Apple finally using HTTPS for AppStore
Apple has begun using secure Web pages -- HTTPS -- for all App Store communications. The move mitigated a number of vulnerabilities that attackers could have exploited to steal App Store passwords, force users to pay for unwanted apps or intercept user data.
Apple announced the security change earlier this year, noting that "active content is now served over HTTPS by default" for App Store via its iTunes applications. Apple's security notice credited multiple researchers for alerting it to the vulnerability, including Google researcher Elie Bursztein.
Bursztein said Friday in a blog post that Apple's previous failure to use HTTPS for App Store communications -- except on purchase pages – along with its failure to confirm certain activities and the dynamic manner in which App Store pages get generated left users open to "an active network attack that is able to read, intercept and manipulate non-encrypted (HTTP) network traffic," for example, via unencrypted public Wi-Fi hotspots.
