Apple restores Google enterprise developer certificate after five-hour ban

AppleInsider · February 1, 2019 4:00AM

Roughly five hours after Apple revoked Google's enterprise developer certificate over an illicit data gathering campaign, the iPhone maker late Thursday restored access to the program just as it did for Facebook hours earlier.

Google's Screenwise Meter.

The restoration of privileges was first noted by Bloomberg reporter Mark Bergen in a tweet and later confirmed by TechCrunch.

In a statement, a Google spokesperson said they "can confirm that our internal corporate apps have been restored," the publication reports.

Earlier in the day, Google saw Apple revoke its Enterprise Certificate revoked following revelations about the search giant's Screenwise Meter app. The app offered users gift cards in exchange for access to device monitoring tools accessed via a VPN.

Google relied on its Enterprise Certificate to enable sideloading of the Screenwise Meter app, allowing the company to effectively skirt the App Store's stringent privacy policies. Following an expos by TechCrunch, Google voluntarily shut down the program on iOS and offered an apology.

Facebook found itself in a similar situation this week after a report exposed a data gathering program called Facebook Research. Like Google's Screenwise Meter, Facebook Research paid users to sideload a VPN app on iOS, granting root access to host devices for the purpose of collecting usage data.

Facebook's certificate was revoked on Wednesday and ultimately restored on Thursday.

Apple framed both Google and Facebook's programs as violations of its developer guidelines. As noted in Apple's terms of use, Enterprise Developer Certificates are designed expressly for the distribution of private software within corporations. Facebook, for example, relied on the certificate to disseminate unreleased betas, internal communications apps and other software to tens of thousands of employees.

krreagan2 · February 1, 2019 4:10AM

Too quick! Should have made them sweat a little longer!

cropr · February 1, 2019 7:06AM

I am chessplayer and a common rule in chess strategy is that the threat is stronger than the execution. That why I don't understand the actions of Apple. Apple might contractually be 100% right, but it should have looked at other options to make Facebook and Google comply to its requirements. Publicly threatening the revoke the certificate is much more effective than actually doing it

This could hit massively back in Apple's face. CIO's of large companies have now to consider the possibility that Apple could cripple the internal working of the company by revoking the certificate. So a CIO might start contemplating if it would not be better to standardize on Android. Even if only a small percentage of the CIO actually decides to do that, Apple can only loose.

rayz2016 · February 1, 2019 9:18AM

cropr said:

I am chessplayer and a common rule in chess strategy is that the threat is stronger than the execution. That why I don't understand the actions of Apple. Apple might contractually be 100% right, but it should have looked at other options to make Facebook and Google comply to its requirements. Publicly threatening the revoke the certificate is much more effective than actually doing it

This could hit massively back in Apple's face. CIO's of large companies have now to consider the possibility that Apple could cripple the internal working of the company by revoking the certificate. So a CIO might start contemplating if it would not be better to standardize on Android. Even if only a small percentage of the CIO actually decides to do that, Apple can only loose.

Nothing you said makes sense.

The reason that Facebook and Google thought this was okay is because they got into their heads that Apple wouldn’t dare retaliate.

They now know differently.

Swift, decisive and very fair.

But I suspect you already know that.

avon b7 · February 1, 2019 10:01AM

Rayz2016 said:

cropr said:

I am chessplayer and a common rule in chess strategy is that the threat is stronger than the execution. That why I don't understand the actions of Apple. Apple might contractually be 100% right, but it should have looked at other options to make Facebook and Google comply to its requirements. Publicly threatening the revoke the certificate is much more effective than actually doing it

This could hit massively back in Apple's face. CIO's of large companies have now to consider the possibility that Apple could cripple the internal working of the company by revoking the certificate. So a CIO might start contemplating if it would not be better to standardize on Android. Even if only a small percentage of the CIO actually decides to do that, Apple can only loose.

Nothing you said makes sense.

The reason that Facebook and Google thought this was okay is because they got into their heads that Apple wouldn’t dare retaliate.

They now know differently.

Swift, decisive and very fair.

But I suspect you already know that.

It makes sense. What doesn't make sense is to take it away for such a short period.

If Facebook were to announce the dropping of support for iOS in 18 months and Google were to do the same, who do you think would have more to lose?

I think chess is the word here.

chasm · February 1, 2019 10:16AM

Facebook and Google need Apple and it’s affluent users FAR more than Apple needs them. All of FBand Google services can be reached from a web connection.

You’re playing tiddlywinks, not chess.

avon b7 · February 1, 2019 10:26AM

chasm said:

Facebook and Google need Apple and it’s affluent users FAR more than Apple needs them. All of FBand Google services can be reached from a web connection.

You’re playing tiddlywinks, not chess.

That isn't true. Using WhatsApp via web would be an issue and the web experience is very different to the app experience.

Who needs who more - today - is very much up for debate.

kimberly · February 1, 2019 10:33AM

+1 @Rayz2016 and @Chasm.

tbornot · February 1, 2019 11:42AM

My “trust score” for Apple has added 35 points in two days,

seanismorris · February 1, 2019 12:22PM

“Google is paying Apple billions per year to remain on the iPhone, Bernstein says. Google will pay Apple about $3 billion this year to remain the default search engine on iOS devices, Bernstein says. The licensing payments make up a large bulk of Apple's services revenue.Aug 14, 2017”

Apple was never going to punish Google significantly. I wish they hit Facebook harder though... barely a slap on the wrist.

tmay · February 1, 2019 12:42PM

seanismorris said:

“Google is paying Apple billions per year to remain on the iPhone, Bernstein says. Google will pay Apple about $3 billion this year to remain the default search engine on iOS devices, Bernstein says. The licensing payments make up a large bulk of Apple's services revenue.Aug 14, 2017”

Apple was never going to punish Google significantly. I wish they hit Facebook harder though... barely a slap on the wrist.

Facebook is going to get more than a slap on the wrist from regulators; just give it some time.

Apple had to kill the certificate just to make sure that they also killed all of those other potential and unknown violations that Facebook had in process. Just standard pest management; kill everything while you are on site.

linkman · February 1, 2019 1:16PM

What does Apple do with little developers (such as an individual) that violate terms in a similar manner?

jungmark · February 1, 2019 1:49PM

cropr said:

I am chessplayer and a common rule in chess strategy is that the threat is stronger than the execution. That why I don't understand the actions of Apple. Apple might contractually be 100% right, but it should have looked at other options to make Facebook and Google comply to its requirements. Publicly threatening the revoke the certificate is much more effective than actually doing it

This could hit massively back in Apple's face. CIO's of large companies have now to consider the possibility that Apple could cripple the internal working of the company by revoking the certificate. So a CIO might start contemplating if it would not be better to standardize on Android. Even if only a small percentage of the CIO actually decides to do that, Apple can only loose.

Nonsense. CIOs know not to violate the license agreement. Your logic doesn’t make sense as Android is the Wild West of security. Why would any CIO allow more vulnerable devices on their network?

lkrupp · February 1, 2019 2:01PM

cropr said:

I am chessplayer and a common rule in chess strategy is that the threat is stronger than the execution. That why I don't understand the actions of Apple. Apple might contractually be 100% right, but it should have looked at other options to make Facebook and Google comply to its requirements. Publicly threatening the revoke the certificate is much more effective than actually doing it

This could hit massively back in Apple's face. CIO's of large companies have now to consider the possibility that Apple could cripple the internal working of the company by revoking the certificate. So a CIO might start contemplating if it would not be better to standardize on Android. Even if only a small percentage of the CIO actually decides to do that, Apple can only loose.

Well, you can always hope I guess.

beowulfschmidt · February 1, 2019 2:09PM

cropr said:

I am chessplayer and a common rule in chess strategy is that the threat is stronger than the execution. That why I don't understand the actions of Apple. Apple might contractually be 100% right, but it should have looked at other options to make Facebook and Google comply to its requirements. Publicly threatening the revoke the certificate is much more effective than actually doing it

This could hit massively back in Apple's face. CIO's of large companies have now to consider the possibility that Apple could cripple the internal working of the company by revoking the certificate. So a CIO might start contemplating if it would not be better to standardize on Android. Even if only a small percentage of the CIO actually decides to do that, Apple can only loose.

Or, they might decide not to violate the terms of the agreement to which they agreed. Integrity. What a concept, huh?

beowulfschmidt · February 1, 2019 2:11PM

linkman said:

What does Apple do with little developers (such as an individual) that violate terms in a similar manner?

The same thing they did to Facebook and Google. Those incidents just don't get the press.

mplsp · February 1, 2019 2:37PM

beowulfschmidt said:

cropr said:

I am chessplayer and a common rule in chess strategy is that the threat is stronger than the execution. That why I don't understand the actions of Apple. Apple might contractually be 100% right, but it should have looked at other options to make Facebook and Google comply to its requirements. Publicly threatening the revoke the certificate is much more effective than actually doing it

This could hit massively back in Apple's face. CIO's of large companies have now to consider the possibility that Apple could cripple the internal working of the company by revoking the certificate. So a CIO might start contemplating if it would not be better to standardize on Android. Even if only a small percentage of the CIO actually decides to do that, Apple can only loose.

Or, they might decide not to violate the terms of the agreement to which they agreed. Integrity. What a concept, huh?

Yes, It’s just odd that it only took 5 hours for things to change and for the service to be restored. I’m thinking there was more going on than we were aware of, likely some talks preceding the outage, but if the talks were ongoing and Google was moving towards rectifying the issue, why pull the plug at all?

jungmark · February 1, 2019 3:59PM

MplsP said:

beowulfschmidt said:

cropr said:

I am chessplayer and a common rule in chess strategy is that the threat is stronger than the execution. That why I don't understand the actions of Apple. Apple might contractually be 100% right, but it should have looked at other options to make Facebook and Google comply to its requirements. Publicly threatening the revoke the certificate is much more effective than actually doing it

This could hit massively back in Apple's face. CIO's of large companies have now to consider the possibility that Apple could cripple the internal working of the company by revoking the certificate. So a CIO might start contemplating if it would not be better to standardize on Android. Even if only a small percentage of the CIO actually decides to do that, Apple can only loose.

Or, they might decide not to violate the terms of the agreement to which they agreed. Integrity. What a concept, huh?

Yes, It’s just odd that it only took 5 hours for things to change and for the service to be restored. I’m thinking there was more going on than we were aware of, likely some talks preceding the outage, but if the talks were ongoing and Google was moving towards rectifying the issue, why pull the plug at all?

It's still a violation. It also pushes the perp to resolve any differences quicker.

gatorguy · February 1, 2019 4:00PM

MplsP said:

beowulfschmidt said:

cropr said:

I am chessplayer and a common rule in chess strategy is that the threat is stronger than the execution. That why I don't understand the actions of Apple. Apple might contractually be 100% right, but it should have looked at other options to make Facebook and Google comply to its requirements. Publicly threatening the revoke the certificate is much more effective than actually doing it

This could hit massively back in Apple's face. CIO's of large companies have now to consider the possibility that Apple could cripple the internal working of the company by revoking the certificate. So a CIO might start contemplating if it would not be better to standardize on Android. Even if only a small percentage of the CIO actually decides to do that, Apple can only loose.

Or, they might decide not to violate the terms of the agreement to which they agreed. Integrity. What a concept, huh?

Yes, It’s just odd that it only took 5 hours for things to change and for the service to be restored. I’m thinking there was more going on than we were aware of, likely some talks preceding the outage, but if the talks were ongoing and Google was moving towards rectifying the issue, why pull the plug at all?

Even if they didn't have any real issue with Google they still needed to do a ban at least for show to demonstrate consistency.

steven n. · February 1, 2019 4:30PM

cropr said:

I am chessplayer and a common rule in chess strategy is that the threat is stronger than the execution. That why I don't understand the actions of Apple. Apple might contractually be 100% right, but it should have looked at other options to make Facebook and Google comply to its requirements. Publicly threatening the revoke the certificate is much more effective than actually doing it

This could hit massively back in Apple's face. CIO's of large companies have now to consider the possibility that Apple could cripple the internal working of the company by revoking the certificate. So a CIO might start contemplating if it would not be better to standardize on Android. Even if only a small percentage of the CIO actually decides to do that, Apple can only loose.

This is incoherent at best. The threat of check mate is not nearly as effective as a checkmate.

Likewise, a CIO should know better than to use their enterprise deployment keys to allow side loading of apps to the general public. This reaks of basic incompetence or extreme arrogance.

strangedays · February 1, 2019 5:43PM

avon b7 said:

Rayz2016 said:

cropr said:

I am chessplayer and a common rule in chess strategy is that the threat is stronger than the execution. That why I don't understand the actions of Apple. Apple might contractually be 100% right, but it should have looked at other options to make Facebook and Google comply to its requirements. Publicly threatening the revoke the certificate is much more effective than actually doing it

This could hit massively back in Apple's face. CIO's of large companies have now to consider the possibility that Apple could cripple the internal working of the company by revoking the certificate. So a CIO might start contemplating if it would not be better to standardize on Android. Even if only a small percentage of the CIO actually decides to do that, Apple can only loose.

Nothing you said makes sense.

The reason that Facebook and Google thought this was okay is because they got into their heads that Apple wouldn’t dare retaliate.

They now know differently.

Swift, decisive and very fair.

But I suspect you already know that.

It makes sense. What doesn't make sense is to take it away for such a short period.

If Facebook were to announce the dropping of support for iOS in 18 months and Google were to do the same, who do you think would have more to lose?

I think chess is the word here.

You have it wrong. Facebook is dependent on ads and would never chop off their nose in such a fashion. iOS users spend more than the knockoffs do.

edited February 2019

Apple restores Google enterprise developer certificate after five-hour ban

Comments