[HN Gopher] Apple's iCloud+ "VPN"
___________________________________________________________________
Apple's iCloud+ "VPN"
Author : n1000
Score : 771 points
Date : 2021-06-16 12:05 UTC (10 hours ago)
(HTM) web link (www.metzdowd.com)
(TXT) w3m dump (www.metzdowd.com)
| bitcurious wrote:
| Correct me if I'm wrong, but as I understand it a two-hop onion
| network is still trivially breakable with (two) warrants,
| especially since both Apple and Cloudflare/etc., are US
| companies. Which would make it a VPN in the duck-type sense.
| gjsman-1000 wrote:
| It depends, whether they do no logs. There are many VPN
| providers in the US which don't have logs, so that if they are
| subpoenaed, they have nothing to give.
|
| The beauty of Apple's double hop is that if one partner was
| hacked, secretly wiretapped, or had lied about not keeping
| logs, your connection would still be private.
|
| But, that assumes that nobody on this network is keeping logs.
| If they are, then it could be theoretically possible to piece
| them together. However considering Apple's marketing with
| privacy, it would be interesting to see whether they keep logs
| on each endpoint or not.
| heavyset_go wrote:
| > _It depends, whether they do no logs_
|
| Courts can compel them to keep logs.
| nojito wrote:
| What would the logs contain?
|
| I believe everything is encrypted on device before being sent
| to Apple.
| TedDoesntTalk wrote:
| Timestamp, source and destination ip addresses, username.
| In the case of the exit node, url.
| nojito wrote:
| Only the timestamp and username would be available from
| Apple.
| krferriter wrote:
| Source IP address and next-hop IP address would be as
| well.
| nojito wrote:
| Source on the next hop address?
|
| Apple doesn't know where you're going.
| NorwegianDude wrote:
| They shouldn't know about the end destination, but
| they'll know your traffic was sent to eg. Cloudflare or
| whatever.
| nojito wrote:
| I would think they batch together all the IPs and pass it
| off.
|
| It's in Apple's best interest to keep the bare minimum
| information they need from their end-user.
| gjsman-1000 wrote:
| We don't know that Apple keeps logs. These are things
| they could theoretically keep, but we don't know if they
| store them or not.
| LegitShady wrote:
| If they don't clearly state 'no logs' then its unlikely
| they are not logging. My bet is they're logging
| everything, because they have no advantage in not
| logging.
| wolverine876 wrote:
| > There are many VPN providers in the US which don't have
| logs
|
| Many claim they don't have logs, and my understanding is that
| it has been sometimes revealed that they do have logs. Also,
| how do you run a server without logs? Many think those claims
| are BS.
| path2power wrote:
| If your threat model includes state level actors, there is no
| commercially available solution that will make you 100% safe.
| This is about privacy from private corporations and making it
| more difficult and more costly for governments to get your
| data. But the latter is always possible when you use the web.
| bitcurious wrote:
| >If your threat model includes state level actors
|
| My personal threat model doesn't include state level actors,
| but if it did I would certainly differentiate between a
| solution that the NSA can break with some expense and one
| that my local police department can break with a warrant.
|
| My actual threat model is advertisers, so I think the Apple
| solution is quite elegant and will serve me well. It
| shouldn't be conflated with TOR though.
| atonse wrote:
| That's the beauty of this. Party 2 only knows Apple's IP. Apple
| doesn't know what site you're visiting.
|
| So how do you assemble "all traffic to this site" even by
| subpoenaing both parties?
| lxgr wrote:
| To party 1: "Give us a netflow log of all of this user's
| traffic." To party 2: "Give us a list of all outbound
| connections matching this netflow list of inbound proxying
| requests."
|
| It would work the other way around as well (going from
| visited sites to a given Apple id). If you can monitor all
| nodes in an onion routing network, you can deanonymize
| everybody.
| gjsman-1000 wrote:
| Well, here's the catch. Even if logs were kept, the 2nd
| party as far as we know does not have a unique identifier
| passed onto it.
|
| This means that Apple's logs would say this user
| authenticated and passed some encrypted stuff to Fastly,
| and Fastly would say that it received requests from Apple,
| without an identifier to match it up against the first
| request.
|
| Once this scales and Apple has millions of requests
| incoming, there will be no way to conclusively prove that
| two requests are the same.
|
| In which case a double subpoena is again useless. And this
| assuming they keep logs - if they don't keep logs, which is
| more likely, it's even more useless.
|
| This also aligns with something we currently know. Apple
| says they can't see your requests. This implies that they
| just pass data along in an encrypted format to their
| partners. So all Apple does is make it so their partners
| don't know your device, and the partners ensure Apple
| doesn't know your request.
|
| Ultimately, even if logs were kept, there would have to be
| a unique identifier of some sort that was passed on to the
| second server from the first server to break the system.
| You decide the odds that they did that. Sounds a lot like
| an IP Address, in which case why not just build a classic
| VPN?
| opheliate wrote:
| Surely some "unique" identifier is required for each TCP
| session between Apple and the exit node so that Apple
| knows where to send the data it gets back, even if it's
| just the port on which Apple connect to the exit node as
| with standard TCP session management.
| ska wrote:
| How would that help you identify all of a particular
| users interactions (rather than one)? Why would you
| expect them to log it?
| opheliate wrote:
| If Apple logged (incoming IP from user, outgoing port to
| exit node) pairs for each session, and the exit node
| logged all requests, this should be sufficient to
| associate all requests with a given user IP, right? Or am
| I misunderstanding you?
|
| I wouldn't expect them to log it, personally, I think
| that can only lead to headaches down the line. My reason
| for responding is just that I disagree that there is no
| way for another party to associate all requests even if
| Apple & exit node both fully cooperate and keep logs.
| ska wrote:
| We are thinking about this the same way. Individual
| sessions don't do you much good, but there is
| traceability iff both parties keep complete logs. Which
| seems unlikely unless coerced.
| [deleted]
| gjsman-1000 wrote:
| So far, partners of Apple I've seen the service forwarding to are
| CloudFlare, Akamai, and Fastly. There may be more but those are
| the ones I've seen and heard.
| ehsankia wrote:
| Wait a second, didn't the Fastly breakage happen the day after
| WWDC? What are the chances that the one client was Apple and
| their config was for this service :)
| freakynit wrote:
| Apple in a few months to VPN's: give us 30% share if you want to
| serve as exit node to Apple iCloud+ VPN.
|
| Two part strategy as always:
|
| 1. Get yourself in-between of an already functioning system, by
| force if needed 2. Abuse your market position to gain millions of
| users, make it super easy to use this as default, and make
| existing players compete for their 70% share of what they already
| were earning.
|
| - Enjoy new billions on top of existing trillions
| permo-w wrote:
| This goes against my general distrust of giant corporations,
| but I trust Apple a lot more than I do the extremely shady VPN
| companies infesting the internet
| njacobs5074 wrote:
| Does anyone have pointers to info/articles about the countries
| that are on the "no VPN" capability list?
|
| Some of them make sense to me, i.e. China which has a long
| history of censoring their citizens.
|
| But in particular, I'm trying to find out why South Africa is on
| that list seeing as I live there.
|
| Edit: In [1], Apple is quoted as saying, "We respect national
| laws wherever we operate" but did not elaborate further.
|
| [1] https://mybroadband.co.za/news/internet/400893-apple-will-
| no...
| gjsman-1000 wrote:
| Another reason could also be that the servers operate in the
| same nation that you are from. If Apple or no suitable partner
| has servers in South Africa, that could also be a reason.
|
| And, of course it could be politics. The South African
| government, I wouldn't know, but it could be possible that they
| wouldn't let tech companies from the US build servers in their
| nation.
| jammmety wrote:
| Apple said it also will not offer "private relay" in Belarus,
| Colombia, Egypt, Kazakhstan, Saudi Arabia, South Africa,
| Turkmenistan, Uganda and the Philippines.
|
| https://www.reuters.com/world/china/apples-new-private-relay...
| thih9 wrote:
| What's are the differences between a VPN and an onion router
| approach? Could anyone explain or link to an article?
| thehappypm wrote:
| A VPN is a middleman that accepts your traffic and forwards it,
| hiding who you are to servers. An onion router is like a VPN
| but instead of 1 middleman, the middleman is a whole random
| network of middlemen, and those middlemen also hand off to
| other middlemen.
| mikemyoung1 wrote:
| This is a great summary, thanks
| permo-w wrote:
| What I don't get is why people don't regard Onion Routers as
| a form of VPN. It's still uses a virtual private network,
| just more of them. a network of networks.
|
| Surely TOR is a type of VPN?
|
| Maybe there's some details I'm missing. I'm no expert
| detaro wrote:
| Really mostly convention. Yes you could label it that way,
| but people consider it to be enough of it's own thing to
| not do so. (+ there is some value in not conflating the two
| because they do have different threat models etc and users
| should treat them differently too)
| headmelted wrote:
| I've been trying to point this out to people but YouTube
| personalities have a louder voice than anyone else so you end up
| with bad information.
|
| Props to Apple for offering an (albeit low entropy) onion router
| on their own infrastructure. I can't imagine this is going to win
| them any friends in government circles but it's definitely a step
| in the right direction.
|
| I'd also really like to see Apple come clean about the iCloud
| backup encryption debacle. A lot of people are trusting it to be
| something it's not and it should really be clarified on-device
| what it is and is not before opting in.
| yepthatsreality wrote:
| Apple won't come clean until they can sweep it under the rug
| like they did with the other debacles (see: keyboards). Being
| honest about those things undermines their "Apple knows best"
| image attempt.
| ______- wrote:
| > I'd also really like to see Apple come clean about the iCloud
| backup encryption debacle
|
| Are you referring to this article?:
|
| https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
|
| It's why I only use my Apple ID for grabbing apps from the app
| store. I have disabled all the `cloud storage` features of
| iCloud. iCloud is a privacy nightmare.
| gjsman-1000 wrote:
| By that logic though, Google Drive, OneDrive, AmazonS3, they
| are all privacy nightmares. And you might agree, but Apple is
| hardly alone.
|
| And like the article says, they didn't want to poke the bear
| anymore. Of course the FBI has congressional friends. It is
| possible that Apple saw the risk of it backfiring and making
| things worse as too great.
| modeless wrote:
| Google does end-to-end encryption of Android backups. And
| Apple knows how to do it too, but they intentionally
| restricted their implementation to only cover backups of
| Keychain passwords and a few other things, apparently
| because they don't have the courage to stand up to the FBI,
| according to Reuters. Strange considering their public
| stance against the FBI in the San Bernardino case and on
| privacy issues in general. Especially since iCloud backup
| totally defeats the highly touted end-to-end encryption in
| iMessage.
| gjsman-1000 wrote:
| Yes, backups, and Apple should get on that. However, your
| photos in Google Photos, your location data, your uploads
| in Google Drive (equivalent to iCloud Drive OP is talking
| about), not end to end encrypted and no option for it.
|
| I think market share is another sign. Does anyone use
| actual Android Backup, or do they use the unencrypted
| "backups" in G Photos and elsewhere? For that reason
| should the FBI care? Maybe I'm wrong but I believe actual
| Android Backup is much less used than iCloud and
| confusingly named alternative "backups" within Google
| apps.
| headmelted wrote:
| Let's be really frank about it - no large company is
| going to offer end-to-end encryption of photos because of
| what kind of photos might end up on their infrastructure
| if they do. And honestly I don't blame them _at all_.
|
| I'd just like to see Apple be more transparent with this
| one particular issue because it undermines so much of
| what they're advertising to the consumer.
|
| A transparency label for iCloud backup showing what is
| and is not E2E before enabling would do. Most people
| (myself included) would be quite happy with photos being
| encrypted by an Apple-held key (I'm not worried about the
| police seeing my boring lunch pics, I just don't want
| photos of my kids being readily accessible to everyone
| else).
|
| It should be made clear if they're offering E2E for some
| features that other settings will render it pointless is
| all I'm saying.
| smoldesu wrote:
| Any large company can offer E2E encryption, as long as
| they don't have extenuating interests that could make
| them liable for the way I use their services. Unless
| Apple is harvesting my data on the regular, they should
| have no problem with me being the sole keyholder for my
| iCloud account.
| tgragnato wrote:
| I think Apple would need to ship a different OS in China.
|
| Cloud services offered there must store data in the
| country and be operated by Chinese companies. (Apple is
| complying with this)
|
| But Chinese companies HAVE TO assist the authorities in
| obtaining systematic access to private sector data. (This
| is not possible with E2E for backups and photos)
| dannyw wrote:
| Are you really arguing that because child pornography
| exists, no large company should offer ETE photos?
|
| Despite there been reasonable solutions like bloom
| filters and client sided hash detection, so that known
| child abuse material can be detected, without it needing
| to compromise the privacy of 99.99999% of users?
|
| And that photos present some of the most sensitive
| materials on your device:
|
| - geo-IP location showing basically everywhere you have
| taken a photo in, ever since the dawn of time
|
| - people's consensual sex tapes
|
| - photos of passwords, account recovery codes, private
| keys, seed words
| headmelted wrote:
| I'm arguing that because it exists no company of Apple's
| size is going to risk unknowingly hosting it, and I
| wouldn't either if I were in their shoes.
|
| I agree with you in terms of photos being some of the
| most private information we have, but the E2E argument
| doesn't ever get won by the tech community without a
| guarantee of blocking/catching/preventing CP and being
| able to make that evidence available for prosecution.
|
| To the arguments above: Any processing server side
| implies no real E2E. Any processing client side is by
| definition under the control of the client and subject to
| forgery/hacking/spoofing/tampering.
| philwelch wrote:
| > Despite there been reasonable solutions like bloom
| filters and client sided hash detection, so that known
| child abuse material can be detected, without it needing
| to compromise the privacy of 99.99999% of users?
|
| This is not a good argument. "Known child abuse material"
| is the tip of the iceberg. There's nothing stopping
| people from creating new "child abuse material", and the
| people who are doing that sort of thing are the ones who
| are more important to catch.
| oarsinsync wrote:
| > geo-IP location showing basically everywhere you have
| taken a photo in, ever since the dawn of time
|
| Geo-IP is the process of taking an IP address and
| attributing an location to that IP address.
|
| I think you meant GPS location?
| vngzs wrote:
| In the bloom filter example, what device calculates the
| hash inputs for the bloom filters? If it's the server,
| then the server needs a copy of the image to check. So is
| it the client? If so, how can you prevent a malicious
| client from forging their hashes to be those of known-
| safe images?
|
| Not saying it's not possible to build an E2E image
| storage service that also has the protections society
| tends to demand. Just saying that I haven't seen anyone
| do it yet, because these problems are subtle.
| encryptluks2 wrote:
| There are encryption options, just not with the software
| provided by the storage providers.
| modeless wrote:
| Look at the Reuters article they linked. iCloud backup is
| the issue. Usage of iCloud backup and Android backup are
| probably very similar (in percentage terms), why would
| you expect that Android backup is used less? They are
| pretty much equivalent features, except that one is end-
| to-end encrypted and the other is not. In both cases,
| photos are handled separately.
| headmelted wrote:
| Yep, exactly that.
|
| I utterly agree that other direct-to-consumer options are in
| the same boat - but Apple is quite heavy-handed in it's
| messaging about, well, messaging being encrypted and private
| and no-one (including Apple) being able to read your
| messages. That's only true if you don't backup to iCloud.
|
| I would expect most people on HN to be aware of all of this
| of course but when you're so strongly selling your privacy
| protections as part of your brand, it's a pretty glaring
| window to leave wide open.
| InTheArena wrote:
| I have very little respect for Youtube personalities (thinking
| of LTT in particular) when it comes to talking about Apple in
| particular. They are so wedded to their "everyone, except us,
| is evil" perspective that their knee-jerk reaction to almost
| anything from Apple, privacy or otherwise is negative. (LTT
| spent the first bit trashing Apple for making marketing claims
| about the M1, instead of letting them do, then refused to back
| off when numbers backed up their claims, continue to trash
| anything with Apple and privacy, etc).
|
| Apple is not without sin. If we get out of this entire epic
| lawsuit (another company not without sin) with consumers
| winning the ability to side-load, it's a win. But for the most
| part, Apple has a multi-decade history of usually working for
| customers in above-board ways, as opposed to Facebook, Googles
| and other(s).
| varispeed wrote:
| > I can't imagine this is going to win them any friends in
| government circles but it's definitely a step in the right
| direction.
|
| Quite the opposite. Governments probably already have taps to
| decrypted traffic.
|
| Otherwise how come that would even be legal to run?
|
| If someone commits a crime and government cannot find evidence,
| because Apple gives shielding, then isn't that making them
| hypothetically an accomplice?
| JumpCrisscross wrote:
| > _If someone commits a crime and government cannot find
| evidence, because Apple gives shielding, then isn 't that
| making them hypothetically an accomplice?_
|
| We have recent and specific case law around this. The cherry
| on top is it was Apple on the other side.
|
| No, this is not how being an accomplice works in the U.S.
| It's not how it works anywhere with the rule of law.
| varispeed wrote:
| Would you have a link?
| JumpCrisscross wrote:
| https://en.m.wikipedia.org/wiki/FBI-
| Apple_encryption_dispute
| gjsman-1000 wrote:
| By the same logic, I'm the taxpayer who paid to help build
| the highway that the drug kingpin used to get away during a
| high speed chase. I'm an accomplice now.
|
| I'm the scientist who purified the water that the criminal
| used to get enough strength to run away. I'm an accomplice
| now.
| kergonath wrote:
| > Otherwise how come that would even be legal to run?
|
| Why wouldn't it be? I was under the impression that what
| isn't forbidden by law was legal by default. AFAIK, running a
| VPN platform isn't illegal.
|
| > If someone commits a crime and government cannot find
| evidence, because Apple gives shielding, then isn't that
| making them hypothetically an accomplice?
|
| I hate this argument. It's lazy and can be used to accuse
| anybody in any context, and shut down discussions that we
| should be having. By that standard we are all accomplices for
| some crimes.
| willis936 wrote:
| >I was under the impression that what isn't forbidden by
| law was legal by default.
|
| Even beyond that, personal privacy from the government is
| enshrined in the 4th amendment. Just because there was some
| executive actions and illegal laws made does not mean the
| 4th amendment suddenly disappears. No person or entity has
| the right to dragnet all communications.
| unknown_error wrote:
| > personal privacy from the government is enshrined in
| the 4th amendment
|
| Yeaaaaah, let's just pretend Snowden and Manning never
| happened.
| [deleted]
| willis936 wrote:
| I'm doing the opposite. Saying that the fed is actively
| engaging in illegal search and seizure is not ignoring
| the whistleblowers that brought the scope of the issue to
| light, it's acknowledging the issue.
| unknown_error wrote:
| The point is that the Constitution is largely
| meaningless, feel-good fluffery that has no actual
| bearing on which of our so-called rights are actually
| available to us.
|
| It's an aspirational document in a largely lawless land,
| more a historical oddity than the supreme anything. If
| you wait for legislators and law enforcement to fix
| personal privacy, you've already lost... the US law
| enforcement culture is actively hostile towards
| individual rights because it makes their jobs harder. The
| only real difference to, say, China, is that we like to
| pretend otherwise. But the reality in the ground is that
| nobody on the grid has had meaningful privacy for decades
| now.
| willis936 wrote:
| >The point is that the Constitution is largely
| meaningless, feel-good fluffery that has no actual
| bearing on which of our so-called rights are actually
| available to us.
|
| IANAL but this sounds fundamentally wrong in every way I
| interpret it. The Constitution is a set of laws that
| cannot be contradicted by any other law, executive
| action, or judicial action, with the exception of an
| amendment.
| kergonath wrote:
| > No person or entity has the right to dragnet all
| communications.
|
| Indeed. And the fact that this is not recognised as a
| fundamental human right is a serious limitation of the
| charter and universal declaration. And yet, it comes up
| regularly.
| smoldesu wrote:
| > I can't imagine this is going to win them any friends in
| government circles but it's definitely a step in the right
| direction.
|
| Apple already has all the friends they need in the "government
| circles". They're fully enrolled in PRISM and are well-known to
| kowtow to the demands of corrupt leadership (see: Russian
| iPhones, Chinese iCloud hosting)
| snowwrestler wrote:
| Apple is "fully enrolled" in PRISM just like any other
| company with U.S. operations, because PRISM is the internal
| NSA source designation for material acquired via FISA
| warrants, and complying with FISA warrants is not optional.
| mark_l_watson wrote:
| I am running APple's betas for iOS, iPadOS, and macOS right now
| - I really appreciate their implementing yet more privacy.
|
| re: non-encrypted iCloud storage: I agree with you. I keep
| medical and financial data encrypted (e.g., their Pages app
| supports encrypting documents, and you can encrypt PDFs, etc.)
| but I would rather they did this for me. That said, for the 90%
| of my files that I would post on a street corner, I find iCloud
| storage across my devices is handy.
| Engineering-MD wrote:
| But how secure is encrypted pages and PDF? My understanding
| was it is not useful against a determined attacker and anyone
| able to access your iCloud will be in this category.
| nr2x wrote:
| iClouds lack of encryption basically invalidates all other
| promises they make.
| LeoPanthera wrote:
| If you believe this you have misunderstood how iCloud works.
| SavantIdiot wrote:
| Where are the Apple VPN exit points?
|
| I wish there was a non-dubious VPN service with an exit in a non
| GDPR country, or at least one with internet privacy. I rolled a
| strongswan VPN through AWS EC2 but all the egress points are in
| countries that can be exposed.
| pdimitar wrote:
| > _All in all, a very Apple approach: They deny themselves any
| knowledge of a customer 's DNS queries and Web traffic, so if
| served with a subpoena they have very little to respond with._
|
| Maybe I am missing something but I view this is a rather genius
| move. They have plausible deniability + actually introduce some
| protection for their users.
|
| Not sure how to read the original post though. Is it praising
| Apple? Is it mocking them? We don't have to be polar of course, I
| am just wondering.
| yreg wrote:
| >In one move, Apple has taken onion routing from a specialized
| tool for hackers to something that will be in daily use on
| billions of devices.
|
| Sounds like praise to me.
| smoldesu wrote:
| Apple has claimed this shtick several times (as well as many
| other VPN companies), but it actually requires a pretty
| intricate software setup to pull off. The best VPN services
| won't even have hard drives to store logs in: that way, even
| individuals with a court-issued warrant can't get your info.
| I'd imagine there's sufficient pressure on Apple from PRISM and
| other governments to keep some level of rudimentary logs.
| heavyset_go wrote:
| > _The best VPN services won 't even have hard drives to
| store logs in: that way, even individuals with a court-issued
| warrant can't get your info_
|
| Courts can compel them to log this information, so all claims
| about not keeping logs are just theater. The second they're
| ordered to by a court in the US, they will.
| pwinnski wrote:
| IANAL! The legal theory is that US courts can stop you from
| taking actions, but cannot compel you to take actions.
|
| So they can stop you from deleting existing logs, but they
| cannot require you to collect logs you aren't already
| collecting.
|
| I have no idea how well this idea has been tested in court,
| but that's the theory on which providers who don't even
| have hard drives are relying.
| saurik wrote:
| (And if Apple has logs of which IP address accessed a
| resource from which egress provider at a specific time, that
| is often enough to do what most governments are looking
| for... such is the limitation of two hops, and why Tor has
| three. I truly hope Apple has designed their system to avoid
| logging anything about their ingress packet flows.)
| steveharman wrote:
| "...why don't VPN providers implement a onion router.."
|
| Pretty sure Nord already does. Probably others.
| tyingq wrote:
| I'm curious how they are securing the feature that keeps you in
| the same region. Since that feature encourages content providers
| to not block, it would be a desirable target to work around.
| permo-w wrote:
| yeah I was thinking about how difficult it might be to spoof
| your location prior to the Apple Router, and have it come out
| the other side nicely laundered
| soheil wrote:
| I think the title should be: Apple's iCloud+ "TOR-esque"
| permo-w wrote:
| Apple Routing
| kibleopard wrote:
| > The routing uses two hops; Apple provides the first, and
| "independent third parties" (not yet specified) provide the
| second.
|
| This isn't true though, they have specified who the independent
| third parties will be: CloudFlare Warp, Fastly, and Akamai. See
| here: https://www.barrons.com/articles/fastly-stock-outage-
| think-a...
| amq wrote:
| Potentially, this provides troves of data to the exit node
| operators (CloudFlare, Fastly, Akamai, ...). Yes, it's the same
| with all VPNs and ISPs, but I think users should be made aware
| that now instead of your ISP analyzing the data, an even bigger
| and more capable corporation is. And if Apple is controlling the
| entire onion chain (I would be surprised if they weren't), they
| have even more data available, mainly with a corresponding IP of
| yours. In the net sum, you are hiding the transmitted data from
| your ISP and the IP from the sites you visit, but you are handing
| over all this information to a centralized place - Apple and exit
| node providers. Potentially, they can use the information to
| connect the dots more easily and fully than any ISP or site ever
| could.
| aeontech wrote:
| This is not quite correct though - entry side and exit side are
| specifically and intentionally not operated by same entities.
| So Apple knows who you are but doesn't know what you're looking
| for or where you're going - your traffic is passed straight
| through to the exit layer. Exit layer operator knows what
| you're looking for and where you are going but doesn't know who
| you are or where you're coming from.
| amq wrote:
| The exit node operator can extract useful information even
| without knowing your IP, especially until Encrypted Client
| Hello (ECH) is ubiquitous.
| Spooky23 wrote:
| I think this is great, if only as a way to kill the bullshit
| consumer VPN business, which sells snake oil.
| wintermutestwin wrote:
| Doesn't a consumer VPN keep my ISP from building a data profile
| on me?
|
| Yes, I get that now my VPN provider can build that data
| profile, but I am certain that my ISP is a vile monopoly that
| has corrupted the regulators that are supposed to represent me.
| dehrmann wrote:
| I have Sonic, so I trust my ISP more than a random VPN
| provider. Even if you have AT&T, they have a legal team that
| makes they provide a lot of opt-outs. I don't trust that they
| work, but there are a lot more eyes on them than a VPN
| provider.
| izacus wrote:
| > I think this is great, if only as a way to kill the bullshit
| consumer VPN business, which sells snake oil.
|
| Having a US megacorporation kill a whole market segment and
| pull it into their monopolized walled garden sure seems like an
| improvement. After all, they pinky promise they will not ever
| abuse that! /s
| massysett wrote:
| By this logic our computer operating systems would not
| improve, ever. Web browsers, built-in networking, music
| players, image editors, mail programs, even Solitare - all
| things that at one time were separate market segments.
| izacus wrote:
| All of those products have been improved by COMPETITION.
| The most critical, most important and ONLY thing that makes
| modern capitalism work for non-rich human beings.
|
| Every single field you mention was thriving when there were
| multiple players fighting over your money and have started
| to become exploitative and abusive as soon as one player
| killed the others and started rent-seeking. Competition is
| crucial for market economy to work.
|
| I find it utterly bizarre that someone educated would think
| that a death of market by megacorp monopoly would somehow
| drive improvement.
| olivierestsage wrote:
| I think that's painting with a pretty broad brush. What's wrong
| with Mullvad, for example?
| casefields wrote:
| The issue here preference falsification:
|
| >Preference falsification is the act of communicating a
| preference that differs from one's true preference. The
| public frequently conveys, especially to researchers or
| pollsters, preferences that differ from what they truly want,
| often because they believe the conveyed preference is more
| acceptable socially.
|
| The reason why the VPN business is booming is to avoid those
| pesky content infringement letters, and to workaround geo
| restrictions.
|
| OP is upset that they advertise themselves as privacy tools,
| but that's just marketing.
| KingMachiavelli wrote:
| Yea you don't legally market your product as a tool to
| commit a crime but 'privacy' is pretty broad term and
| partially true so it works.
| dehrmann wrote:
| VPNs mostly do what they claim, but they may or may not be
| government or marketing honeypots, and a lot of the sales
| pitches around hackers and privacy aren't as interesting in
| the days of HTTPS. Aside from piracy and bypassing region
| restrictions, you're just hiding your IP address, but those
| change often enough already.
| symlinkk wrote:
| Who runs Mullvad?
|
| I find it funny that people here mistrust companies like
| Facebook and Google, but then turn around and hand off their
| entire network activity to a faceless, anonymous VPN company.
| wolverine876 wrote:
| Have you tried answering that question? Mullvad isn't
| faceless and anonymous.
| olivierestsage wrote:
| I think a lot of that distinction turns on how well your
| network data is linked to your identity. In the case of
| Mullvad, you can pay them anonymously by putting cash in an
| envelope and just mailing it to them,[1] which lowers the
| trust factor involved.
|
| [1] https://mullvad.net/en/pricing/
| VWWHFSfQ wrote:
| what is bullshit about it
| Spooky23 wrote:
| You're "protecting" yourself against Starbucks monitoring you
| by establishing a secure connection to a grey market entity
| with more of an interest in your activity.
| vmception wrote:
| Internet reselling doesn't have nearly as much privacy as
| internet resellers suggest
|
| If you are only hiding from your local network and ISP its
| fine
|
| If you want to do that and change your location to a website
| it's fine
|
| If you are hiding from any government for a civil or criminal
| charge it is not fine
|
| If you are hiding from any government intelligence so nobody
| knows anything it is not fine
|
| It doesnt matter what "no logging" claims the internet
| reseller has, this is not verifiable and can also change at
| any moment
| KMnO4 wrote:
| Have you noticed all the ads say "Hackers can spy on your
| connection when you log into your bank at Starbucks."
|
| That's complete FUD. HTTPS completely avoids this issue (
| _especially_ with a bank). Very few websites use HTTP now.
|
| While VPNs do have their valid use (preventing your ISP from
| spying, changing geolocation, and private networks for eg,
| work), most of the marketing is spreading misinformation.
| flixic wrote:
| I've seen stats for a couple of the biggest VPNs. Massive
| majority of their traffic is just switching geolocation
| restrictions (US Netflix and similar).
|
| They don't tend to advertise that. Some do, but it's not
| their main message, because "prevent ISPs from spying" is
| cleaner.
|
| iCloud+ does not solve this, so there will be a sustained
| need for VPNs, particularly those that invest effort into
| into avoiding Netflix blacklists.
| tpush wrote:
| > They don't tend to advertise that.
|
| IME of podcast advertising they all advertise this very
| openly.
| anonymouse008 wrote:
| I've never understood how a VPN doesn't get too carried
| away to pull a MITM with some central cert
| gjsman-1000 wrote:
| Because if you used a central cert, every device would
| have to whitelist that cert, and just clocking the lock
| icon in your browser would reveal it.
| jen20 wrote:
| Many consumer VPNs install a client, and it would be
| trivial to ship a new trusted certificate with it.
| acdha wrote:
| This is true, but note that, for example, on iOS an
| application can't do that without prompting. Now, most
| people would probably hit "Approve" if one of their
| security products said it was necessary.
| gjsman-1000 wrote:
| That wouldn't change that clicking the lock icon in your
| browser would show the same certificate on every website,
| and that this certificate was universally valid. Pretty
| obvious...
| AdamJacobMuller wrote:
| > show the same certificate on every website
|
| Not really, because, you can use on-demand certificate
| issuance.
|
| Hell, if you really want to, you can even name your
| certificates the same as existing certificates and the
| only way to detect the forgery would be to compare the
| actual public keys (and who does THAT).
|
| I feel like I'm writing an evil roadmap here, but, you
| can even do multiple root certs with different names and
| trust them all, do a whole "fake" PKI infrastructure
| which would be impossible to detect unless you were
| comparing the actual keys.
| anonymouse008 wrote:
| > I feel like I'm writing an evil roadmap here, but, you
| can even do multiple root certs with different names and
| trust them all, do a whole "fake" PKI infrastructure
| which would be impossible to detect unless you were
| comparing the actual keys.
|
| Yeah, just imagine being beholden to some federal statue
| impropriety (easiest in taxes) and running one of the
| these vpn organizations...
| 0x0 wrote:
| If and when browsers start requiring pre-certificate
| transparency logging, anything like this should no longer
| be possible to pull off, since none of the fake
| certificates would be able to contain a stapled pre-
| certificate "signoff" from a trusted CT log.
| throw0101a wrote:
| > _Many consumer VPNs install a client, and it would be
| trivial to ship a new trusted certificate with it._
|
| A lot of browsers have their own root chain, and also now
| do certificate pinning, so will (IIRC) only accept
| specifically designated certs for particular sites
| (doesn't Google/Chrome/Gmail do this?).
| Nextgrid wrote:
| On the other hand, a lot of VPNs provide proprietary
| client software (even though all the major OSes have
| built-in support for the common VPN protocols such as
| IPSec, L2TP, etc) so they could very well sneak the root
| cert in there too.
| dehrmann wrote:
| > "Hackers can spy on your connection when you log into
| your bank at Starbucks."
|
| I've also heard this from a reputable news source (NPR) in
| the past few years, even though it hasn't been true for
| banks for at least 15 years, ~5 for most websites.
| o8r3oFTZPE wrote:
| Here is a simple question: Why is there only one "Tor".
|
| Why haven't there been more onion routing projects. (Maybe there
| have been and I am just not aware.)
|
| Perhaps the same reason(s) we never saw widespread adoption of
| remote proxies, despite their usefulness in many situations.
|
| Although in some respects onion routing seems quite an
| improvement over "simple" proxies.
| gabmiral wrote:
| If I recall correctly, I2P uses some sort of onion routing.
| marshray wrote:
| The more nodes you have participating the more secure an onion
| system tends to be. Since the Tor network can carry most kinds
| of traffic, the motivation to avoid a fork is strong.
| wolverine876 wrote:
| > The more nodes you have participating the more secure an
| onion system tends to be.
|
| Tor isn't very large as it is, and (I would guess) it's the
| largest. If another onion routing network didn't grow the
| audience, you would have two even smaller networks.
|
| > the Tor network can carry most kinds of traffic
|
| Isn't Tor limited to routing TCP? That would rule out QUIC,
| for example.
| shp0ngle wrote:
| I'm literally using VPNs just to get around geo-blocking.
|
| Still, this is interesting.
| bhaavan wrote:
| My guess is one of the major reasons for having the exit nodes in
| the same geo location as entry nodes is to have continuous
| operations in China. Without this constraint, they would have
| allowed chinese consumers to access the free web, which would ban
| them instantaneously.
|
| I don't think Apple cares as much about video content providers,
| though.
| gjsman-1000 wrote:
| That's not the reason. In China, Myanmar, Egypt, and several
| other countries this service will not be available at all.
| Those customers will just have regular old iCloud.
|
| A more likely reason is that video streaming services with
| georestrictions like Netflix, Amazon, or BBC would have lost
| their minds.
| lxgr wrote:
| > I don't think Apple cares as much about video content
| providers, though.
|
| Not being able to watch Netflix, Amazon Video etc. in Safari
| seems like something Apple would in fact care about.
| krferriter wrote:
| Not if it gets them banned in those countries.
| Mindwipe wrote:
| HBO is blocking Private Relay regardless.
| gjsman-1000 wrote:
| Only for now. When it rolls out widely, Apple's sheer scale
| will most likely force the issue.
| Mindwipe wrote:
| I doubt it, unless HBO and Apple are able to come to some
| assurance on it.
| whynotminot wrote:
| I don't think this service is being offered in China, period.
| simias wrote:
| It wouldn't have been too hard to just implement this feature
| for chinese customers if that was the only driver.
|
| But I agree that making the exit node in the same country
| probably goes beyond video content providers, it avoids all
| sorts of potential legal, diplomatic and practical issues.
| dehrmann wrote:
| Apple also isn't in the business of people bypass region
| restrictions. This seems focused on privacy.
| smoldesu wrote:
| Apple has always given in to China's demands. A few years ago
| they even moved their entire Asian iCloud datacenter to the
| China mainland after the government issued some vague
| complaints about "nationalism" and "security".
| danpalmer wrote:
| Props to Apple for the design of this service. It doesn't hit all
| the privacy targets that long-time personal VPN users might be
| looking for, and it doesn't get into the game of trying to
| circumvent region locked content*, but otherwise it's likely to
| be a solid privacy improvement for almost all users in a careful
| and deliberate way.
|
| I use a VPN for other reasons (downloading Ubuntu ISOs mostly)
| but I'll probably turn this on and leave it running on all my
| devices because of how transparent it appears to be. I trust
| Apple's onion-routing design more than I trust my VPN provider
| not to log things.
|
| * I'm actually glad they don't try to get around region locks. I
| consume a lot of BBC content and live in the UK. I'm constantly
| struggling with my VPNs (with UK endpoints) being blocked because
| others outside the UK could be using them. It would be nice if
| the BBC didn't block like this, but UK residents do typically pay
| for the content whereas those outside the UK are unable to.
| hammock wrote:
| Which vpn do you use?
| danpalmer wrote:
| Private Internet Access.
|
| I used to use NordVPN but found it to be much slower, less
| stable, worse macOS integration, not as good on the privacy
| front.
| hammock wrote:
| Do you have any thoughts on PIA vs Mullvad?
| wolverine876 wrote:
| PIA is owned by the person who owns Freenode, afaik. I
| would certainly look into that before trusting them.
| 1_player wrote:
| FWIW, Mozilla VPN is based off Mullvad, which I've
| enjoyed for a year to download Linux ISOs and I've never
| had an issue with. Also they have one of the most
| anonymous of setups (accept cash, crypto, no username or
| passwords or personal details required, you're just given
| a random account number you can add credit to)
|
| NordVPN is oversubscribed crap.
|
| PIA was founded by Andrew Lee, the big brain behind the
| current Freenode drama, with help of the infamous Mark
| Karpeles of Mt. Gox fame. I'd rather use something else.
| bjoli wrote:
| PIA is owned in a weird structure I don't understand in a
| jurisdiction where any legal agreements with my home
| country are, most likely, non-existant or untested. They
| also seem to have enormous amounts on money to spend on
| marketing or paying off torrent review sites.
|
| Everybody recommends them, but all of these things make
| me uneasy.
| sa1 wrote:
| After the recent freenode drama, best to avoid them.
| NicoJuicy wrote:
| > Props to Apple for the design of this service.
|
| I was under the assumption that it was mostly Cloudflare Warp
| repackaged with a different name?
| defaultname wrote:
| That would be an incorrect assumption. It's an onion that
| goes to Apple first and then to a variety of external vendors
| -- Fastly, Cloudflare, Akamai, and likely others.
| kergonath wrote:
| > It would be nice if the BBC didn't block like this, but UK
| residents do typically pay for the content whereas those
| outside the UK are unable to.
|
| As an exiled Londoner, I would love to be able to pay to access
| BBC programmes. Unfortunately I can't, so a VPN is often the
| only solution (well, I guess torrenting would be another one,
| but it's not really better).
| dylan604 wrote:
| If only there was a way to store a user's information so that
| they could be identified with some sort of a login process
| that would indicate that they are a current valid member. It
| would also be impressive if this same system would allow the
| user to indicate that they are currently abroad to allow a
| temporary exemption of geofencing.
|
| Obviously, this is something licensing agreements do not
| allow for, but it seems like such an obvious user friendly
| concept that it will never be allowed.
| rlaabs wrote:
| BBC Select is another option for BBC documentaries if you
| have either Amazon Prime video or an Apple TV.
|
| https://www.bbcselect.com/
| robotresearcher wrote:
| BritBox is a neflix-like service that has UK shows from the
| BBC and ITV. Decent catalog.
| [deleted]
| loloquwowndueo wrote:
| Why do you use a VPN to download free and publicly available
| iso images? (Ubuntu). Just curious.
|
| Do you download directly from a mirror or use BitTorrent for
| this? (If the latter I think I kind of understand the rationale
| for the VPN)
| bjoli wrote:
| My ISP throttles bittorrent traffic.
| chrisfinazzo wrote:
| Until a few months ago, I had never really used BitTorrent to
| do anything - save for about 20 minutes back in HS almost 20
| years ago (!)
|
| (I _think_ I was running uTorrent on Windows, it was weird
| and I really didn 't know how to use it.)
|
| However, in order to "acquire" [this][1], torrenting was
| realistically the only sensible option I had. A direct
| download from the Internet Archive would have taken roughly 7
| hours @ 100 Mb/s. The torrent file was done in an hour.
|
| To my great surprise, the link isn't dead, so...yeah :)
|
| Transmission CLI FTW.
|
| [1]: https://www.caseyliss.com/2021/2/14/a-concert-for-
| charlottes...
| vultour wrote:
| 13GB would take less than 20 minutes at 100Mbps.
| Regardless, I'm not sure why you only consider near instant
| downloads "sensible". I often spent several days
| downloading things when I was younger.
| syntaxstic wrote:
| Probably because of this -
| https://arstechnica.com/gadgets/2021/05/fake-dmca-
| takedown-n...
| xuki wrote:
| linux iso is code for pirated content
| Jiocus wrote:
| And here I was, still thinking Linux was _" an illegal
| hacker operation system, invented by a Soviet computer
| hacker named Linyos Torovoltos, before the Russians lost
| the Cold War"_.
| yunohn wrote:
| "Ubuntu ISOs" is a common euphemism for pirated content like
| media or games.
| [deleted]
| [deleted]
| [deleted]
| krageon wrote:
| > but UK residents do typically pay for the content whereas
| those outside the UK are unable to.
|
| In essence, what you're saying boils down to "it's already paid
| for, but nobody else can have it anyway". It's unreasonable and
| there is no need to make excuses for this behaviour.
| 867-5309 wrote:
| totally agree. I had no end of shit trying to watch BBC News
| channel from abroad. I'm a UK national, I own a house in the
| UK, I pay UK taxes, I pay your stupid TV licence fee, you're
| broadcasting live over 3 separate CDNs, just let me watch the
| fucking news. I eventually subscribed to an illegal IPTV
| service for that one sodding channel. I don't even need the
| other 17,000 channels. the BBC drove me to it
| herbstein wrote:
| Completely off-topic: great choice of name. That number is
| burned into my mind, and will be forever
| 867-5309 wrote:
| cheers ;)
| mikecarlton wrote:
| Still more off-topic: I can only read it as 86-75-309
| 867-5309 wrote:
| the joy of fitting 7 beats into a 4/4 signature
| UncleEntity wrote:
| To continue the off-topicness...
|
| That number almost always works for store 'loyalty
| program' discounts too.
|
| <local area code> 867-5309
| mavhc wrote:
| Not running a vpn from your house?
| 867-5309 wrote:
| the tenants wouldn't approve (they pay for elec and
| internet). plus I'm away for twelve months so no chance
| of onsite troubleshooting, physical reboots after power
| outages, etc.
| larkost wrote:
| So, you are saying that the TV license you are paying for
| is actually being used by the renters in the house you
| own. Is that a fair statement? That puts a bit of a
| different spin on it.
| 867-5309 wrote:
| due to the timing of things, I prepaid for ten twelfths
| of their residence. I didn't seek recompense as I knew I
| would be consuming one channel. I am unaware if the
| tenants use a tv
| vanburen wrote:
| It may be worth looking at the AAISP L2TP Service[1].
|
| They are a domestic ISP, so I guess iplayer should work
| over the service.
|
| [1]: https://www.aa.net.uk/broadband/l2tp-service/
| 867-5309 wrote:
| looked interesting, but is around double the price for
| around max 2 hours viewing per day, with no guaranty of
| supporting BBC streams. from experience I'll presume they
| know about this service and are actively blocking their
| subnet
|
| I'm paying around half the price for unlimited viewing of
| direct streams (no faffing with client protocols) which
| come transcoded for home and mobile usage
| criddell wrote:
| It really hasn't already been paid for. For example, say you
| are a composer who wrote some music for a BBC series. You get
| paid more for something in wide release than for something
| released only in the UK.
| andyjh wrote:
| Licensing issues aside, it would cost _additional_ money to
| actually serve all that content to a global audience
| (shipping bytes over the internet isn't free).
| 867-5309 wrote:
| yet they deliver over 3 CDNs, yes THREE, for a maximum
| viewership of one country
| danpalmer wrote:
| Yes you're right, I was giving a reason more than an excuse.
| I don't think they should be doing it.
| JumpCrisscross wrote:
| > _what you 're saying boils down to "it's already paid for,
| but nobody else can have it anyway"_
|
| This is already paid for but the next show isn't.
|
| If the BBC were sold to the public as a soft dollar
| expenditure, it would be one thing. But it wasn't. I'm not
| sure it could be in today's Britain. Ignoring the freeloader
| problem threatens the support on which the BBC's funding
| depends.
|
| This is a debate with reasonable arguments on both sides.
| mtsr wrote:
| It's generally down to the terms for content that networks
| (BBC in this case) buy licenses to. The IP owners don't want
| the networks to allow the whole world access to that content
| for the price that the network is willing to pay to show it
| to their region.
| subpixel wrote:
| But also, and mostly, in reverse. The BBC is the producer
| and license owner of a ton of programming, and rather than
| offer that to the world for a subscription fee, they choose
| to offer it to select partners (previously mainly PBS, now
| Netflix and Amazon) for a licensing fee, or sometimes in a
| coproduction arrangement.
|
| This is big money, up-front, with no need to build out a
| global delivery system or deal with millions of customers.
| Mindwipe wrote:
| > The BBC is the producer and license owner of a ton of
| programming
|
| The BBC is complete license owner of virtually zero
| programming. Almost all (as in 99.9%+) of their content
| uses substantial third party copyright works where the
| cost implications of selling internationally still apply
| (just the music rights alone will drive you mad, and it's
| far from uncommon for BBC content that is shown in the UK
| to have a different soundtrack to the internationally
| sold version to the likes of Netflix due to the licensing
| cost and complexity).
|
| It is also worth noting that the BBC makes a lot less
| than people think, especially if you consider BBC studios
| to be a quasi-separate production entity now (which it
| is!).
| hnlmorg wrote:
| The BBC aren't allowed to. There are very strict terms in
| which the BBC can operate. So what they have to do is
| sell to subsidiaries like BBC America. And there in lies
| the licensing issues described in the GPs post.
|
| This is one of those classic examples of something that
| looks really simple from an outsiders perspective but
| once you have to deal with the details you realise it's
| anything but simple. And through no fault of the BBC
| either, I might add. Various commercial stations and news
| outlets have campaigned relentlessly to shut the Beeb
| down. It's a miracle the service is still operating, even
| if their hands are tightly tied.
| kmeisthax wrote:
| More generally, geographic licensing maximizes revenue
| without damaging brand goodwill for the vast majority of
| customers, so pretty much everyone is going to do it.
|
| Hell, I thought the practice would die (or at least slow
| down) when Netflix started transitioning away from
| syndicated TV and movies; this never happened. Netflix
| will totally geoblock _their own shows_ so they can, say,
| release a cartoon on a weekly basis in Japan but in
| binge-watchable chunks in America.
|
| You will continue to see anything more premium than a
| high-subscriber-count YouTube channel be geoblocked until
| and unless one of two things happens:
|
| - Geoblocking gets so heinous that it starts to push
| people away from shows and services, beyond ordinary
| subscriber churn. This is unlikely - the US is the
| biggest market for a lot of this stuff, and that's a
| market full of people who have no desire to watch foreign
| media ahead of an official release. Hell, most of us
| don't even have _passports_ , and think that you can just
| move to another country by _asking politely_.
|
| - Some country or trading bloc gets enough of a bug up
| their butt about getting releases late that they start
| amending copyright law to ban the practice. AFAIK, I've
| heard Australia was considering banning region locked DVD
| players at one point; and that the EU was considering
| forcing online video providers to license content on an
| EU-wide basis.
| withinboredom wrote:
| > the US is the biggest market for a lot of this stuff
|
| I have a funny feeling that a very large percentage of
| that market comes from VPNs. Everyone I know watches the
| US Netflix and we aren't in the US.
| 867-5309 wrote:
| of all the streaming services, I have found Netflix to be
| the one that cares least about geoblocking. they appear
| to care on the outside to appease the production outlets,
| but on the inside they don't appear to block or
| discourage VPNs at all. unlike the BBC who actively, and
| aggressively, geoblock their content
| nindalf wrote:
| GP wanted to watch BBC News in particular. I don't think
| there's any licensing issue with that, surely?
| Mindwipe wrote:
| > GP wanted to watch BBC News in particular. I don't
| think there's any licensing issue with that, surely?
|
| Ha! There's SO SO MUCH. More than you can imagine.
| [deleted]
| Jiocus wrote:
| > I use a VPN for other reasons (downloading Ubuntu ISOs
| mostly).
|
| This made me smile. Good one.
|
| For context, copyright trolls recently tried to extort torrent
| users for downloading and sharing Ubuntu ISOs.
| rrrrrrrrrrrryan wrote:
| "Linux ISOs" has been slang for a very long time:
|
| https://www.urbandictionary.com/define.php?term=Linux+ISO&am.
| ..
| Jiocus wrote:
| Thanks for clarifying. I've not encountered the use before,
| maybe because here in the Nordics piracy has been -is- very
| normalized.
|
| The other reply told about a uni tale. I've heard about a
| similar story about someone torrenting actual Linux ISOs on
| university network. That resulted in a stern warning else
| the student would be barred from using the network and
| computers. Basically an automatic fail for future studies.
| gbil wrote:
| Anecdote from my MSc year in 2003. In the dorm room I had
| 10Mbps Internet connection via the University's network
| which was quite amazing for the time. So among the real
| Linux ISOs, I tormented also the other kind of ISOs. At
| some point the Uni NOC reached out telling me that I'm
| consuming lots of BW for torrents which is against the
| policy, at which I replied that I download Linux ISOs and
| I'm happy to schedule it for after midnight, outside of
| peak hours. After some days I get a reply that please do so
| from another guy who forgot to remove the quote from his
| previous colleague which went something like "hey we have a
| problem with this guy's answer"
|
| So yes, Linux ISOs is an old thing indeed
| judge2020 wrote:
| If you want to give context, a link to the story would be
| nice:
|
| https://arstechnica.com/gadgets/2021/05/fake-dmca-
| takedown-n...
|
| Importantly, OpSec (the company doing this torrent-dmca-for-
| hire stuff) says the DMCA itself was spoofed
|
| > OpSec Security's DCMA notice sending program was spoofed on
| Wednesday, May 26, 2021, by unknown parties across multiple
| streaming platforms.
| DaiPlusPlus wrote:
| ...who names their company "OpSec"? Are they actively
| wanting to be made fun-of at the next defcon?
| kalleboo wrote:
| Is anything worse than "Web Sheriff"?
|
| https://en.wikipedia.org/wiki/Web_Sheriff
|
| https://web.archive.org/web/20090122235038/https://thepir
| ate...
| zrobotics wrote:
| I mean, they're willing to work for ISPs doing torrent
| detection, which has been a scummy business from the
| start. Somehow, I would imagine they would be even less
| respected than the feds at defcon, since the feds
| actually do technically challenging things occasionally.
| [deleted]
| Jiocus wrote:
| Of course it was a false flag issue, it never made sense
| from the beginning.
| paranoidrobot wrote:
| In a world where white noise[1], birdsong[2] and someone
| playing Beethoven on the piano[3] get copyright
| strikes/takedown notices - I don't think someone getting
| a copyright notice for downloading Ubuntu is that far
| fetched.
|
| [1] https://www.bbc.com/news/technology-42580523
|
| [2] https://news.ycombinator.com/item?id=3637124
|
| [3] https://news.ycombinator.com/item?id=27004577
| wmf wrote:
| The sad thing is that actual Linux ISOs are so over-mirrored
| that using BitTorrent generally has no benefit and may be
| slower.
| Jiocus wrote:
| High availability (through mirrors) is still a good thing.
| My experience is that torrent files are sometimes a lot
| faster, sometimes less so. Just as mirrors.
| mkr-hn wrote:
| They get some by way of their portion of most Americans' cable
| bills from BBC America.
| cwizou wrote:
| > trying to circumvent region locked content
|
| Semi-related to this, but they do offer an option to pick
| between preserving your approximate location and using a
| broader location.
|
| The example they took in one of the sessions was, if you live
| in San Jose, with the first option, you'll get an exit node
| near San Jose so you can still get local "content". With the
| second one, you could get an exit node in Los Angeles.
|
| In practice in Europe, it looks a bit different. I do live in
| the north west of France, and with the first option I regularly
| get an exit node in the southwest of France (from Fastly),
| about 700km away (which is pretty fine by me).
|
| With the second one however, I get exit nodes in Germany and
| the Netherlands (pretty much exclusively Cloudflare), which can
| become an issue with region locked content. I had the issue
| with Prime Video last week not offering me a Tennis match for
| which they only bought rights for in France.
|
| Obviously it's still early and they might tighten a bit the
| locations outside of the US, but overall it's definitely quick
| and well thought out.
|
| Last thing, all your traffic from Safari (and presumably some
| other Apple services ? Still unclear) whether http or https
| will be routed through it. Only http traffic from 3rd party
| apps (Firefox, curl etc) is routed through the relays, which I
| think is a pretty sensible default.
| fnord77 wrote:
| I wish I could pay for bbc iPlayer service outside old blighty.
| But they don't allow it.
| ptaffs wrote:
| This is as much to do with their content license agreements
| as it is BBC being disinterested. Material BBC licenses to
| distribute, they are limited to the UK, and content BBC
| licenses to foreign TV presumably can't be also distributed
| to that same region. There is a service BBC run which allows
| those outside the UK to stream some content
| (https://www.britbox.com/us/).
| xnyan wrote:
| smartdnsproxy.com - 2 weeks, no credit card needed. Works
| perfectly and you don't need to use a VPN, just one of their
| DNS servers.
| fnord77 wrote:
| this is showing up as a malicious site.
| easrng wrote:
| I took a look at this, it seems the way it works is when
| you do a DNS lookup it does a lookup itself and rewrites
| the IPs before returning to you. It stores a mapping of
| client IP and rewritten IP to real IP and when it gets a
| request on the rewritten IP it looks up the original and
| proxies the request. Pretty cool, but I wouldn't trust it
| with anything unencrypted. It offers no privacy benefits.
| ska wrote:
| You still can in some places if I recall correctly. Notably
| not in US due to licensing disagreements (of course).
| rrrrrrrrrrrryan wrote:
| Like, commonwealth nations? Or just countries too small to
| bother with the legal fees?
| ska wrote:
| Like, you can download BBC iPlayer (or could) and pay a
| fee. For UK license fee payers, the app and content is
| free.
|
| I don't think the content was identical, but it was
| pretty broad. Some EU countries, maybe Canada?, at least.
| maxpert wrote:
| I don't really mind paying few bucks for privacy. But I think
| Apple in the process is gonna kill a lot VPN providers. While I
| don't care right now I hope it doesn't make Apple a monopoly.
| gjsman-1000 wrote:
| It won't harm VPN providers, I don't think, for a few reasons.
|
| - VPNs are actually less private than iCloud+ double hop
| design, but could be much faster due to only having a single
| hop.
|
| - Unlike a VPN, you can't choose the location of the server you
| exit at, and the exit server cannot be in a different nation.
| If you are in the US, iCloud+'s relays are in the US. No
| circumventing georestrictions here.
|
| - Apple does not market their service as a VPN and never said
| it is one. For most customers, they don't know this is a VPN
| substitute because it doesn't call itself one. So if you have
| "VPN" in your mind, this isn't something you think of as an
| option.
| CubsFan1060 wrote:
| Additionally, this only works for port 80 traffic from apps.
| Other traffic is not run through this, so a VPN would still
| be useful in those scenarios.
| mariojv wrote:
| To clarify: port 80 and 443 (TLS connections), right? Or is
| TLS traffic only routed through the private relay in
| Safari, not other apps?
| gjsman-1000 wrote:
| All traffic in Safari goes through relay. However, in 3rd
| party apps, all traffic over 80 goes through relay and
| traffic over 443 is exempt. There is going to be an API
| though for if you want your 3rd party app's 443 to go
| over the relay if you desire.
| 0xf00fc7c8 wrote:
| Not in beta1. I tcpdump'ed traffic from Firefox. HTTP/80
| traffic is perfectly visible and not pushed to
| mask.icloud.com
| gcbirzan wrote:
| Wait, so no HTTPS?
| kalleboo wrote:
| Everyone I know who uses a VPN doesn't really care about
| Privacy with a big P (i.e. state actors etc), they either use
| it to get around geo-blocks or to conceal their use of
| BitTorrent and maybe porn sites and this only seems to cover
| the last of those.
| whiteboardr wrote:
| Actually surprised how this only shows up on HN now.
|
| Expected this to take the top spot right after the keynote.
| bhaavan wrote:
| Does this mean that all DDoS mitigation techniques need to exist
| before the exit node of this traffic? Which in turn mean, that
| everyone needs to outsource their DDoS mitigation to Apple.
|
| Also the corollary would be, that anyone who is able to bypass
| the protection mechanisms Apple has in place to control DDoS, can
| use it to DDoS a service like Google, Microsoft and get the
| entire service banned for all iCloud+ users. Right?
| gjsman-1000 wrote:
| Apple has sort of addressed this with only having it work with
| Safari and other apps that implement the API, rather than
| system-wide as something you can connect to. It's probably
| going to take a lot of reverse engineering before hackers
| figure out the API and how to get third party devices to
| connect and authenticate, if at all. If you can't get third
| party devices to connect, you are missing the first D in DDOS.
| mariojv wrote:
| There is also almost certainly an authentication mechanism in
| place, even if you were to reverse engineer the API. You'd
| need a bunch of paid iCloud accounts to have a DDoS be at all
| feasible with this service.
|
| Additionally, Cloudflare themselves, one of Apple's third
| party partners, offer DDoS protection services. Because they
| see all the exit traffic, they'd be able to detect the DDoS
| and block it.
| Ensorceled wrote:
| That's why this concern seemed weird to me; the exit nodes
| ARE the DDoS protection services.
|
| I can't see Cloudflare putting themselves in the position
| of needed to protect their clients from themselves ...
| gjsman-1000 wrote:
| Otherwise, by the poster's logic, why hasn't CloudFlare
| been a DDoS vector?
| Ensorceled wrote:
| Why are you assuming this can, and will, be readily used as a
| DDoS vector?
| Operyl wrote:
| So far the two different third parties I've seen are Cloudflare
| and Akamai. Has worked relatively well here, besides the fact
| that some bug has made it so it turns back on randomly, which
| isn't a big deal.
| soheil wrote:
| This could also mean now major companies security teams have even
| more incentive to track onion routing users and to check their
| pattern of traffic to ensure they are legitimate Apple users and
| not some tor user instead of just blanket-blocking every tor
| user. This could make tor less secure in the long term if more
| open source/closed source projects (NSA notwithstanding) are
| started and dedicated to analyzing and delayering tor traffic.
| vngzs wrote:
| From Apple's statement[0]:
|
| > The first assigns the user an anonymous IP address that maps to
| their region but not their actual location. The second decrypts
| the web address they want to visit and forwards them to their
| destination. This separation of information protects the user's
| privacy because no single entity can identify both who a user is
| and which sites they visit.
|
| Apple is not saying nobody can deanonymize you - they are being
| very careful to only state that no single entity can deanonymize
| you. Hence you should still assume this is not a good protection
| against any entity with subpoena power, or the ability to compel
| the cooperation of Apple and their 3rd-party egress relay
| providers.
|
| [0]: https://9to5mac.com/2021/06/07/apple-icloud-private-relay-
| fe...
| allochthon wrote:
| That makes me wonder whether an analysis could be done over a
| long period of time to determine where in the region the user
| isn't, and thereby narrow down where the user is.
| bjtitus wrote:
| I'm curious what the details around the anonymous IP address
| assignment are. Protecting copyright holders seems to be the
| point of the IP assignment to not break content restrictions.
|
| Are they able to assign a set for an entire country? If so,
| that doesn't narrow it down all that much. However, major
| league sports blackouts wouldn't work, so is it by city?
| ROARosen wrote:
| > or you can view it as a concession to reality: If Apple didn't
| do this, the video providers would block their exit nodes, as
| they do with any VPN provider that gets large enough for them to
| notice.
|
| I seriously doubt any reasonable video streaming service would
| cut off such a huge chunk of their user base just because they
| are using an iPhone.
| grantcox wrote:
| I expect they would just show a message "to view our content,
| download our app - Safari is not supported"
| spideymans wrote:
| But when you download the app: "please use safari to pay for
| subscriptions" :)
| modernerd wrote:
| > It's not clear if the API will be public for other browsers or
| applications to use.
|
| Apple has already confirmed that other app traffic will go
| through iCloud Private Relay "no matter what networking API
| you're using", with some exemptions:
|
| > Not all networking done by your app occurs over the public
| internet, so there are several categories of traffic that are not
| affected by Private Relay.
|
| > Any connections your app makes over the local network or to
| private domain names will be unaffected.
|
| > Similarly, if your app provides a network extension to add VPN
| or app-proxying capabilities, your extension won't use Private
| Relay and neither will app traffic that uses your extension.
|
| > Traffic that uses a proxy is also exempt.
|
| From https://developer.apple.com/videos/play/wwdc2021/10096/.
| ls612 wrote:
| So will this mean if I'm using Cloudflare 1.1.1.1 that I won't
| get the iCloud private relay since they implement DoH as a VPN
| in iOS?
| jedisct1 wrote:
| DNSCloak still works with Private Cloud.
| firloop wrote:
| Not super familiar with 1.1.1.1, but I use NextDNS and it's
| no longer implemented as a VPN - they use the native iOS
| encrypted DNS feature. I wonder how iCloud Private Relay
| works with that.
| richbradshaw wrote:
| I have the beta and it currently doesn't appear to work.
| beermonster wrote:
| This is interesting. I think overall I approve as it benefits
| people by default.
|
| It does mean you now have to trust Apple since that's the first
| hop. However you're already doing this when you spin up your AWS
| Lightsail Wireguard instance, say. AWS can see ingress and egress
| traffic and so you just need AWS to not be part of your threat
| model. Same here. Though I dont see this as too much of a problem
| since it applies to devices and services where you've already
| made this explicit choice.
|
| The app limitation thing is a shame and hopefully there will be
| an API at a later date.
|
| The exit node choice based on exit-locality kinda makes me think
| Apple either:
|
| - Want to restrict this service being (ab)used for geolocked
| content (Netflix etc)
|
| - Want to speed up the service by providing the closest exit node
| (Performance)
|
| Of course given all the FBI cases, you also have to consider
| other possibilties for the creation of this service.
| joshstrange wrote:
| Craig Federighi, on the most recent episode of The Talk Show
| with John Gruber [0] about 47 minutes into the episode, talked
| about this and I think both your assumptions are correct. For
| the first one I'm sure they didn't want to deal with the
| complexity of picking an exit location nor did they want to be
| a party to getting around geo-locking and so this gave them the
| best of both worlds, no UI and no issue with geo-blocking. For
| the second point I think that is also the reason as well as
| it's often helpful if a website knows your general location
| (For relevant recommendations, CDN routing, etc) but we'd
| prefer if the website didn't know exactly where we are coming
| from (IP-wise) which can be used for tracking/ads.
|
| [0] https://daringfireball.net/thetalkshow/2021/06/11/ep-316
| Brajeshwar wrote:
| Does this compare to NextDNS[1]. I moved from Pi Hole[2] to
| NextDNS and I'm happy with it.
|
| 1. https://nextdns.io
|
| 2. https://pi-hole.net
| KMnO4 wrote:
| Just curious, are you on the free tier? Just wondering if 300k
| queries per month is sufficient for the average person. I have
| no reference to base that number on.
| gnicholas wrote:
| I'm on the free tier and haven't hit the cap.
|
| I've also found that I still get creepily-targeted
| advertising, which is presumably based on IP. For example, I
| watched a youtube video in Firefox Focus on my iPhone. Later
| that day, I saw a youtube recommendation for a very similar
| video (on a topic that I do not ever engage with, except for
| the single video earlier that days) on my laptop, in Safari.
|
| I use NextDNS on both devices. It's nice, but it's not a
| silver bullet.
| decrypt wrote:
| I was on the free tier but hit 300k requests in roughly 25
| days. My primary smartphone, laptop, and parents'
| smartphones. Upgraded to NextDNS, happy customer for an year
| but jumped ship to pihole. Have two pihole devices on the
| Tailscale network. NextDNS was great. Checks all of my
| requirements. Just wanted to support open source software. I
| donate to pihole often instead.
| Brajeshwar wrote:
| I'm on the paid tier. I pay the yearly subscription. Our
| family of four (2 kids) easily hit 1+ Million queries a
| month.
| marceldegraaf wrote:
| No. NextDNS and Pi-Hole serve DNS requests and are mainly used
| for ad blocking and content restrictions on your network. They
| don't tunnel or redirect your actual internet traffic the way a
| VPN does.
| yegor wrote:
| Shameless self-plug: NextDNS does not, but ControlD does do
| that - https://controld.com
| corobo wrote:
| Your service seems to support the same features as your
| provider -- are you 1:1 reselling or do you add stuff?
| yegor wrote:
| Not sure what you mean by that. The features are not the
| same, see https://kb.controld.com/compare
| lucasverra wrote:
| This is the correct observation.
|
| - A nextDNS user having that same question answered by
| official team
| arnvald wrote:
| Oh, that's interesting. What convinced you to switch? Not
| having to host it yourself or some specific features?
| aPoCoMiLogin wrote:
| i'm not the OP but I think it might be the issue with
| exposing pi-hole to the internet to access the dns outside of
| your home network. nextdns is cheap, i'm using it on all my
| devices, without the hassle to expose pi-hole to the
| internet.
| Brajeshwar wrote:
| More of Not Hosting it Myself. NextDNS is cheap enough and
| does the work really well. Part of my lifestyles
| simplification, especially when it comes to critical
| services.
|
| Had few instances where some websites do not work when ad
| scripts are blocked. I had to debug while traveling and my
| wife is not too keen on tinkering with the Raspberry Pis.
|
| NextDNS have similar issues, lots of newsletter
| unsubscription just fails. For NextDNS, I can just ask my
| wife, "Click that Shield Icon and Disable for sometime." For
| Mobile devices, "Open NextDNS and slide the Disable button."
| basisword wrote:
| I'm currently running the beta and this doesn't work on my router
| (provided by one of the largest ISP's in the UK). When I go to
| settings it displays a message that the router is unsupported by
| private relay. Hopefully it's something they can fix before
| launch but if not I wonder how many other routers are
| unsupported?
| dcow wrote:
| Isn't iCloud+ "VPN" (Private Relay) just white-labled Cloudflare
| Warp? Is "onion router" a new development or is Jerry
| overzealously inferring there's more than meets the eye here?
| ComodoHacker wrote:
| >why don't VPN providers implement a onion router
|
| ProtonVPN does.
| Grustaf wrote:
| > An big tradeoff for some is that the exit node is always chosen
| to be in the same geo location as the entry node. You can view
| this as a sop to the various on-line video providers
|
| How could it be a "sop" to video services, isn't it exactly what
| they want, no more no less?
| pwinnski wrote:
| What video services really want is for each user to be
| identifiable by IP address. This doesn't quite give them that,
| but it does region-lock them.
| Grustaf wrote:
| Why do they want that though? They can still remember you,
| right, since you're logged in?
| pwinnski wrote:
| Not all media sites require one to be logged in.
|
| However, there are _many_ reasons why a video service might
| want each user to be individually identifiable by IP.
|
| - Many media items are contractually region-locked
|
| - The same user from too many simultaneous IPs might mean
| shared credentials, a perceived loss of revenue
|
| - The same user from geographically disparate IPs might
| also mean shared credentials, even if not simultaneous.
|
| I'm sure there are more.
| vmception wrote:
| Apple should release a token for the routing nodes to stake and
| get slashed for poor quality connectivity
| a-dub wrote:
| sounds awesome! tor as a system service with a professionally
| managed network. beyond making ad tracking harder, i wonder what
| sorts of new application spaces this may open up. i can already
| think of one! (and no, it's not some shady illegitimate/illegal
| bs)
| fossuser wrote:
| I was curious how they would actually implement this, if it's
| actually onion routing that's pretty cool.
|
| I wonder what advantage this gives over using NextDNS?
| peddling-brink wrote:
| NextDNS is encrypted DNS. DNS is like using your neighbor
| across the street for all your directions, except you have to
| shout.
|
| "YO, WHERE'S THE GROCERY STORE AGAIN? ALSO AFTER THAT I'M
| VISITING THE STRIP CLUB, AGAIN."
|
| NextDNS turns that shout into a signal/telegram message, to a
| different neighbor. There's still a neighbor involved, but at
| least the neighborhood doesn't get to hear anymore.
|
| If they include DNS in the onion routing scheme, it turns into
| a game of telephone, where the neighbor doesn't know you
| anymore.
|
| Your traffic, and directions become more private.
| xnx wrote:
| This is great. I hope this spurs Google to make their VPN
| (https://one.google.com/about/vpn) more widely available. A few
| audiences they could expand it to: any ChromeOS device, any Pixel
| phone, any Android phone, any mobile Chrome user, any Chrome
| user.
| crossroadsguy wrote:
| They'll release that as a Chrome app.
| irae wrote:
| A lot of people think of VPN as escaping Google mega-giga-
| tracking schemes. So growing their own would be doomed to fail.
| unknown_error wrote:
| Because Google is definitely the most trustworthy company when
| it comes to data governance and respecting user privacy. No
| chance they'd use it to put you into a FLoC-type thing,
| benefiting their own advertising business while shutting out
| competitors.
|
| Google, the engineering company, always plays second fiddle to
| Google, the advertising company.
| xnx wrote:
| I trust Google and Apple 100x more (low estimate) than I do
| Comcast/Verizon, AT&T, etc.
| foobiekr wrote:
| I agree on the Apple, but not on Google. AT&T, Comcast,
| Verizon, Deutschetelekom, British Telecom, NTT, etc. Have
| spent the last 15 to 20 years being absolutely deskilled by
| people leaving for better jobs in the hyperscalers. If
| you're worried about any telecom carrier looking at your
| traffic then all you need to do is make sure that encrypted
| client hello and DNS over HTTPS are used by the devices
| that you have. The products that they use to do deep packet
| inspection are all falling apart at this point and since
| they have no internal technologist they are busy asking
| vendors to fix it for them, and the vendors can't fix it
| either.
|
| Worrying about the carriers was really hot for a while
| especially post Snowden, but it's really not a genuine
| threat.
| unknown_error wrote:
| True.
| dmitriid wrote:
| Meanwhile even Google's employees don't know what data
| Google collects, how to turn it off, and de-google their
| phones. A thread with unsealed documents:
| https://twitter.com/jason_kint/status/1398353211220807682
| LegitShady wrote:
| I don't trust google and apple equally. I trust google
| about the same level as comcast/etc.
|
| apple having less advertising influence is more
| trustworthy, I think, in terms of privacy. don't lump
| google in with them.
|
| Meanwhile apple has many many anti consumer anti
| competitive policies so while I may trust my privacy with
| them more, I wouldn't trust them to fight for my privacy
| rights in the long run.
| smoldesu wrote:
| To be fair, Apple's software has always played second fiddle
| to their hardware. I trust Apple with a VPN about as much as
| I do Google.
| unknown_error wrote:
| They don't have an inherent conflict of interest the way
| Google does (advertising vs privacy in the same company).
| The App Store makes them plenty of money, and if anything,
| enhancing user "privacy" by limiting access of other adtech
| vendors only strengthens their walled garden and increases
| revenue. Even something like Fortnite or the Epic store...
| as long as they can dictate their entire stack from
| hardware to software (very much unlike Google + OEMs +
| third-party stores), they'll have a huge advantage over
| Google in terms of being able to limit your personal info
| being used by third parties, while still retaining it for
| their own use.
| nuker wrote:
| I hope it'll not bring captcha hell, as Google does for using
| VPNs. Twitter is simply blocking my VPN provider. eBay sends
| scary email every time I login.
| acdha wrote:
| This will come down to reputation. VPN providers which don't do
| a good job managing abuse from their networks get blocked a lot
| more readily than better run networks, and in this case they'd
| be able to make pretty strong assurances that they can link
| activity to a single user.
| xnx wrote:
| Because Apple is so large and well respected, issues will be
| blamed on whoever is putting up the captcha, not Apple.
| NorwegianDude wrote:
| You can disable the captcha by paying the site a 30 % cut of
| the purchase price of the Apple device and the subscription./s
| jameshart wrote:
| Interesting. I thought I recalled talking about this on HN
| previously:
|
| https://news.ycombinator.com/item?id=10355868
| _-__--- on Oct 8, 2015 | parent | favorite | on: Verizon revives
| "zombie cookie" device tracking on... Tor as an OS-
| level feature may not spark the best reaction. It's been given a
| bad name ("deep web," silk road, etc) in mass media and many
| people don't understand it enough to think of it as anything
| other than bad. I think that it'd be cool to have, but I
| don't think that Apple would ever implement it.
| jameshart on Oct 8, 2015 [-] Agree, it's
| phenomenally unlikely, but then again there is a part of me which
| could actually imagine Apple doing something like it. They
| wouldn't use Tor, of course, they'd build a proprietary
| equivalent, and then come out on a black stage to 'introduce
| Apple Undercover, a revolutionary enhancement to personal network
| privacy and security'.
| Legion wrote:
| I love the moments when you can point back to an old post and
| say, "called that!"
|
| (No snark, I really do love it.)
|
| Enjoy the moment, future seer.
| amznthrwaway wrote:
| I mean, he also said it was phenomenally unlikely.... Maybe
| 1/2 a point.
| headmelted wrote:
| Your prediction of it being called Apple Undercover is
| _significantly_ more 80's though. And I like it.
|
| So much so that I would accept Apple using something other than
| Helvetica this one time for a Miami Vice typeface and a Michael
| Knight and Kitt intro at WWDC.
|
| I cannot stress enough that Hasselhoff needs to stay in
| character the entire time or the whole concept doesn't work.
| mkr-hn wrote:
| Hasselhoff drifts on to stage in KITT, jumps out, and tackles
| Tim Cook. They then get up, shake, laugh, and take turns
| explaining how iCloud+ VPN makes it look like everything you
| do online comes from Apple.
| headmelted wrote:
| He may sing in German as the musical guest they sometimes
| have at the end of the keynotes, but that's as much
| flexibility as I'm willing to allow.
| mkr-hn wrote:
| Can William Daniels at least voice the car saying "one
| more thing" before throwing it to Hasselhoff?
| MobileVet wrote:
| The Hoff MUST sing 'Jump in my car' for this to really
| land.
|
| https://youtu.be/dm7jEA3frY4
| tobr wrote:
| > I would accept Apple using something other than Helvetica
|
| At this point, Helvetica itself would give a retro feeling if
| used by Apple. They've been all in on San Francisco for
| several years.
| watersb wrote:
| Nobody goes there anymore. It's too crowded.
|
| https://imgur.com/gallery/2eBXYnT
| mikeiz404 wrote:
| No offense or anything but what's the point of making this
| comment outside of showing that you were right? Good
| prediction.
| jameshart wrote:
| (Fair question. I just found it amusing. I'm annoyed it got
| voted to the top. For substantive discussion, people should
| look down page)
| shoto_io wrote:
| Hey there, can I call you? I have some questions about the
| future!
| toxik wrote:
| An even more impressive prediction in 2015, a time when Apple
| was not positioned as some type of savior of user privacy.
| jameshart wrote:
| I'm not so sure. If you read back up that thread, the thought
| that triggered it was from qzervaas: Apple's
| already shown they don't like this behaviour with their
| randomised MAC addresses in iOS 8+.
|
| And elsewhere in the thread people called out the fact apple
| had already introduced support for ad blocking. So Apple's
| privacy-positive posture was already in the air.
|
| I think there is a sense in which privacy was already a
| differentiator for Apple in iOS (as contrasted with Google's
| motives in android in particular of course) - so this did
| feel like a not completely implausible way they could go to
| double down on that differentiator.
| simonh wrote:
| Steve Jobs talking about this at D8 in 2010, and of course
| the privacy features he talks about were baked into the OS
| APIs from the start.
|
| Apple's rift with Google over user data collection in
| Google Maps goes back to 2009 when Google held Apple to
| ransom for the user data in return for turn-by-turn
| directions. Apple refused and started building their own
| maps service, buying Placebase in July that year.
|
| https://www.youtube.com/watch?v=39iKLwlUqBo
| shaicoleman wrote:
| If anyone's interested in reading more, here's an article
| which discusses why Apple switched from Google Maps:
|
| http://allthingsd.com/20120926/apple-google-maps-talks-
| crash...
| hlau wrote:
| I actually wrote a deep dive on Apple's pivot to privacy.
| https://saturation.substack.com/p/apple-facebook-and-the-
| glo...
| tialaramex wrote:
| It's really not about privacy though, the insight needed (not
| that I'm saying it was easy to make this particular
| prediction) is that Apple is all about the Walled Garden. It
| can't be Tor because Apple doesn't own Tor, and so that's not
| inside the Walled Garden, whereas "Apple Undercover" even if
| it were functionally no better or worse than Tor, is
| magically blessed by the Apple branding. And Apple have been
| all about Walled Gardens for decades.
| yarcob wrote:
| Tor has reputation problems. Lots of services block tor
| exit nodes because of all the abuse that comes from them.
|
| By making it a feature for paying subscribers only, Apple
| probably hopes that their solution won't be interesting for
| criminals. (Apple will likely cooperate with law
| enforcement)
| [deleted]
| [deleted]
| nabla9 wrote:
| Apple is in crossfire:
|
| (a) There is pressure from many governments to give backdoor
| for surveillance. Or just comply with subpoenas that are
| against human rights.
|
| (b) Complying with local laws generates PR damage. It makes
| privacy and ethics as a brand strategy look disingenuous.
|
| The solution is, of course, to generate truly secure system
| where Apple can't make backdoors. Those services may not be
| available in some countries, but then it's just missing
| service, not a compromised system.
| gjsman-1000 wrote:
| This is something Apple is increasingly working on. For
| example, in Fall 2020 they actually revised their CPU designs
| (including older CPUs) with a new Secure Enclave design that
| uses mailboxes to more securely store the number
| authentication attempts inside the secure enclave.
|
| The goal of this is to make it so that even if the FBI had an
| incident similar to 2016, Apple would not be able to fulfill
| their request to make a backdoor, and the FBI wouldn't be
| able to make a backdoor even if they had the power to sign
| and run any code they wanted on the phone.
|
| That's how you make a secure system these days. You can't
| just make it secure to everyone but yourself and fight the
| government - you need to secure it from yourself as well.
| shard wrote:
| That only works if you don't give control of the servers
| over to a third party and also use encryption on the
| servers. Which Apple has not been able to do across the
| board.
| matt-attack wrote:
| Wow props for quite a prediction. You definitely deserve some
| recognition for that one.
| gordon_freeman wrote:
| Does anybody know, how iCloud+ VPN would compare with Cloudflare
| WARP in terms of better privacy protection.
| dustyharddrive wrote:
| Don't forget that neither is a pure VPN, though that's not
| always a bad thing -- Private Relay is better than a VPN
| because onion routing means "no one party"[1] can correlate
| your connections and identity.
|
| However WARP, being more like a VPN, requires you to trust
| Cloudflare to not log DNS lookups / the servers you connect to
| and associate that with your origin IP.
|
| Why do I hesitate to call WARP a real VPN? It reveals your
| actual IP address to websites you visit via X-Forwarded-For.
| [2]
|
| Also I think the fact that iCloud Private Relay will be built-
| in makes it more private than WARP -- more users' traffic will
| come out of each node.
|
| [1]: Obviously this is imperfect because the Apple (which knows
| your IP) and third-party (which knows the network traffic)
| nodes will likely be in the same jurisdiction as each other,
| subject to the same laws, as mentioned by other commenters.
|
| [2]: https://twitter.com/eastdakota/status/1176987146177196032
|
| edit: typo, line break, clarified Private Relay concept
| GoofballJones wrote:
| I liked this little article as it reminds me of when the Web was
| still young and mainly just text with no formatting or graphics
| yet. Takes me right back to 1991!
| [deleted]
| defaultname wrote:
| https://developer.apple.com/videos/play/wwdc2021/10096/
|
| A pretty decent overview of the scope of the product.
|
| As mentioned in the video, the service also is involved if your
| app does HTTP over port 80, offering at least some marginal level
| of improvement. Otherwise it leaves your app traffic as is.
|
| As to Mail, the linked comment mentions that but I don't remember
| it being a part of the solution (nor does it seem feasible that
| it could be). Apple offers privacy improvements in mail, but not
| via the private relay.
| floatingatoll wrote:
| https://developer.apple.com/wwdc21/10085
|
| Privacy Relay is also discussed in the privacy pillars video
| for a few minutes, starting at 24m30s.
| Jyaif wrote:
| To be exact, the video says that it includes all insecure HTTP
| traffic, so if you use HTTPS for now you are saved.
| neximo64 wrote:
| It just re routes traffic to your nearest Fastly pop and mixes
| traffic up with everyone else nearby.
| judge2020 wrote:
| It specifically goes through an Apple proxy first and fastly
| (or other partners like Akamai and Cloudflare) don't see the
| incoming IP address.
| theonlybutlet wrote:
| I'm curious how does the second hop work? are the third parties
| contracted by Apple to provide the service? What's in it for
| them?
| res0nat0r wrote:
| Is this like Cloudflare Warp then?
|
| https://1.1.1.1/
| alpb wrote:
| the beta seems to be using Warp actually.
| pilif wrote:
| My experience with this so far was... mixed.
|
| - This breaks DNS resolution for company-internal domains.
|
| - This routes all my traffic through CloudFlare or another CDN I
| might or might not trust (yes, the IP is hidden, but not the
| data)
|
| - it significantly slows down my internet access on my location.
|
| - it tends to turn itself on again without my intervention
|
| especially the last point is very problematic for me
| defaultname wrote:
| To use it you're clearly using early beta software. Clearly it
| isn't going to "turn itself on again".
|
| I turned it on and actually forgot I did. Performance is decent
| here. I mean _of course_ it 's going to be worse than native,
| but that's the compromise.
|
| As to trusting Cloudflare -- what do you mean? You understand
| your connection is still TLS end-to-end encrypted (presuming
| that's what we're talking about), right? I mean...presuming the
| site your talking to isn't using Cloudflare SSL. In no way does
| this reduce that security. If you're talking about HTTP, well
| everyone in between can already see that.
| kerng wrote:
| [Clearly not turn itself on.]
|
| Funny story, I was shocked and quite annoyed that an iPhone
| automatically turns on Wifi and stuff every day by itself -
| even if you turn it off...
|
| Still dont know how to actually turn it off
| mvanbaak wrote:
| If you disable it from the control center thingie overlay
| it even states that is only for this day ...
|
| If you disable it from settings, it stays off.
| klaushardt wrote:
| If you tap the wifi button in your controll center it just
| turns it off for 24 hours or when you switch locations. If
| you turn it off in the Settings App then it stays off.
| permo-w wrote:
| if you disable from quick menu, it turns back on. if you
| disable from settings, it doesn't
| nucleardog wrote:
| And when you do so it does flash a message along the
| lines of "Disconnecting nearby wifi until tomorrow".
|
| Which makes it pretty clear it's not a wifi kill switch
| but just a "my current connection is shit, let me use
| cellular" button.
| marmaduke wrote:
| > Clearly it isn't going to "turn itself on again"
|
| Why is it so clear? An iPhone hotspot turns itself off as
| soon as a device disconnects, with no option to leave it on,
| presumably for security or battery reasons.
| gjsman-1000 wrote:
| It directs to an Apple server, then CloudFlare, so considering
| it's basically a double VPN speed decreases have been
| reasonable.
|
| The fact they can see unencrypted HTTP data is a downside with
| all VPNs. At least you have the double hop going in your favor.
|
| As for turning on by itself, it's annoying, but it is the very
| first developer-only preview so I'm not complaining yet.
| yunohn wrote:
| > This breaks DNS resolution for company-internal domains.
|
| Is this not the case for any VPN or proxying service? In fact,
| it could even be a security flaw if your internal domains were
| accessible on external VPN style endpoints?
| gjsman-1000 wrote:
| Also it's developer preview 1. People like the OP who gripe
| about bugs on such an unfinished product are the reason why
| Apple doesn't make those first builds available to anyone but
| their registered developers for the first month.
| krageon wrote:
| > Is this not the case for any VPN or proxying service?
|
| No, it's not.
|
| > In fact, it could even be a security flaw if your internal
| domains were accessible on external VPN style endpoints?
|
| It would be, but then this is not something that happens on a
| network configured in the way you describe.
| krferriter wrote:
| It is for any VPN client that routes DNS traffic through
| the VPN as well as HTTP and other web traffic. It's not out
| of the ordinary for this to happen.
| yunohn wrote:
| I use NordVPN. It specifically has an opt-in setting to use
| locally discovered DNS in favor of their in-network DNS.
| This is crucial since out-of-network DNS can leak activity.
|
| I'm not sure what kind of network you believe I described,
| but would be useful to have a clearer explanation from you.
| defaultname wrote:
| "No, it's not"
|
| The root's observation is that it doesn't use the machine
| configured DNS. The overwhelming majority of VPNs also
| don't use the machine configured DNS. Maybe not "any", but
| if you're using a VPN you're generally going to want your
| DNS going over it as well.
|
| But it is worth noting if you're on a corporate network, or
| if you use a DNS solution like NextDNS -- when you turn on
| PR those no longer play a part, at least to Safari traffic.
| williamtwild wrote:
| "yes, the IP is hidden, but not the data"
|
| Using TLS it certainly should be.
| stock_toaster wrote:
| Does it work like an https proxy (with CONNECT) or a socks
| proxy?
|
| Because if it is instead actually unwrapping the connection
| somehow (eg. mitm) then they would be able to see the
| content, and that seems like a huge no-go -- both for the
| users, AND for apple as I would think it would open them up
| to liability.
|
| note: they certainly would be able to see unencrypted http
| traffic regardless though.
| EveYoung wrote:
| Does Apple preserve the client source IP in the request
| (similar to Cloudflare's VPN) or will the server only see the
| IP of the exit node?
| dividuum wrote:
| The whole point of the service is to hide the client source
| IP.
| EveYoung wrote:
| Not necessarily. I thought it was mainly about encrypting
| traffic in untrusted networks. Cloudflare already does it
| like this in their VPN service.
| dividuum wrote:
| Correct. I guess it wasn't really obvious from the linked
| mail. The introduction video at
| https://developer.apple.com/videos/play/wwdc2021/10096/
| is a lot clearer.
| defaultname wrote:
| Not sure why you said correct, as it's both. A big part
| of private relay -- I would say the most significant part
| -- is to allow people to talk to websites without giving
| up their personal IP (and from that pretty tight
| geolocation, and with fingerprinting a correlation with
| loads of other data they collect). Apple makes a big deal
| about it being about maintaining privacy, not just
| against snooping of traffic -- which is unlikely -- but
| against fingerprinting and targeting from the services
| and sites you connect to.
|
| And to answer the original guy, no Apple does not add any
| headers or details to tell the destination what your IP
| address is. They just see that they're talking to an exit
| node somewhere approximal of your general region.
| wolverine876 wrote:
| > the IP is hidden, but not the data
|
| Isn't the great majority of your traffic HTTPS?
| xiphias2 wrote:
| > This breaks DNS resolution for company-internal domains.
|
| Why would it? The WWDC developer video clearly states that it's
| only for public domains.
| ec109685 wrote:
| I believe the DNS requests are routed through their ingress
| proxy, so there's no chance to hit an internal split horizon
| DNS server.
___________________________________________________________________
(page generated 2021-06-16 23:00 UTC)