AR model protection / accessibility - arkit

I'm hosting multiple AR models on my website. For iOS I've got the AR models (.usdz) set up so they can be accessed directly via the browser.
One of the problems I run into is security of the AR models. I want to prevent users from being able to download them:
On iOS, the AR models are automatically opened in Apple's AR Quick
Look. It's probably also possible to download the underlying models,
but this feature isn't easily accessible.
Via Android (I know .usdz isn't the right file format) and
MacOS/Windows it's easy to download the .usdz models by clicking on the link
Is there a way to protect the files so they can be accessed in AR Quick Look, but not downloaded in any way?


Ultimately, if the users device or browser will display the models then it needs to be able to download them.
This is a similar problem to protecting online videos. In that domain the usual approach is to encrypt the video so that even if it is downloaded it cannot be used without the decryption key.
That requires a secure way to share the decryption key with the device or browser and also a secure way to play the decrypted video without the user or other apps being able to access it. The standard approach to this is to use a DRM technology, although it may be possible to create custom solutions and share the keys separately by some other communication means.
At this time, there is no DRM that supports AR models and provides a secure display environment for them, AFAIK.
You could implement a solution where you encrypt the models and decrypt them just before you display them in your web app or browser, using a configured or hardcoded key. This might be enough to deter causal piracy, which may be enough for your needs - it won't deter a determined attacker for long, unfortunately.

Related

Can PWA share state/data between browsers?

If I have multiple browsers, can PWA share states or data? For example if I’m offline and I interact with the app on Firefox, save some data, etc. Can I access that same data when I open the app in Chrome? I tried it with https://voice-memos.appspot.com/ but it doesn’t work. Perhaps an unimplemented feature?

No, you can't. The browsers implement the cache in different ways, they store the data in different directories, etc..

Browsers have their own private storage for web apps, and there's no API designed specifically for direct, seamless cross-browser data sharing, so only workarounds are available.
When online you can share the data by synchronizing it via a server. This may even be near-realtime with the help of SSE/WebSockets or push notifications.
When offline I don't think you can in any sensible way. You could instruct the user download a file in one app and select it in a file picker in another app (or use drag'n'drop or copy'n'paste). Maybe (I haven't tested) you could establish WebRTC data connection between browsers while online and it'd survive going offline if the direct p2p connection was made over loopback/LAN.

Best way to store large data clientside in an gwt offline application?

We have written an Vaadin7/GWT application where the user can select multiple images and upload them. The application works offline, so we want to store the images clientside and only upload them when the user is pressing the sync button. The clue is that we want to keep the selected images, even when the user is closing the Tab/Browser. The clientside storage should also work with mobile browsers (Android and iOS)
We have found the following possibilities to store data on the client
Session Storage is killed when the tab/browser is closed. Not suited for our case.
Local Storage is limited to 5MB which is not enough. Is there a way to extend that limit?
IndexedDB does not work on IOS devices (http://caniuse.com/indexeddb)
WebSQL does work on IOS and Android devices (http://caniuse.com/sql-storage) but is deprecated
So the question are. Does anyone know a good Frameworks in conjunction with gwt? Which storage type/DB would you prefer and why? Or even more general, how would you solve the Problem?
Thanks for any advice, suggestion or experiences you had.

Unfortunately, there is no magic solution for all operating systems/browsers. I believe that you your only option for large objects is to build native apps for each platform that use a web browser for their client.

Data encrypted on iPad/iPhone?

is the data stored on an iPad/iPhone encrypted?
I assume that the iPad/iPhone has an advanced pass code (not just the 4-digit code).
So my question is if data that my custom app stores in the device is encrypted or not (if no special methods are taken in the source code of the app). Would an attacker be able to read the data? What if he jailbreaks the device?
Thanks!

The answer is no if you don't apply any encrypting technique on it. You can try to use iExplorer to browse all the sandboxes of your device's applications. You may get surprised about the security of many apps out there.

I am just starting getting familiar with security in iOS, but from what I read and understood from Apple's IOS Security whitepaper, files are encrypted by per file encryption keys and those are encrypted by class keys assigned by the application that owns the files (which are sandboxed with the application). And then, the files access depends on the protection policy you assigned in your application.
However, from this answer, it is unclear if the encryption is always on, or just when the device if off or unlocked.
In any case, the above applies from non jailbreaked systems (not sure if they do for jailbreaked ones as well).

Accessing Video Content ONLY through an iOS App - How would I do that

I've got a client that wants to have a paid app providing his video instructional content on iOS, but of course we dont want people simply getting the video content directly without paying for the app.
Is there some simple way of doing this that I'm overlooking? He wants the content streamed so he can add content easily and periodically without app updates.
Perhaps using Youtube but having the videos password protected? Is there a service anyone has used with an appropriate iOS API that anyone has heard of?

I've never done this before, but you could do some kind of token exchange based on the device ID. When the app is first used, register the device ID with the content server, and use that in combination with a salted hash of some kind to identify the device when requesting the media from the server.

I'm considering two options right now.
1- Following this post (roughly) In iOS, how would you programmatically pass a username / password to a secure site and essentially doing a combination of .htaccess for password protection, leveraging robots.txt to prevent search engines from indexing the videos, and obfuscating the video names. I've got to research the password protection of the video directory and how exactly to do that... but it seems the simplest. The downside is the clear text password.
2- A slightly more sophisticated method where I use oAuth to authenticate against but really following the first path, and potentially leveraging http://maniacdev.com/2010/09/new-open-source-oauth-library-for-easy-authentication-on-ios-devices-from-google/ to help in writing the oAuth piece.
a third possibly prohibitively expensive option is to look at the HTTP live streaming in OSX server https://developer.apple.com/streaming/
How do you guys think these options sound? Are there others I'm not considering?

What is the iPhone SDK Missing?

I've been doing mobile app development for a long time (2001?), but the systems we worked with back then were dedicated mobile development environments (Symbian, J2ME, BREW). iPhone SDK is a curious hybrid of Mac OS X and Apple's take on mobile (Cocoa Touch).
But it is missing some stuff that other mobile systems have, IMO. Specifically:
Application background processing
SMS/MMS application routing (send an SMS to my application in the background)
API for accessing phone functions/call history/call interception
I realize that Apple has perfectly valid reasons for releasing the SDK the way they did. I am curious what people on SO think the SDK is missing and how would they go about fixing/adding it, were they an Engineering Product Manager at Apple.

The biggest shortcoming in my opinion is support for separating licensing from distribution.
What I mean by this is that it should be possible to download a trial version of an application and later purchase a license for that application (from an API call inside the application or from the app store). This would make it much easier to try-before-you-buy and get rid of the current duplicates of many applications with 'lite' versions.

I think lack of push notifications for apps is the big thing we're missing right now. With push, you can register your application to perform a task (like getting the most recent data from a web service) even when it's not running, at a time and frequency the OS decides is best. In an ideal world, along with the existing concept of iPhone apps loading quickly and resuming where you last left off, this solves the problem of not running in the background. I know some tasks will be more difficult or maybe impossible with this strategy, but it's still a pretty good compromise between third party applications and the iPhone's limited hardware.
Originally push was scheduled for last September, but it was removed from the beta SDK and not spoken of since then.

API's I'm personally looking for:
Apple80211 as a public API (private, current API is fine if documented)
Access to Volume buttons (semi-accessible via Celestial, private, needs new API)
Access to Calendar (private, API status unknown)
Access to Bluetooth + SPP profile (status unknown)
Access to Camera (directly, API status unknown)
Access to JavaScript runtime (directly, not through UIWebView, API status unknown)
WebKit access that's lower-level than UIWebView (private, current API is fine)
Access to Music Library (private, current API is fine)

Garbage Collection.

CoreData is missing.

You've mentioned some of the big ones - copy & paste (or in fact any way for apps to collaborate) is another huge omission.
It also seems to lack a desktop synch framework (at least if it exists I can't find it).
Language independence and especially lack of scripting is another pet peeve - objective-c is all very well but more languages to choose from would be good.
Inability to dynamically extend apps, via scripts or otherwise, is another big omission. This is partly an SDK/OS issue, partly licensing.

My list ordered by priority:
Mapping abstraction (the MapKit looks awesome), but that would require a new Google Maps TOS
Music library
Camera (photo + video) Access to more
UIViews, Apple designed some pretty nice custom ones for their apps
Better UIWebKit abstraction

The features I see missing that it should have is
Access to SMS
Direct Access to Google Maps App. You should be able have access to this so you could extend your application to use the built in features provided by Google Maps.
Access to the Bluetooth functionality of the phone.
Access to the Calendar. Why not allow access to simply post a calendar event for the user.
Access to Active Sync. It would great if we could directly access this and communicate back to the Exchange Server.
Core Image. They provide Core Animation but Core Image is missing. I hope that this is added to the API soon.
These are some of the features that my clients have access for in the past and are supprised when they are not available.

We definitely miss a Calendar API and SMS access. So many applications could leverage such APIs. The iPhone allows users to have everything in their pocket, but it's almost useless as long as developers cannot leverage this integration in their apps.

A language with proper namespaces.

A limitation that bugs me is lack of access to system features that require root or setuid. For example: opening privileged IP ports.
I'm not sure there is a good solution to this, as long as Apple's policy is to keep the device locked-down.

Allow program to set some kind of local timed event for your application to bring up an alert and launch your app if the user agrees (like any calendar app). You could do that with push notifications but there are many cases I'd hate to have to rely on a whole server infrastructure and network connectivity just to basically do some timed thing.
Some idea of what direction the user is facing. I cannot believe the GPS chip the newer iPhones use are not capable of reporting direction.

I would personally love to see
Access to the CoreTelephony Framework (Currently private). Which allows access to all the phone functions (Especially sending MMS / SMS).
Some sort of ability to run stuff in the background. While push notifications is ok for most things, but it is a bit hard to leverage CoreLocation (i.e. have the app show a notification at a certain location). Of course this would probably need an on/off button or app specific like push is.

animation view which will be reduce developer to make a cool app , of course the core business local still need consider more , but the view layer could more easy to use ....