iOS 14.5 Beta Directs 'Safe Browsing' Traffic in Safari Through Apple Server Instead of Google to Protect Personal User Data

[MacRumors]

Starting with iOS and iPadOS 14.5, Apple will proxy Google's "Safe Browsing" service used in Safari through its own servers instead of relying on Google as a way to limit which personal data Google sees about users.

Safari on iOS and iPadOS includes a built-in feature called "Fraudulent Website Warning." As Apple describes it, having the feature enabled will prompt Safari to warn users if they're visiting a suspected phishing website, or in other words, a website attempting to steal your data such as username, passwords, and other information.

In order to provide this feature, Apple relies on Google's "Safe Browsing," a database/blocklist of websites crawled by Google of websites that it deems to be suspected phishing or scam. In practice Google sends Safari a list of hashed prefixes of URLs that it determines to be malicious/phishing, Safari then checks the website you're trying to visit against the list from Google. Any match in hashed prefix will cause Safari to request the full URL link from Google, and by using the hashed prefix, Google never sees the website's URL you're trying to go to.

While Google doesn't know which specific URL you're trying to visit, it may collect your IP address during its interaction with Safari. Now on iOS/iPadOS 14.5, that's no longer the case. As confirmed by the Head of Engineering for WebKit, Apple will now proxy Google's Safe Browsing feature through its own servers instead of Google as a way to "limit the risk of information leak."

Screenshots posted on Reddit of incoming/outgoing connections on a device running the latest iOS 14.5 beta shows a new "proxy.safebrowsing.apple" URL, and testing by MacRumors shows the same URL alongside "safebrowsing.g.applimg.com" and "token.safebrowsing.apple" being used to proxy "Safe Browsing."

The new change in iOS and iPadOS is part of a comprehensive set of privacy-focused features for the iPhone and iPad and Apple's recent forceful push towards more stringent privacy features/rules. In addition to the change in "Safe Browsing," iOS 14.5 will also require apps to asks for user's permission before tracking them across other apps and websites.

The new requirement called "ATT" or App Tracking Transparency has caused companies such as Facebook and Twitter to voice concerns about how the new feature will impact their bottom-line, specifically when it comes to personalized advertising.

Another noteworthy feature in the upcoming update is crowdsource reporting for accidents, speed traps, and hazards within Apple Maps. Apple released the first beta to developers and public beta testers last week and says that iOS and iPadOS 14.5 will roll out to the public in the "early spring."

Article Link: iOS 14.5 Beta Directs 'Safe Browsing' Traffic in Safari Through Apple Server Instead of Google to Protect Personal User Data

 

[Wildkraut]

Ohh nice another kill switch, as if they don't already have enough of them

 

[TheYayAreaLiving 🎗️]

Apple will eventually leave Google behind. Google is being way too shady with the whole privacy and security.

 

[robinp]

14.5 is shaping up to be a quite impressive privacy update

 

[Bazooka-joe]

yep Apple is really driving privacy standards forward which is great assurance for their users

 

[Romeo_Nightfall]

How does that help when i am logged into my google account?!

 

[ruka.snow]

I hope they stop taking Google's money and make DuckDuckGo the default search engine. I would be delighted if Apple truly went all in on privacy, it looks like that is the plan as a way to separate them from the pack. The Apple of the next decade should be privacy focused and have very tight control over its supply chain.

 

[atomic.flip]

Hmm. Pick your poison. I frankly don’t trust any of these companies when it comes to privacy.

 

[Homme]

You have to love it when even a device like the Mini 4 (and obviously saying this because it is the minimum requirement of iOS/iPadOS 14) will get many of these security/privacy updates.

 

[verified]

I wish Apple create its own service for that instead of just proxying Googles one.
Why would one rely on Google in every Safari request?
Cut that string.

edit: creates*

 

[miniyou64]

So long as Apple holds decryption keys or shares iCloud data with governments, this security theater is meaningless.

 

[anshuvorty]

I wish Apple create its own service for that instead of just proxying Googles one.
Why would one rely on Google in every Safari request?
Cut that string.

But then, Safari would either have to build their own search engine or buy one outright....

I also think that Apple doesn't want to say bye bye to that sweet sweet Google Search deal $AAPL made with $GOOG...

 

[Stalwart]

14.5 is shaping up to be a quite impressive privacy update

It's most likely to be the last update for quite a few devices like iPhone SE and 6S

 

[verified]

But then, Safari would either have to build their own search engine or buy one outright..

Do you mean long-awaited Siri.com?

Also I wish they have Swift-powered Facetagtube alternative in mind.

 

[tom.humphrey]

And what if I already use 1.1.1.1?

 

[Abazigal]

I hope they stop taking Google's money and make DuckDuckGo the default search engine. I would be delighted if Apple truly went all in on privacy, it looks like that is the plan as a way to separate them from the pack. The Apple of the next decade should be privacy focused and have very tight control over its supply chain.

It does make me wonder how many people will actually stick with DDG were Apple to actually make it default one fine day. Google evidently fears this possibility enough to pay Apple billions of dollars a year, but I feel like the majority would just switch back to google search out of sheer annoyance.

 

[arvinsim]

Why not redirect to anyone's server?

 

[verified]

I also think that Apple doesn't want to say bye bye to that sweet sweet Google Search deal $AAPL made with $GOOG...

For me that departure from Google makes sense as M1.

 

[chucker23n1]

I wish Apple create its own service for that instead of just proxying Googles one.
Why would one rely on Google in every Safari request?
Cut that string.

There are two different APIs here: you can ask whether a specific set of URLs are safe, or you can ask for an entire database of safe URLs. Safari probably uses the latter. It’s more efficient and more private. It does not require a request each time.

 

[Smartass]

Apple will eventually leave Google behind. Google is being way too shady with the whole privacy and security.

It appears so more and more. I wouldnt be surprised if they remove Gmail app from the app store for a short period time if Google doesnt update it with new privacy guidelines

 

[Smartass]

It does make me wonder how many people will actually stick with DDG were Apple to actually make it default one fine day. Google evidently fears this possibility enough to pay Apple billions of dollars a year, but I feel like the majority would just switch back to google search out of sheer annoyance.

It would depend on how good DDG would be. If people found what they were looking for, then i dont see why majority(other than those 10% tech savy) would even bother switching back to google. 50% would probably never even notice they're not searching via google.

 

[verified]

There are two different APIs here: you can ask whether a specific set of URLs are safe, or you can ask for an entire database of safe URLs. Safari probably uses the latter. It’s more efficient and more private. It does not require a request each time.

Even if things are like that you are still missing that each request is *intellectually* served by Google.

 

[McScooby]

Forgive my tech ignorance, but do Apple have the resource for this?

What I mean is that I used to love the back to my mac feature until Apple nixed it as was costing too much with all the traffic it generated, is this not a similar thing taken to the nth degree?

 

[chris1958]

So, Apple uses a service provided by Google, but is shielding the user from Google. Isn't this, what Apple usually would call "stealing"?

And people doing a lot of searches to the same topic would notice a big difference between DDG and Google. If a word has a meaning in another context, with Google I'm getting, what I'm looking for, because Google knows my interests. With DDG I might get quite different results, e.g. strange thinks, if the word is otherwise some slang expression with explicit meaning.

 

[InGen]

How does that help when i am logged into my google account?!

Well that there's your first mistake