Secure SKAdNetwork 2.0: A seamless setup for establishing trust

When we released our first-to-market solution for SKAdNetwork back in June 23rd, we recognized two critical issues that existed in SKAdNetwork exposing advertisers to ad fraud:

• Conversion values are not signed by Apple
  This creates an opportunity for networks to change the values and self-report higher ROI, which can make SKAdNetwork completely untrustworthy.
• Country information is not part of the postback payload
  The first recipient of the postback can identify the country based on the sender’s IP, but this data is lost at that point, and we need the network to forward it … which is again susceptible to changes.

We chose to address these issues as part of our Secure-SKAN product. In addition, we shared this solution as part of our open-source SKAdNetwork spec called SKAN, where we devised a “Secure SKAdNetwork setup:”

• Ad Networks and DSPs co-register to SKAdNetwork with each MMPs (e.g. “Singular+Ad Network”).
• MMPs will become the initial recipients of the postbacks, and then forward them to the ad networks.
• This eliminates all concerns of data manipulation and makes reporting dramatically easier.

Since launching this solution, we’ve received incredible feedback and interest from customers, and true collaboration from ad networks. But the one thing that remained a challenge was the need for multiple SKAdNetwork registrations, which works, but not as streamlined. So we challenged ourselves to find an easier way to achieve the same level of trust and security.

Today we’re excited to announce a new and dramatically easier way to achieve a secure SKAdNetwork setup.

The solution works in the following way:

1. Ad networks, who are the initial recipients of the SKAdNetwork postbacks, will return an HTTP 307 response, which designates a temporary redirect.
2. This HTTP response instructs the device to retransmit the exact same HTTP message to the Singular endpoint.
3. Singular will first verify this message is unique, and not a duplicate.
4. Then we will verify this message is indeed cryptographically signed by Apple.
5. Lastly, we will verify the IP address of the sender is reasonably unique to prevent malicious parties from sending modified postbacks from their servers.

We’re very excited that the solution is elegant, simple for networks to implement, and provides a lot of benefits. It took some time to validate the new setup since SKAdNetwork is very challenging to test, but we can confirm we have verified this on a real device and it works exactly as we expected!

The Secure-SKAN solution offers some major advantages:

• Fraud-free
  The device is sending the exact same payload to the network and Singular. It is therefore impossible to manipulate the data.
• Simplified setup
  This doesn’t require a new SKAdNetworkIdentifier leveraged in the SKAdNetwork signature process, nor does it require a new list update on the publisher’s side.
• Easy to implement
  This almost completely removes the need for ad networks to implement APIs for providing the SKAdNetwork data – since we will get the data directly from a user’s device.
• Privacy-safe
  This solution involves zero PII and requires no policy change or code updates from Apple (which has always been our litmus test for separating real solutions from mere ideas).

In the following weeks, we’ll continue to promote the secure implementation of SKAdNetwork with our ad network partners. We’re very excited at the journey ahead with our customers and partners, and we thank them for their support.