security - Something fishy about AWS S3 SSL deprecation and iOS SDK -


i got email amazon saying of app's use ssl access s3 buckets. after contacted support, gave me list of clients, points ios app running on ios7/8. use aws ios sdk version 1.7.1.

the first thought came mind update sdk latest. cost quite effort due major difference between 1.x , 2.x of sdk. after that, tested simulator pointing testing end point ssl disabled. worked, great!

but tonight did reading on aws forum, in 1 thread, aws claimed versions of ios sdk support tls... things not add up.

anybody can think of reasonable explanation this? if not sdk, , never altered sdk in anyway, caused ssl accesses show on report?

if have not modified sdk or not implemented nsurlconnection's authentication related delegates manipulate security model, proxy can potential cause.

some of mobile devices may behind proxy, , prevents proper tls negotiation. may need identify mobile devices using ssl , see if there common network components between them , aws service.


Comments