Apple has confirmed it is redirecting Google Safe Browsing traffic in iOS 14.5 through its own servers to better protect user info.
Apple has previously reported that its Safari browser may use the Google Safe Browsing feature to determine if a website is fraudulent. From the forthcoming iOS 14.5 onwards, though, Apple will redirect Google Safe Browsing request through its own proxy servers, specifically to limit how much user data gets seen by Google.
A new report from The 8-Bit explains that by proxying the feature, Apple is essentially getting that list of known malicious websites and checking it themselves with Safari, meaning that your IP address and other information won’t be passed along to Google in that moment:
According to Google, its Safe Browsing system works by scanning sections of Google’s web index and “identifying potentially compromised websites.” Then, Google tests those websites by using a virtual machine to check if the website compromises the system. If it does, it’s added to Google’s online database. Google also identifies phishing websites by using statistical models.
According to Apple, before visiting a website, Safari may send hashed prefixes of the URL (Apple terms it “information calculated from the website address”) to Google Safe Browsing to check if there’s a match.
Since Apple uses a hashed prefix, Google cannot learn which website the user is trying to visit. Up until iOS 14.5, Google could also see the IP address of where that request is coming from. However, since Apple now proxies Google Safe Browsing traffic, it further safeguards users’ privacy while browsing using Safari.
Google might not be able to tell what a user is looking up, because Safari only sends a “hashed” value of the webpage to the company’s Safe Browsing service. But that service could log the IP address you’re connecting from, which can be considered a form of data leak.
In order to mitigate this privacy risk, Maciej Stachowiak, head of engineering of WebKit (the engine that powers Safari) confirmed that the browser would now proxy the entire Safe Browsing feature through their servers.
This article is a bit confused on the details of how Safe Browsing works, but in the new iOS beta, Safari does indeed proxy the service via Apple servers to limit the risk of information leak.https://t.co/TlDZNMO8do
— othermaciej (@othermaciej) February 11, 2021
Read the entire report over at The 8-Bit.
