ChrisMorrisOrg

Can you please give an example? I don't think I understand what you're saying.

Precisely this. The title of this article should probably be renamed because it's looking at specific examples where the whole process (ie login + registration flows) hasn't been implemented properly.

Yeah, seems to be limited to Google’s own payment services. Just so you know, Apple doesn’t see nor store the item/s you purchase via Apple Pay, so if Apple Pay is accepted through this payment API, I think it’s unlikely to send purchase information directly to Apple.

I must have misunderstood. Sorry!

https://twitter.com/marcosc/status/909645024282869760

UPDATE: I may have misunderstood the talk. Apologies! My original statement that payment method doesn’t matter may be wrong.

https://twitter.com/marcosc/status/909645024282869760

Hmm. You could be right. I’ll have to verify with him. Perhaps I misunderstood him.

I’ll get back to you!

Not sure if the talk has been uploaded, but: https://twitter.com/chrismorrisorg/status/896352427426799618

Not sure if this is still the case, but Marcos from Mozilla did a talk on this at CampJS earlier this year. Apparently Chrome will send data about the items purchased to Google, even if you’re using a payment provider completely unrelated to Google.

Unlike Chrome, Firefox will apparently not send data about what you purchase back to Mozilla.

Edit: https://twitter.com/chrismorrisorg/status/896352427426799618

I would argue that their stringent security requirements are a testament to how much they care about the macOS platform and its users.

Yes you can download apps outside the App Store, but the App Store has a brand recognition associated to it that Apple need to and should protect.

Hmm, I definitely had to install an update for the YouTube app to receive the double tap to rewind/fast-forward.

I agree - they're definitely putting the customer's security first. If people want to use an open environment, the web browser is always available on iOS anyway. Apple are completely within their rights to restrict their application platform.

I strongly doubt Apple would ever ban web browsers. The amount browsing done on iOS is too significant, it wouldn't make sense to ban them.

In a word - context.

This might sound a bit counter-intuitive, but learning how to break things has helped me the most in learning how to create things. I'm not at an absolute expert level in the IT security field, but it's the thought process that has helped me build a deeper understanding of how things are developed. From this, I have learnt and continue to learn how to think critically about whether a particular design for a piece of software I'm trying to break is good or bad, and also think about what I would have done had I been a developer.

I guess in a sense, it's me asking myself the question of how I could personally design quality software at all levels. Getting into the nitty gritty details from learning how to break things has really helped me learn more about development at all levels. From the low level, where, say, Java might have a function that could be used inappropriately - questioning why they were designed that way. To libraries that have issues - questioning why the developer used this library. To the high-level, the overall pieces of the system - questioning if they interact with each other in a logical way. Then there's also the user interface and experience aspect.

So, understanding the reasoning behind choices and why things are the way they are (from the level of the C programming language, to the libraries you use, to how the users expect to interact with it, and what other developers would expect if you want them to contribute to it) is the one thing that has helped me become a better developer. It just so happens that in IT security, you tend to ask yourself and the developers you're working with these exact questions.

Don't worry about spoilers - the images are only linked and not embedded.