Apple SKY

As noticed by 9to5Mac, Apple has offered developers a series of best practices to prevent the In-App Purchase vulnerability, as well as promising a full fix in iOS 6. The advisement was sent to developers in an email today.

CNET was issued this statement by Apple:

“We recommend developers follow best practices at developer.apple.com to help ensure they are not vulnerable to fraudulent In-App purchases,” Apple spokesperson Tom Neumayr told CNET. “This will also be addressed with iOS 6.”

Apple issued this note to developers on the iOS Developer webpage, along with a series of suggestions to help verify that in-app purchases are legitimate:

A vulnerability has been discovered in iOS 5.1 and earlier related to validating in-app purchase receipts by connecting to the App Store server directly from an iOS device. An attacker can alter the DNS table to redirect these requests to a server controlled by the attacker. Using a certificate authority controlled by the attacker and installed on the device by the user, the attacker can issue a SSL certificate that fraudulently identifies the attacker’s server as an App Store server. When this fraudulent server is asked to validate an invalid receipt, it responds as if the receipt were valid.

News of the in-app purchase hack broke a week ago, and Apple has made several attempts to prevent users using the hack. It allows users to avoid paying for in-app purchases by using a third-party server as a “man-in-the-middle” attack. Apple now includes the UDID identifier in in-app purchase receipts in an attempt to increase the security of purchases.

Apple needs to step in and make in-app purchases illegal altogether…all that stuff is just a ploy and gimmick to make developer’s more money. If I am paying for an application, I don’t want “half-ass” functionality which requires 10-100x what I paid for the app to get to use all the features. That is just ridiculous!

The way I basically see it, is the in-app purchases (especially games) feed on a user’s craving for “more” out of the game. When a user realizes they cannot advance in a game or achieve a goal in the game without the in-app purchase, they will tap a button and charge a fee to their Apple Store account. A few of these “taps” and the user feels comfortable using this feature….and before you know it, they have tacked on $200 in fees for a $2.99 or FREE game download originally. The whole thing feeds on an addictive-nature to get you “hooked” on using the in-app purchases with the game….and it’s making developer’s bookoos of money. Now that a hacker has circumvented this, devs are crying about it, but the truth of the matter is in-app purchases are an evil, luring, deceptive, scheming beast altogether to sucker the public into forking over their wallets!!!

And that, my friends, is the reason I refuse to download and use apps and games with the in-app purchase feature. It’s a gimmick made by *greedy greedy* developer types, and I am not buying into any of that junk, at all. Just not worth it.

I’m so-so on this. I can understand paying in-app for an application you initially downloaded for free, but if you’ve already paid for an app, why should you have to pay MORE to gain enhancements? I’m all for supporting the developers, believe me, I know that they work hard and it’s a steady income for most, but I’m not going to find myself paying additional money for something in an app that I’ve already paid for to get more from the app.

Some of the in-app purchases are just ridiculous but still doesn’t mean you should cheat a developer out of money. They need to make a living too.

I firmly agree. The Amazing Spider-Man (Gameloft, $6.99, LINK) has 10 in app purchases from $1.99 to $49.99. How can an in app purchase be worth more than the game itself? This from a game that has almost 4,000 reviews. Not everyone who buys the game writes a review. I can’t do the math, but c’mon. I’m never going to buy a Gameloft game ever again.

Yeah, I think these kinds of in-app purchases are just unethical. I want to buy an app, but I don’t know if it will let me do everything I want to in it. Some paid apps just don’t let you do much unless you buy more stuff in the app.

Also, those things where you pay in order to cheat the game and unlock stuff that you’re supposed to get by playing are dumb. An example would be paying real money to buy points in Temple Run. That’s when I just go and modify my save file.

I’m so-so on this. I can understand paying in-app for an application you initially downloaded for free, but if you’ve already paid for an app, why should you have to pay MORE to gain enhancements? I’m all for supporting the developers, believe me, I know that they work hard and it’s a steady income for most, but I’m not going to find myself paying additional money for something in an app that I’ve already paid for to get more from the app.

I firmly agree. The Amazing Spider-Man (Gameloft, $6.99, LINK) has 10 in app purchases from $1.99 to $49.99. How can an in app purchase be worth more than the game itself? This from a game that has almost 4,000 reviews. Not everyone who buys the game writes a review. I can’t do the math, but c’mon. I’m never going to buy a Gameloft game ever again.

So I guess this means no more free in-app purchases…. wonderful.:rolleyes:

Apple needs to step in and make in-app purchases illegal altogether…all that stuff is just a ploy and gimmick to make developer’s more money.

It’s a free market. I have the power to choose how I develop and sell my IP. If you don’t like it, don’t buy it. Simple.

And not all IAP use is of this sort, some of it is for removing ads etc. And in some cases the games (which are what commonly use this ploy) are still playable although at a slower rate without playing. Or like Temple Run let you earn in game coins to buy the enhancements

Wait, what? iOS 6?

This is a serious security flaw in the OS. Apple is forcing users (and developers) to wait months for a fix and some devices won’t even get that fix because they won’t get iOS 6?

Seems quality software is not the priority in Cupertino any more. Remember how long it took for Apple to fix Safari on iOS and Mac OS after the DigiNotar hack?

Well. I’m not exactly on topic here, but I’d like to share my dislike of “in app purchase” games.

I don’t mind paying a hefty sum for a good game but I absolutely refuse to encourage IAP games. (Pay or wait, pay for better score, pay to refuel your game…)

I’m of the opinion that Apple should create a distinct category for IAP games altogether. (They’re not really free.) It’s getting harder and harder to find a decent complete (pay once) game on the app store because the IAP games all float to the top of the new & newsworthy category.

I also think the app store review system is broken. How can all those games be rated 4 or 5 stars. I can’t believe all those games are masterpieces. Or do people have such low standards or expectations?

I feel better now. Sorry for side-tracking.

Note: When I say I don’t want to encourage IAP games, I don’t mean that I’d pirate the content instead. I simply won’t download them in the first place. (I vote with my wallet)

What i find interesting is that when pirates normally try to justify their actions – they usually use the high price of software as an excuse, and that if prices were cheaper.. They’d stop doing it.

If you’re enjoying a developers hard work and not paying for it – then you are stealing that developers time. It’d be akin to going to a barbers – getting a haircut and not paying for it… You’ve not stolen anything physical from him, but you have stolen his time from him – he gave you a service, you didn’t pay.

You can try to justify that however you like, but that barber gave you a service you didnt pay for, and as such you have just stolen from him. Same goes for software development – people spend their time to make something for you to enjoy – if you benefit from it and havent paid for it, that is theft. Pure and simple.

If you worked for your boss for a month, only for him to refuse to pay you at the end of that.. And just laughed it off as “piracy” – how would that make you feel? He’s got the benefit of your work but refused to pay you for it.

I put a LOT of time and effort into my software – if i cant put food on the table because people are ripping my work off… then i’ll stop doing it.. If everyone did that – then you’d have nothing left to pirate.

I guess that’s just the way the self-entitled nature of todays kids are…