were falling behind in machine learning.

 

[itsmilo]

Apple never truly cared about privacy or they wouldn’t allow every app to have a billion different tracking snippets built into it. Look how many Instagram and Facebook requests I have within minutes even tho I have neither app installed

 

[Delgibbons]

Stick that on a billboard, Apple. Holier than thou.

Apple's Fraudulent Website Warning feature in Safari for iOS and Mac has come under scrutiny for using Chinese internet giant Tencent as one of its Safe Browsing providers.

The Safari feature has long sent data to Google Safe Browsing to cross-reference URLs against a blacklist and protect users against phishing scams and sites that attempt to push malware. However, it's unclear when Apple started sending user data to Tencent as well.

Apple notes in iOS that it sends some user IP addresses to Tencent, but most users are probably unaware of the fact. The mention can be found in the "About Safari & Privacy" screen, which is linked via small text under the Privacy & Security section in Settings -> Safari. The Fraudulent Website Warning feature is also enabled by default, so users aren't likely to know that their IP address may be logged unless they opt to view the information screen.

Apple's reference to Tencent has been found on devices running iOS 13, but some tweets suggest versions as early as iOS 12.2 also included the Chinese company as a safe browsing provider.

At this point, it's difficult to know for sure whether Apple users residing outside of China are having their data sent to Tencent, but the company appears to be mentioned on iPhones and iPads registered in the U.S. and the U.K., and possibly in other countries, too.

The privacy implications of shifting Safe Browsing to Tencent's servers are unknown, because Apple hasn't said much about it. However, according to Johns Hopkins University professor Matthew Green, a malicious provider could theoretically use Google's Safe Browsing approach to de-anonymize a user by linking their site requests.

Apple's relationship with the Chinese government has come in for increasing criticism lately, and that could make customers uneasy about Apple's links to Tencent, which is known to work closely with the Chinese Communist Party.

As such, Green believes users "deserve to be informed about this kind of change and to make choices about it. At very least, users should learn about these changes before Apple pushes the feature into production, and thus asks millions of their customers to trust them."

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Article Link: Apple Sending User Data to Chinese Company for Fraudulent Website Warnings in Safari

 

[Jacquesvw]

.

 

[iGeneo]

Just go into the settings for Safari, and turn off fraudulent website warning

 

[dantroline]

I don’t have an issue with them sending the website to them for a check but surely they don’t need my IP address. That seems overkill. Apple could easily write some code to check the website url without sending an IP address and return the request to the users device - maybe they just couldn’t be bothered. ¯\_(ツ)_/¯

I can't possibly imagine why a totalitarian regime would want to know what websites you browse.

 

[Heineken]

Just go into the settings for Safari, and turn off fraudulent website warning

if turning it off actually turns it off.

 

[matrix07]

Disabled. Apple should doing this in house.

 

[NufSaid]

1. It is in the agreement that no one reads.
2. No matter what you do there they know. You are in China. There is no privacy.

 

[TrueBlou]

Meh, I give my details to the Chinese every other week when I phone Alec for a takeaway.....

Ok, crap joke, but Alec would like it, in fact I'll have to show him this next time I go in

 

[macfacts]

I'm not surprised but I'm sure some people are surprised.

 

[himanshumodi]

Sigh... bad week for apple. Though here, most reaction will be over-reaction. The headline is appropriately click-baitey and misleading. Sometimes comments here read as if people want Apple to have absolutely zero interaction with China. That's not possible in a global economy. There are hundreds of ways in which China plays a role in daily things in each of our lives. They just can't be that completely isolated... not all of a sudden. Not without turning it into another North Korea. Having a business engagement with a Chinese (or another country's) company is not per se a bad thing.

That said... Apple towing China government's line as in the case of HK.live... that deserves all the criticism it's getting.

 

[macfacts]

Why doesn't apple have the list of fraudulent web sites downloaded to the device and have the checks done locally on the device instead of remotely on some server owned by google or some chinese company. This doesn't sound like "what happens on your iPhone stays on your iPhone".

 

[jezbd1997]

Disabled on my end. Seems to only be iPhone? I checked on my Mac running Sierra and it only mentions google safe browsing, maybe it’s different on newer macOS?
Hope Apple clears this up soon and removes/changes it...

 

[whooleytoo]

It could be that all mobile devices have a global list of servers for fraudulent site checks, so if a UK/US user visits China the device will switch to the Tencent server.

It would be very nice to know for sure. There's no point in Tim Cook giving nice public speeches about privacy, if Apple aren't open and transparent about the details. (And no, burying this in the terms and conditions/ EULA somewhere doesn't count).

 

[Classie]

Apple is playing with fire! I would argue that privacy and “standing up to big brother” is their biggest selling points operating in a market where tec/design/innovation has plateaued.