Fraudulent Website Warning is the feature to blame
What you need to know
A report via Reclaim the Net has revealed Apple may send the IP address of Safari users on iOS to Chinese company Tencent when „Fraudulent Website Warning“ is enabled.
According to the report:
Now it’s been discovered that Apple, which often positions itself as a champion of privacy and human rights, is sending some IP addresses from users of its Safari browser on iOS to Chinese conglomerate Tencent – a company with close ties to the Chinese Communist Party.
Apple admits that it sends some user IP addresses to Tencent in the „About Safari & Privacy“ section of its Safari settings which can be accessed on an iOS device by opening the Settings app and then selecting „Safari > About Privacy & Security.“ Under the title „Fraudulent Website Warning,“
The report seems to be substantially correct, when you access the Fraudulent Website Warning feature inside settings and click the „About Safari & Privacy…“ link, users are met with the following disclaimer.
Image via Reclaim The Net
„Before visiting a website, Safari may send information calculated from the website address to Google Safe Browsing and Tencent Safe Browsing to check if the website is fraudulent. These safe browsing providers may also log your IP address.“
Reclaim The Net notes that the security feature is toggled on by default, so unless you have intentionally accessed these setting to disable the feature, there’s a chance that at some point your IP address may have been logged by Tencent or Google whilst you’ve been browsing in Safari. According to one Twitter user, the addition of Tencent to this policy may have begun as early as February of this year with the iOS 12.2 beta.
In iOS 12.2 beta 2 Safari now uses Tencent Safe Browsing in addition to Google Safe Browsing. pic.twitter.com/92pZKBmwWs
— Stijn (@StijnDV) February 4, 2019
It seems that this went unnoticed at the time, and has likely come to light in wake of reports surrounding Apple’s dealing in and with China over recent days. Of course, users can avoid having their IP address logged by disabling the feature, however this leaves users vulnerable to accessing fraudulent websites, which of course is the whole point of this security feature…
You could install a third-party browser, however if you view a web page inside of an app, you’ll be accessing it through Safari View Controller, and by default links within apps also open Safari. Essentially, it’s very hard to avoid using Safari on iOS.
Tencent of course owns WeChat, and works closely with the Chinese Communist Party to facilitate government censorship, preventing the spread of negative information about the government. WeChat’s censorship is so severe that it sometimes (unintentionally) censors neutral information published by approved state media outlets.
With regards to the logging of IP addresses, Reclaim The Net notes that an IP address can reveal a uers location, and can be used to profile users across devices:
If Tencent logs the IP address of an iPhone or iPad user through its Safe Browsing service, this information could potentially be used to identify the owner of the device by searching for instances of the IP address across Tencent’s other services.
This article was originally posted on iMore