[HN Gopher] Apple's iCloud+ "VPN"
___________________________________________________________________
 
Apple's iCloud+ "VPN"
 
Author : n1000
Score  : 771 points
Date   : 2021-06-16 12:05 UTC (10 hours ago)
 
web link (www.metzdowd.com)
w3m dump (www.metzdowd.com)
 
| bitcurious wrote:
| Correct me if I'm wrong, but as I understand it a two-hop onion
| network is still trivially breakable with (two) warrants,
| especially since both Apple and Cloudflare/etc., are US
| companies. Which would make it a VPN in the duck-type sense.
 
  | gjsman-1000 wrote:
  | It depends, whether they do no logs. There are many VPN
  | providers in the US which don't have logs, so that if they are
  | subpoenaed, they have nothing to give.
  | 
  | The beauty of Apple's double hop is that if one partner was
  | hacked, secretly wiretapped, or had lied about not keeping
  | logs, your connection would still be private.
  | 
  | But, that assumes that nobody on this network is keeping logs.
  | If they are, then it could be theoretically possible to piece
  | them together. However considering Apple's marketing with
  | privacy, it would be interesting to see whether they keep logs
  | on each endpoint or not.
 
    | heavyset_go wrote:
    | > _It depends, whether they do no logs_
    | 
    | Courts can compel them to keep logs.
 
    | nojito wrote:
    | What would the logs contain?
    | 
    | I believe everything is encrypted on device before being sent
    | to Apple.
 
      | TedDoesntTalk wrote:
      | Timestamp, source and destination ip addresses, username.
      | In the case of the exit node, url.
 
        | nojito wrote:
        | Only the timestamp and username would be available from
        | Apple.
 
        | krferriter wrote:
        | Source IP address and next-hop IP address would be as
        | well.
 
        | nojito wrote:
        | Source on the next hop address?
        | 
        | Apple doesn't know where you're going.
 
        | NorwegianDude wrote:
        | They shouldn't know about the end destination, but
        | they'll know your traffic was sent to eg. Cloudflare or
        | whatever.
 
        | nojito wrote:
        | I would think they batch together all the IPs and pass it
        | off.
        | 
        | It's in Apple's best interest to keep the bare minimum
        | information they need from their end-user.
 
        | gjsman-1000 wrote:
        | We don't know that Apple keeps logs. These are things
        | they could theoretically keep, but we don't know if they
        | store them or not.
 
        | LegitShady wrote:
        | If they don't clearly state 'no logs' then its unlikely
        | they are not logging. My bet is they're logging
        | everything, because they have no advantage in not
        | logging.
 
    | wolverine876 wrote:
    | > There are many VPN providers in the US which don't have
    | logs
    | 
    | Many claim they don't have logs, and my understanding is that
    | it has been sometimes revealed that they do have logs. Also,
    | how do you run a server without logs? Many think those claims
    | are BS.
 
  | path2power wrote:
  | If your threat model includes state level actors, there is no
  | commercially available solution that will make you 100% safe.
  | This is about privacy from private corporations and making it
  | more difficult and more costly for governments to get your
  | data. But the latter is always possible when you use the web.
 
    | bitcurious wrote:
    | >If your threat model includes state level actors
    | 
    | My personal threat model doesn't include state level actors,
    | but if it did I would certainly differentiate between a
    | solution that the NSA can break with some expense and one
    | that my local police department can break with a warrant.
    | 
    | My actual threat model is advertisers, so I think the Apple
    | solution is quite elegant and will serve me well. It
    | shouldn't be conflated with TOR though.
 
  | atonse wrote:
  | That's the beauty of this. Party 2 only knows Apple's IP. Apple
  | doesn't know what site you're visiting.
  | 
  | So how do you assemble "all traffic to this site" even by
  | subpoenaing both parties?
 
    | lxgr wrote:
    | To party 1: "Give us a netflow log of all of this user's
    | traffic." To party 2: "Give us a list of all outbound
    | connections matching this netflow list of inbound proxying
    | requests."
    | 
    | It would work the other way around as well (going from
    | visited sites to a given Apple id). If you can monitor all
    | nodes in an onion routing network, you can deanonymize
    | everybody.
 
      | gjsman-1000 wrote:
      | Well, here's the catch. Even if logs were kept, the 2nd
      | party as far as we know does not have a unique identifier
      | passed onto it.
      | 
      | This means that Apple's logs would say this user
      | authenticated and passed some encrypted stuff to Fastly,
      | and Fastly would say that it received requests from Apple,
      | without an identifier to match it up against the first
      | request.
      | 
      | Once this scales and Apple has millions of requests
      | incoming, there will be no way to conclusively prove that
      | two requests are the same.
      | 
      | In which case a double subpoena is again useless. And this
      | assuming they keep logs - if they don't keep logs, which is
      | more likely, it's even more useless.
      | 
      | This also aligns with something we currently know. Apple
      | says they can't see your requests. This implies that they
      | just pass data along in an encrypted format to their
      | partners. So all Apple does is make it so their partners
      | don't know your device, and the partners ensure Apple
      | doesn't know your request.
      | 
      | Ultimately, even if logs were kept, there would have to be
      | a unique identifier of some sort that was passed on to the
      | second server from the first server to break the system.
      | You decide the odds that they did that. Sounds a lot like
      | an IP Address, in which case why not just build a classic
      | VPN?
 
        | opheliate wrote:
        | Surely some "unique" identifier is required for each TCP
        | session between Apple and the exit node so that Apple
        | knows where to send the data it gets back, even if it's
        | just the port on which Apple connect to the exit node as
        | with standard TCP session management.
 
        | ska wrote:
        | How would that help you identify all of a particular
        | users interactions (rather than one)? Why would you
        | expect them to log it?
 
        | opheliate wrote:
        | If Apple logged (incoming IP from user, outgoing port to
        | exit node) pairs for each session, and the exit node
        | logged all requests, this should be sufficient to
        | associate all requests with a given user IP, right? Or am
        | I misunderstanding you?
        | 
        | I wouldn't expect them to log it, personally, I think
        | that can only lead to headaches down the line. My reason
        | for responding is just that I disagree that there is no
        | way for another party to associate all requests even if
        | Apple & exit node both fully cooperate and keep logs.
 
        | ska wrote:
        | We are thinking about this the same way. Individual
        | sessions don't do you much good, but there is
        | traceability iff both parties keep complete logs. Which
        | seems unlikely unless coerced.
 
  | [deleted]
 
| gjsman-1000 wrote:
| So far, partners of Apple I've seen the service forwarding to are
| CloudFlare, Akamai, and Fastly. There may be more but those are
| the ones I've seen and heard.
 
  | ehsankia wrote:
  | Wait a second, didn't the Fastly breakage happen the day after
  | WWDC? What are the chances that the one client was Apple and
  | their config was for this service :)
 
| freakynit wrote:
| Apple in a few months to VPN's: give us 30% share if you want to
| serve as exit node to Apple iCloud+ VPN.
| 
| Two part strategy as always:
| 
| 1. Get yourself in-between of an already functioning system, by
| force if needed 2. Abuse your market position to gain millions of
| users, make it super easy to use this as default, and make
| existing players compete for their 70% share of what they already
| were earning.
| 
| - Enjoy new billions on top of existing trillions
 
  | permo-w wrote:
  | This goes against my general distrust of giant corporations,
  | but I trust Apple a lot more than I do the extremely shady VPN
  | companies infesting the internet
 
| njacobs5074 wrote:
| Does anyone have pointers to info/articles about the countries
| that are on the "no VPN" capability list?
| 
| Some of them make sense to me, i.e. China which has a long
| history of censoring their citizens.
| 
| But in particular, I'm trying to find out why South Africa is on
| that list seeing as I live there.
| 
| Edit: In [1], Apple is quoted as saying, "We respect national
| laws wherever we operate" but did not elaborate further.
| 
| [1] https://mybroadband.co.za/news/internet/400893-apple-will-
| no...
 
  | gjsman-1000 wrote:
  | Another reason could also be that the servers operate in the
  | same nation that you are from. If Apple or no suitable partner
  | has servers in South Africa, that could also be a reason.
  | 
  | And, of course it could be politics. The South African
  | government, I wouldn't know, but it could be possible that they
  | wouldn't let tech companies from the US build servers in their
  | nation.
 
  | jammmety wrote:
  | Apple said it also will not offer "private relay" in Belarus,
  | Colombia, Egypt, Kazakhstan, Saudi Arabia, South Africa,
  | Turkmenistan, Uganda and the Philippines.
  | 
  | https://www.reuters.com/world/china/apples-new-private-relay...
 
| thih9 wrote:
| What's are the differences between a VPN and an onion router
| approach? Could anyone explain or link to an article?
 
  | thehappypm wrote:
  | A VPN is a middleman that accepts your traffic and forwards it,
  | hiding who you are to servers. An onion router is like a VPN
  | but instead of 1 middleman, the middleman is a whole random
  | network of middlemen, and those middlemen also hand off to
  | other middlemen.
 
    | mikemyoung1 wrote:
    | This is a great summary, thanks
 
    | permo-w wrote:
    | What I don't get is why people don't regard Onion Routers as
    | a form of VPN. It's still uses a virtual private network,
    | just more of them. a network of networks.
    | 
    | Surely TOR is a type of VPN?
    | 
    | Maybe there's some details I'm missing. I'm no expert
 
      | detaro wrote:
      | Really mostly convention. Yes you could label it that way,
      | but people consider it to be enough of it's own thing to
      | not do so. (+ there is some value in not conflating the two
      | because they do have different threat models etc and users
      | should treat them differently too)
 
| headmelted wrote:
| I've been trying to point this out to people but YouTube
| personalities have a louder voice than anyone else so you end up
| with bad information.
| 
| Props to Apple for offering an (albeit low entropy) onion router
| on their own infrastructure. I can't imagine this is going to win
| them any friends in government circles but it's definitely a step
| in the right direction.
| 
| I'd also really like to see Apple come clean about the iCloud
| backup encryption debacle. A lot of people are trusting it to be
| something it's not and it should really be clarified on-device
| what it is and is not before opting in.
 
  | yepthatsreality wrote:
  | Apple won't come clean until they can sweep it under the rug
  | like they did with the other debacles (see: keyboards). Being
  | honest about those things undermines their "Apple knows best"
  | image attempt.
 
  | ______- wrote:
  | > I'd also really like to see Apple come clean about the iCloud
  | backup encryption debacle
  | 
  | Are you referring to this article?:
  | 
  | https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
  | 
  | It's why I only use my Apple ID for grabbing apps from the app
  | store. I have disabled all the `cloud storage` features of
  | iCloud. iCloud is a privacy nightmare.
 
    | gjsman-1000 wrote:
    | By that logic though, Google Drive, OneDrive, AmazonS3, they
    | are all privacy nightmares. And you might agree, but Apple is
    | hardly alone.
    | 
    | And like the article says, they didn't want to poke the bear
    | anymore. Of course the FBI has congressional friends. It is
    | possible that Apple saw the risk of it backfiring and making
    | things worse as too great.
 
      | modeless wrote:
      | Google does end-to-end encryption of Android backups. And
      | Apple knows how to do it too, but they intentionally
      | restricted their implementation to only cover backups of
      | Keychain passwords and a few other things, apparently
      | because they don't have the courage to stand up to the FBI,
      | according to Reuters. Strange considering their public
      | stance against the FBI in the San Bernardino case and on
      | privacy issues in general. Especially since iCloud backup
      | totally defeats the highly touted end-to-end encryption in
      | iMessage.
 
        | gjsman-1000 wrote:
        | Yes, backups, and Apple should get on that. However, your
        | photos in Google Photos, your location data, your uploads
        | in Google Drive (equivalent to iCloud Drive OP is talking
        | about), not end to end encrypted and no option for it.
        | 
        | I think market share is another sign. Does anyone use
        | actual Android Backup, or do they use the unencrypted
        | "backups" in G Photos and elsewhere? For that reason
        | should the FBI care? Maybe I'm wrong but I believe actual
        | Android Backup is much less used than iCloud and
        | confusingly named alternative "backups" within Google
        | apps.
 
        | headmelted wrote:
        | Let's be really frank about it - no large company is
        | going to offer end-to-end encryption of photos because of
        | what kind of photos might end up on their infrastructure
        | if they do. And honestly I don't blame them _at all_.
        | 
        | I'd just like to see Apple be more transparent with this
        | one particular issue because it undermines so much of
        | what they're advertising to the consumer.
        | 
        | A transparency label for iCloud backup showing what is
        | and is not E2E before enabling would do. Most people
        | (myself included) would be quite happy with photos being
        | encrypted by an Apple-held key (I'm not worried about the
        | police seeing my boring lunch pics, I just don't want
        | photos of my kids being readily accessible to everyone
        | else).
        | 
        | It should be made clear if they're offering E2E for some
        | features that other settings will render it pointless is
        | all I'm saying.
 
        | smoldesu wrote:
        | Any large company can offer E2E encryption, as long as
        | they don't have extenuating interests that could make
        | them liable for the way I use their services. Unless
        | Apple is harvesting my data on the regular, they should
        | have no problem with me being the sole keyholder for my
        | iCloud account.
 
        | tgragnato wrote:
        | I think Apple would need to ship a different OS in China.
        | 
        | Cloud services offered there must store data in the
        | country and be operated by Chinese companies. (Apple is
        | complying with this)
        | 
        | But Chinese companies HAVE TO assist the authorities in
        | obtaining systematic access to private sector data. (This
        | is not possible with E2E for backups and photos)
 
        | dannyw wrote:
        | Are you really arguing that because child pornography
        | exists, no large company should offer ETE photos?
        | 
        | Despite there been reasonable solutions like bloom
        | filters and client sided hash detection, so that known
        | child abuse material can be detected, without it needing
        | to compromise the privacy of 99.99999% of users?
        | 
        | And that photos present some of the most sensitive
        | materials on your device:
        | 
        | - geo-IP location showing basically everywhere you have
        | taken a photo in, ever since the dawn of time
        | 
        | - people's consensual sex tapes
        | 
        | - photos of passwords, account recovery codes, private
        | keys, seed words
 
        | headmelted wrote:
        | I'm arguing that because it exists no company of Apple's
        | size is going to risk unknowingly hosting it, and I
        | wouldn't either if I were in their shoes.
        | 
        | I agree with you in terms of photos being some of the
        | most private information we have, but the E2E argument
        | doesn't ever get won by the tech community without a
        | guarantee of blocking/catching/preventing CP and being
        | able to make that evidence available for prosecution.
        | 
        | To the arguments above: Any processing server side
        | implies no real E2E. Any processing client side is by
        | definition under the control of the client and subject to
        | forgery/hacking/spoofing/tampering.
 
        | philwelch wrote:
        | > Despite there been reasonable solutions like bloom
        | filters and client sided hash detection, so that known
        | child abuse material can be detected, without it needing
        | to compromise the privacy of 99.99999% of users?
        | 
        | This is not a good argument. "Known child abuse material"
        | is the tip of the iceberg. There's nothing stopping
        | people from creating new "child abuse material", and the
        | people who are doing that sort of thing are the ones who
        | are more important to catch.
 
        | oarsinsync wrote:
        | > geo-IP location showing basically everywhere you have
        | taken a photo in, ever since the dawn of time
        | 
        | Geo-IP is the process of taking an IP address and
        | attributing an location to that IP address.
        | 
        | I think you meant GPS location?
 
        | vngzs wrote:
        | In the bloom filter example, what device calculates the
        | hash inputs for the bloom filters? If it's the server,
        | then the server needs a copy of the image to check. So is
        | it the client? If so, how can you prevent a malicious
        | client from forging their hashes to be those of known-
        | safe images?
        | 
        | Not saying it's not possible to build an E2E image
        | storage service that also has the protections society
        | tends to demand. Just saying that I haven't seen anyone
        | do it yet, because these problems are subtle.
 
        | encryptluks2 wrote:
        | There are encryption options, just not with the software
        | provided by the storage providers.
 
        | modeless wrote:
        | Look at the Reuters article they linked. iCloud backup is
        | the issue. Usage of iCloud backup and Android backup are
        | probably very similar (in percentage terms), why would
        | you expect that Android backup is used less? They are
        | pretty much equivalent features, except that one is end-
        | to-end encrypted and the other is not. In both cases,
        | photos are handled separately.
 
    | headmelted wrote:
    | Yep, exactly that.
    | 
    | I utterly agree that other direct-to-consumer options are in
    | the same boat - but Apple is quite heavy-handed in it's
    | messaging about, well, messaging being encrypted and private
    | and no-one (including Apple) being able to read your
    | messages. That's only true if you don't backup to iCloud.
    | 
    | I would expect most people on HN to be aware of all of this
    | of course but when you're so strongly selling your privacy
    | protections as part of your brand, it's a pretty glaring
    | window to leave wide open.
 
  | InTheArena wrote:
  | I have very little respect for Youtube personalities (thinking
  | of LTT in particular) when it comes to talking about Apple in
  | particular. They are so wedded to their "everyone, except us,
  | is evil" perspective that their knee-jerk reaction to almost
  | anything from Apple, privacy or otherwise is negative. (LTT
  | spent the first bit trashing Apple for making marketing claims
  | about the M1, instead of letting them do, then refused to back
  | off when numbers backed up their claims, continue to trash
  | anything with Apple and privacy, etc).
  | 
  | Apple is not without sin. If we get out of this entire epic
  | lawsuit (another company not without sin) with consumers
  | winning the ability to side-load, it's a win. But for the most
  | part, Apple has a multi-decade history of usually working for
  | customers in above-board ways, as opposed to Facebook, Googles
  | and other(s).
 
  | varispeed wrote:
  | > I can't imagine this is going to win them any friends in
  | government circles but it's definitely a step in the right
  | direction.
  | 
  | Quite the opposite. Governments probably already have taps to
  | decrypted traffic.
  | 
  | Otherwise how come that would even be legal to run?
  | 
  | If someone commits a crime and government cannot find evidence,
  | because Apple gives shielding, then isn't that making them
  | hypothetically an accomplice?
 
    | JumpCrisscross wrote:
    | > _If someone commits a crime and government cannot find
    | evidence, because Apple gives shielding, then isn 't that
    | making them hypothetically an accomplice?_
    | 
    | We have recent and specific case law around this. The cherry
    | on top is it was Apple on the other side.
    | 
    | No, this is not how being an accomplice works in the U.S.
    | It's not how it works anywhere with the rule of law.
 
      | varispeed wrote:
      | Would you have a link?
 
        | JumpCrisscross wrote:
        | https://en.m.wikipedia.org/wiki/FBI-
        | Apple_encryption_dispute
 
    | gjsman-1000 wrote:
    | By the same logic, I'm the taxpayer who paid to help build
    | the highway that the drug kingpin used to get away during a
    | high speed chase. I'm an accomplice now.
    | 
    | I'm the scientist who purified the water that the criminal
    | used to get enough strength to run away. I'm an accomplice
    | now.
 
    | kergonath wrote:
    | > Otherwise how come that would even be legal to run?
    | 
    | Why wouldn't it be? I was under the impression that what
    | isn't forbidden by law was legal by default. AFAIK, running a
    | VPN platform isn't illegal.
    | 
    | > If someone commits a crime and government cannot find
    | evidence, because Apple gives shielding, then isn't that
    | making them hypothetically an accomplice?
    | 
    | I hate this argument. It's lazy and can be used to accuse
    | anybody in any context, and shut down discussions that we
    | should be having. By that standard we are all accomplices for
    | some crimes.
 
      | willis936 wrote:
      | >I was under the impression that what isn't forbidden by
      | law was legal by default.
      | 
      | Even beyond that, personal privacy from the government is
      | enshrined in the 4th amendment. Just because there was some
      | executive actions and illegal laws made does not mean the
      | 4th amendment suddenly disappears. No person or entity has
      | the right to dragnet all communications.
 
        | unknown_error wrote:
        | > personal privacy from the government is enshrined in
        | the 4th amendment
        | 
        | Yeaaaaah, let's just pretend Snowden and Manning never
        | happened.
 
        | [deleted]
 
        | willis936 wrote:
        | I'm doing the opposite. Saying that the fed is actively
        | engaging in illegal search and seizure is not ignoring
        | the whistleblowers that brought the scope of the issue to
        | light, it's acknowledging the issue.
 
        | unknown_error wrote:
        | The point is that the Constitution is largely
        | meaningless, feel-good fluffery that has no actual
        | bearing on which of our so-called rights are actually
        | available to us.
        | 
        | It's an aspirational document in a largely lawless land,
        | more a historical oddity than the supreme anything. If
        | you wait for legislators and law enforcement to fix
        | personal privacy, you've already lost... the US law
        | enforcement culture is actively hostile towards
        | individual rights because it makes their jobs harder. The
        | only real difference to, say, China, is that we like to
        | pretend otherwise. But the reality in the ground is that
        | nobody on the grid has had meaningful privacy for decades
        | now.
 
        | willis936 wrote:
        | >The point is that the Constitution is largely
        | meaningless, feel-good fluffery that has no actual
        | bearing on which of our so-called rights are actually
        | available to us.
        | 
        | IANAL but this sounds fundamentally wrong in every way I
        | interpret it. The Constitution is a set of laws that
        | cannot be contradicted by any other law, executive
        | action, or judicial action, with the exception of an
        | amendment.
 
        | kergonath wrote:
        | > No person or entity has the right to dragnet all
        | communications.
        | 
        | Indeed. And the fact that this is not recognised as a
        | fundamental human right is a serious limitation of the
        | charter and universal declaration. And yet, it comes up
        | regularly.
 
  | smoldesu wrote:
  | > I can't imagine this is going to win them any friends in
  | government circles but it's definitely a step in the right
  | direction.
  | 
  | Apple already has all the friends they need in the "government
  | circles". They're fully enrolled in PRISM and are well-known to
  | kowtow to the demands of corrupt leadership (see: Russian
  | iPhones, Chinese iCloud hosting)
 
    | snowwrestler wrote:
    | Apple is "fully enrolled" in PRISM just like any other
    | company with U.S. operations, because PRISM is the internal
    | NSA source designation for material acquired via FISA
    | warrants, and complying with FISA warrants is not optional.
 
  | mark_l_watson wrote:
  | I am running APple's betas for iOS, iPadOS, and macOS right now
  | - I really appreciate their implementing yet more privacy.
  | 
  | re: non-encrypted iCloud storage: I agree with you. I keep
  | medical and financial data encrypted (e.g., their Pages app
  | supports encrypting documents, and you can encrypt PDFs, etc.)
  | but I would rather they did this for me. That said, for the 90%
  | of my files that I would post on a street corner, I find iCloud
  | storage across my devices is handy.
 
    | Engineering-MD wrote:
    | But how secure is encrypted pages and PDF? My understanding
    | was it is not useful against a determined attacker and anyone
    | able to access your iCloud will be in this category.
 
  | nr2x wrote:
  | iClouds lack of encryption basically invalidates all other
  | promises they make.
 
    | LeoPanthera wrote:
    | If you believe this you have misunderstood how iCloud works.
 
| SavantIdiot wrote:
| Where are the Apple VPN exit points?
| 
| I wish there was a non-dubious VPN service with an exit in a non
| GDPR country, or at least one with internet privacy. I rolled a
| strongswan VPN through AWS EC2 but all the egress points are in
| countries that can be exposed.
 
| pdimitar wrote:
| > _All in all, a very Apple approach: They deny themselves any
| knowledge of a customer 's DNS queries and Web traffic, so if
| served with a subpoena they have very little to respond with._
| 
| Maybe I am missing something but I view this is a rather genius
| move. They have plausible deniability + actually introduce some
| protection for their users.
| 
| Not sure how to read the original post though. Is it praising
| Apple? Is it mocking them? We don't have to be polar of course, I
| am just wondering.
 
  | yreg wrote:
  | >In one move, Apple has taken onion routing from a specialized
  | tool for hackers to something that will be in daily use on
  | billions of devices.
  | 
  | Sounds like praise to me.
 
  | smoldesu wrote:
  | Apple has claimed this shtick several times (as well as many
  | other VPN companies), but it actually requires a pretty
  | intricate software setup to pull off. The best VPN services
  | won't even have hard drives to store logs in: that way, even
  | individuals with a court-issued warrant can't get your info.
  | I'd imagine there's sufficient pressure on Apple from PRISM and
  | other governments to keep some level of rudimentary logs.
 
    | heavyset_go wrote:
    | > _The best VPN services won 't even have hard drives to
    | store logs in: that way, even individuals with a court-issued
    | warrant can't get your info_
    | 
    | Courts can compel them to log this information, so all claims
    | about not keeping logs are just theater. The second they're
    | ordered to by a court in the US, they will.
 
      | pwinnski wrote:
      | IANAL! The legal theory is that US courts can stop you from
      | taking actions, but cannot compel you to take actions.
      | 
      | So they can stop you from deleting existing logs, but they
      | cannot require you to collect logs you aren't already
      | collecting.
      | 
      | I have no idea how well this idea has been tested in court,
      | but that's the theory on which providers who don't even
      | have hard drives are relying.
 
    | saurik wrote:
    | (And if Apple has logs of which IP address accessed a
    | resource from which egress provider at a specific time, that
    | is often enough to do what most governments are looking
    | for... such is the limitation of two hops, and why Tor has
    | three. I truly hope Apple has designed their system to avoid
    | logging anything about their ingress packet flows.)
 
| steveharman wrote:
| "...why don't VPN providers implement a onion router.."
| 
| Pretty sure Nord already does. Probably others.
 
| tyingq wrote:
| I'm curious how they are securing the feature that keeps you in
| the same region. Since that feature encourages content providers
| to not block, it would be a desirable target to work around.
 
  | permo-w wrote:
  | yeah I was thinking about how difficult it might be to spoof
  | your location prior to the Apple Router, and have it come out
  | the other side nicely laundered
 
| soheil wrote:
| I think the title should be: Apple's iCloud+ "TOR-esque"
 
  | permo-w wrote:
  | Apple Routing
 
| kibleopard wrote:
| > The routing uses two hops; Apple provides the first, and
| "independent third parties" (not yet specified) provide the
| second.
| 
| This isn't true though, they have specified who the independent
| third parties will be: CloudFlare Warp, Fastly, and Akamai. See
| here: https://www.barrons.com/articles/fastly-stock-outage-
| think-a...
 
| amq wrote:
| Potentially, this provides troves of data to the exit node
| operators (CloudFlare, Fastly, Akamai, ...). Yes, it's the same
| with all VPNs and ISPs, but I think users should be made aware
| that now instead of your ISP analyzing the data, an even bigger
| and more capable corporation is. And if Apple is controlling the
| entire onion chain (I would be surprised if they weren't), they
| have even more data available, mainly with a corresponding IP of
| yours. In the net sum, you are hiding the transmitted data from
| your ISP and the IP from the sites you visit, but you are handing
| over all this information to a centralized place - Apple and exit
| node providers. Potentially, they can use the information to
| connect the dots more easily and fully than any ISP or site ever
| could.
 
  | aeontech wrote:
  | This is not quite correct though - entry side and exit side are
  | specifically and intentionally not operated by same entities.
  | So Apple knows who you are but doesn't know what you're looking
  | for or where you're going - your traffic is passed straight
  | through to the exit layer. Exit layer operator knows what
  | you're looking for and where you are going but doesn't know who
  | you are or where you're coming from.
 
    | amq wrote:
    | The exit node operator can extract useful information even
    | without knowing your IP, especially until Encrypted Client
    | Hello (ECH) is ubiquitous.
 
| Spooky23 wrote:
| I think this is great, if only as a way to kill the bullshit
| consumer VPN business, which sells snake oil.
 
  | wintermutestwin wrote:
  | Doesn't a consumer VPN keep my ISP from building a data profile
  | on me?
  | 
  | Yes, I get that now my VPN provider can build that data
  | profile, but I am certain that my ISP is a vile monopoly that
  | has corrupted the regulators that are supposed to represent me.
 
    | dehrmann wrote:
    | I have Sonic, so I trust my ISP more than a random VPN
    | provider. Even if you have AT&T, they have a legal team that
    | makes they provide a lot of opt-outs. I don't trust that they
    | work, but there are a lot more eyes on them than a VPN
    | provider.
 
  | izacus wrote:
  | > I think this is great, if only as a way to kill the bullshit
  | consumer VPN business, which sells snake oil.
  | 
  | Having a US megacorporation kill a whole market segment and
  | pull it into their monopolized walled garden sure seems like an
  | improvement. After all, they pinky promise they will not ever
  | abuse that! /s
 
    | massysett wrote:
    | By this logic our computer operating systems would not
    | improve, ever. Web browsers, built-in networking, music
    | players, image editors, mail programs, even Solitare - all
    | things that at one time were separate market segments.
 
      | izacus wrote:
      | All of those products have been improved by COMPETITION.
      | The most critical, most important and ONLY thing that makes
      | modern capitalism work for non-rich human beings.
      | 
      | Every single field you mention was thriving when there were
      | multiple players fighting over your money and have started
      | to become exploitative and abusive as soon as one player
      | killed the others and started rent-seeking. Competition is
      | crucial for market economy to work.
      | 
      | I find it utterly bizarre that someone educated would think
      | that a death of market by megacorp monopoly would somehow
      | drive improvement.
 
  | olivierestsage wrote:
  | I think that's painting with a pretty broad brush. What's wrong
  | with Mullvad, for example?
 
    | casefields wrote:
    | The issue here preference falsification:
    | 
    | >Preference falsification is the act of communicating a
    | preference that differs from one's true preference. The
    | public frequently conveys, especially to researchers or
    | pollsters, preferences that differ from what they truly want,
    | often because they believe the conveyed preference is more
    | acceptable socially.
    | 
    | The reason why the VPN business is booming is to avoid those
    | pesky content infringement letters, and to workaround geo
    | restrictions.
    | 
    | OP is upset that they advertise themselves as privacy tools,
    | but that's just marketing.
 
      | KingMachiavelli wrote:
      | Yea you don't legally market your product as a tool to
      | commit a crime but 'privacy' is pretty broad term and
      | partially true so it works.
 
    | dehrmann wrote:
    | VPNs mostly do what they claim, but they may or may not be
    | government or marketing honeypots, and a lot of the sales
    | pitches around hackers and privacy aren't as interesting in
    | the days of HTTPS. Aside from piracy and bypassing region
    | restrictions, you're just hiding your IP address, but those
    | change often enough already.
 
    | symlinkk wrote:
    | Who runs Mullvad?
    | 
    | I find it funny that people here mistrust companies like
    | Facebook and Google, but then turn around and hand off their
    | entire network activity to a faceless, anonymous VPN company.
 
      | wolverine876 wrote:
      | Have you tried answering that question? Mullvad isn't
      | faceless and anonymous.
 
      | olivierestsage wrote:
      | I think a lot of that distinction turns on how well your
      | network data is linked to your identity. In the case of
      | Mullvad, you can pay them anonymously by putting cash in an
      | envelope and just mailing it to them,[1] which lowers the
      | trust factor involved.
      | 
      | [1] https://mullvad.net/en/pricing/
 
  | VWWHFSfQ wrote:
  | what is bullshit about it
 
    | Spooky23 wrote:
    | You're "protecting" yourself against Starbucks monitoring you
    | by establishing a secure connection to a grey market entity
    | with more of an interest in your activity.
 
    | vmception wrote:
    | Internet reselling doesn't have nearly as much privacy as
    | internet resellers suggest
    | 
    | If you are only hiding from your local network and ISP its
    | fine
    | 
    | If you want to do that and change your location to a website
    | it's fine
    | 
    | If you are hiding from any government for a civil or criminal
    | charge it is not fine
    | 
    | If you are hiding from any government intelligence so nobody
    | knows anything it is not fine
    | 
    | It doesnt matter what "no logging" claims the internet
    | reseller has, this is not verifiable and can also change at
    | any moment
 
    | KMnO4 wrote:
    | Have you noticed all the ads say "Hackers can spy on your
    | connection when you log into your bank at Starbucks."
    | 
    | That's complete FUD. HTTPS completely avoids this issue (
    | _especially_ with a bank). Very few websites use HTTP now.
    | 
    | While VPNs do have their valid use (preventing your ISP from
    | spying, changing geolocation, and private networks for eg,
    | work), most of the marketing is spreading misinformation.
 
      | flixic wrote:
      | I've seen stats for a couple of the biggest VPNs. Massive
      | majority of their traffic is just switching geolocation
      | restrictions (US Netflix and similar).
      | 
      | They don't tend to advertise that. Some do, but it's not
      | their main message, because "prevent ISPs from spying" is
      | cleaner.
      | 
      | iCloud+ does not solve this, so there will be a sustained
      | need for VPNs, particularly those that invest effort into
      | into avoiding Netflix blacklists.
 
        | tpush wrote:
        | > They don't tend to advertise that.
        | 
        | IME of podcast advertising they all advertise this very
        | openly.
 
      | anonymouse008 wrote:
      | I've never understood how a VPN doesn't get too carried
      | away to pull a MITM with some central cert
 
        | gjsman-1000 wrote:
        | Because if you used a central cert, every device would
        | have to whitelist that cert, and just clocking the lock
        | icon in your browser would reveal it.
 
        | jen20 wrote:
        | Many consumer VPNs install a client, and it would be
        | trivial to ship a new trusted certificate with it.
 
        | acdha wrote:
        | This is true, but note that, for example, on iOS an
        | application can't do that without prompting. Now, most
        | people would probably hit "Approve" if one of their
        | security products said it was necessary.
 
        | gjsman-1000 wrote:
        | That wouldn't change that clicking the lock icon in your
        | browser would show the same certificate on every website,
        | and that this certificate was universally valid. Pretty
        | obvious...
 
        | AdamJacobMuller wrote:
        | > show the same certificate on every website
        | 
        | Not really, because, you can use on-demand certificate
        | issuance.
        | 
        | Hell, if you really want to, you can even name your
        | certificates the same as existing certificates and the
        | only way to detect the forgery would be to compare the
        | actual public keys (and who does THAT).
        | 
        | I feel like I'm writing an evil roadmap here, but, you
        | can even do multiple root certs with different names and
        | trust them all, do a whole "fake" PKI infrastructure
        | which would be impossible to detect unless you were
        | comparing the actual keys.
 
        | anonymouse008 wrote:
        | > I feel like I'm writing an evil roadmap here, but, you
        | can even do multiple root certs with different names and
        | trust them all, do a whole "fake" PKI infrastructure
        | which would be impossible to detect unless you were
        | comparing the actual keys.
        | 
        | Yeah, just imagine being beholden to some federal statue
        | impropriety (easiest in taxes) and running one of the
        | these vpn organizations...
 
        | 0x0 wrote:
        | If and when browsers start requiring pre-certificate
        | transparency logging, anything like this should no longer
        | be possible to pull off, since none of the fake
        | certificates would be able to contain a stapled pre-
        | certificate "signoff" from a trusted CT log.
 
        | throw0101a wrote:
        | > _Many consumer VPNs install a client, and it would be
        | trivial to ship a new trusted certificate with it._
        | 
        | A lot of browsers have their own root chain, and also now
        | do certificate pinning, so will (IIRC) only accept
        | specifically designated certs for particular sites
        | (doesn't Google/Chrome/Gmail do this?).
 
        | Nextgrid wrote:
        | On the other hand, a lot of VPNs provide proprietary
        | client software (even though all the major OSes have
        | built-in support for the common VPN protocols such as
        | IPSec, L2TP, etc) so they could very well sneak the root
        | cert in there too.
 
      | dehrmann wrote:
      | > "Hackers can spy on your connection when you log into
      | your bank at Starbucks."
      | 
      | I've also heard this from a reputable news source (NPR) in
      | the past few years, even though it hasn't been true for
      | banks for at least 15 years, ~5 for most websites.
 
| o8r3oFTZPE wrote:
| Here is a simple question: Why is there only one "Tor".
| 
| Why haven't there been more onion routing projects. (Maybe there
| have been and I am just not aware.)
| 
| Perhaps the same reason(s) we never saw widespread adoption of
| remote proxies, despite their usefulness in many situations.
| 
| Although in some respects onion routing seems quite an
| improvement over "simple" proxies.
 
  | gabmiral wrote:
  | If I recall correctly, I2P uses some sort of onion routing.
 
  | marshray wrote:
  | The more nodes you have participating the more secure an onion
  | system tends to be. Since the Tor network can carry most kinds
  | of traffic, the motivation to avoid a fork is strong.
 
    | wolverine876 wrote:
    | > The more nodes you have participating the more secure an
    | onion system tends to be.
    | 
    | Tor isn't very large as it is, and (I would guess) it's the
    | largest. If another onion routing network didn't grow the
    | audience, you would have two even smaller networks.
    | 
    | > the Tor network can carry most kinds of traffic
    | 
    | Isn't Tor limited to routing TCP? That would rule out QUIC,
    | for example.
 
| shp0ngle wrote:
| I'm literally using VPNs just to get around geo-blocking.
| 
| Still, this is interesting.
 
| bhaavan wrote:
| My guess is one of the major reasons for having the exit nodes in
| the same geo location as entry nodes is to have continuous
| operations in China. Without this constraint, they would have
| allowed chinese consumers to access the free web, which would ban
| them instantaneously.
| 
| I don't think Apple cares as much about video content providers,
| though.
 
  | gjsman-1000 wrote:
  | That's not the reason. In China, Myanmar, Egypt, and several
  | other countries this service will not be available at all.
  | Those customers will just have regular old iCloud.
  | 
  | A more likely reason is that video streaming services with
  | georestrictions like Netflix, Amazon, or BBC would have lost
  | their minds.
 
  | lxgr wrote:
  | > I don't think Apple cares as much about video content
  | providers, though.
  | 
  | Not being able to watch Netflix, Amazon Video etc. in Safari
  | seems like something Apple would in fact care about.
 
    | krferriter wrote:
    | Not if it gets them banned in those countries.
 
    | Mindwipe wrote:
    | HBO is blocking Private Relay regardless.
 
      | gjsman-1000 wrote:
      | Only for now. When it rolls out widely, Apple's sheer scale
      | will most likely force the issue.
 
        | Mindwipe wrote:
        | I doubt it, unless HBO and Apple are able to come to some
        | assurance on it.
 
  | whynotminot wrote:
  | I don't think this service is being offered in China, period.
 
  | simias wrote:
  | It wouldn't have been too hard to just implement this feature
  | for chinese customers if that was the only driver.
  | 
  | But I agree that making the exit node in the same country
  | probably goes beyond video content providers, it avoids all
  | sorts of potential legal, diplomatic and practical issues.
 
  | dehrmann wrote:
  | Apple also isn't in the business of people bypass region
  | restrictions. This seems focused on privacy.
 
  | smoldesu wrote:
  | Apple has always given in to China's demands. A few years ago
  | they even moved their entire Asian iCloud datacenter to the
  | China mainland after the government issued some vague
  | complaints about "nationalism" and "security".
 
| danpalmer wrote:
| Props to Apple for the design of this service. It doesn't hit all
| the privacy targets that long-time personal VPN users might be
| looking for, and it doesn't get into the game of trying to
| circumvent region locked content*, but otherwise it's likely to
| be a solid privacy improvement for almost all users in a careful
| and deliberate way.
| 
| I use a VPN for other reasons (downloading Ubuntu ISOs mostly)
| but I'll probably turn this on and leave it running on all my
| devices because of how transparent it appears to be. I trust
| Apple's onion-routing design more than I trust my VPN provider
| not to log things.
| 
| * I'm actually glad they don't try to get around region locks. I
| consume a lot of BBC content and live in the UK. I'm constantly
| struggling with my VPNs (with UK endpoints) being blocked because
| others outside the UK could be using them. It would be nice if
| the BBC didn't block like this, but UK residents do typically pay
| for the content whereas those outside the UK are unable to.
 
  | hammock wrote:
  | Which vpn do you use?
 
    | danpalmer wrote:
    | Private Internet Access.
    | 
    | I used to use NordVPN but found it to be much slower, less
    | stable, worse macOS integration, not as good on the privacy
    | front.
 
      | hammock wrote:
      | Do you have any thoughts on PIA vs Mullvad?
 
        | wolverine876 wrote:
        | PIA is owned by the person who owns Freenode, afaik. I
        | would certainly look into that before trusting them.
 
        | 1_player wrote:
        | FWIW, Mozilla VPN is based off Mullvad, which I've
        | enjoyed for a year to download Linux ISOs and I've never
        | had an issue with. Also they have one of the most
        | anonymous of setups (accept cash, crypto, no username or
        | passwords or personal details required, you're just given
        | a random account number you can add credit to)
        | 
        | NordVPN is oversubscribed crap.
        | 
        | PIA was founded by Andrew Lee, the big brain behind the
        | current Freenode drama, with help of the infamous Mark
        | Karpeles of Mt. Gox fame. I'd rather use something else.
 
        | bjoli wrote:
        | PIA is owned in a weird structure I don't understand in a
        | jurisdiction where any legal agreements with my home
        | country are, most likely, non-existant or untested. They
        | also seem to have enormous amounts on money to spend on
        | marketing or paying off torrent review sites.
        | 
        | Everybody recommends them, but all of these things make
        | me uneasy.
 
        | sa1 wrote:
        | After the recent freenode drama, best to avoid them.
 
  | NicoJuicy wrote:
  | > Props to Apple for the design of this service.
  | 
  | I was under the assumption that it was mostly Cloudflare Warp
  | repackaged with a different name?
 
    | defaultname wrote:
    | That would be an incorrect assumption. It's an onion that
    | goes to Apple first and then to a variety of external vendors
    | -- Fastly, Cloudflare, Akamai, and likely others.
 
  | kergonath wrote:
  | > It would be nice if the BBC didn't block like this, but UK
  | residents do typically pay for the content whereas those
  | outside the UK are unable to.
  | 
  | As an exiled Londoner, I would love to be able to pay to access
  | BBC programmes. Unfortunately I can't, so a VPN is often the
  | only solution (well, I guess torrenting would be another one,
  | but it's not really better).
 
    | dylan604 wrote:
    | If only there was a way to store a user's information so that
    | they could be identified with some sort of a login process
    | that would indicate that they are a current valid member. It
    | would also be impressive if this same system would allow the
    | user to indicate that they are currently abroad to allow a
    | temporary exemption of geofencing.
    | 
    | Obviously, this is something licensing agreements do not
    | allow for, but it seems like such an obvious user friendly
    | concept that it will never be allowed.
 
    | rlaabs wrote:
    | BBC Select is another option for BBC documentaries if you
    | have either Amazon Prime video or an Apple TV.
    | 
    | https://www.bbcselect.com/
 
    | robotresearcher wrote:
    | BritBox is a neflix-like service that has UK shows from the
    | BBC and ITV. Decent catalog.
 
  | [deleted]
 
  | loloquwowndueo wrote:
  | Why do you use a VPN to download free and publicly available
  | iso images? (Ubuntu). Just curious.
  | 
  | Do you download directly from a mirror or use BitTorrent for
  | this? (If the latter I think I kind of understand the rationale
  | for the VPN)
 
    | bjoli wrote:
    | My ISP throttles bittorrent traffic.
 
    | chrisfinazzo wrote:
    | Until a few months ago, I had never really used BitTorrent to
    | do anything - save for about 20 minutes back in HS almost 20
    | years ago (!)
    | 
    | (I _think_ I was running uTorrent on Windows, it was weird
    | and I really didn 't know how to use it.)
    | 
    | However, in order to "acquire" [this][1], torrenting was
    | realistically the only sensible option I had. A direct
    | download from the Internet Archive would have taken roughly 7
    | hours @ 100 Mb/s. The torrent file was done in an hour.
    | 
    | To my great surprise, the link isn't dead, so...yeah :)
    | 
    | Transmission CLI FTW.
    | 
    | [1]: https://www.caseyliss.com/2021/2/14/a-concert-for-
    | charlottes...
 
      | vultour wrote:
      | 13GB would take less than 20 minutes at 100Mbps.
      | Regardless, I'm not sure why you only consider near instant
      | downloads "sensible". I often spent several days
      | downloading things when I was younger.
 
    | syntaxstic wrote:
    | Probably because of this -
    | https://arstechnica.com/gadgets/2021/05/fake-dmca-
    | takedown-n...
 
    | xuki wrote:
    | linux iso is code for pirated content
 
      | Jiocus wrote:
      | And here I was, still thinking Linux was _" an illegal
      | hacker operation system, invented by a Soviet computer
      | hacker named Linyos Torovoltos, before the Russians lost
      | the Cold War"_.
 
    | yunohn wrote:
    | "Ubuntu ISOs" is a common euphemism for pirated content like
    | media or games.
 
    | [deleted]
 
    | [deleted]
 
    | [deleted]
 
  | krageon wrote:
  | > but UK residents do typically pay for the content whereas
  | those outside the UK are unable to.
  | 
  | In essence, what you're saying boils down to "it's already paid
  | for, but nobody else can have it anyway". It's unreasonable and
  | there is no need to make excuses for this behaviour.
 
    | 867-5309 wrote:
    | totally agree. I had no end of shit trying to watch BBC News
    | channel from abroad. I'm a UK national, I own a house in the
    | UK, I pay UK taxes, I pay your stupid TV licence fee, you're
    | broadcasting live over 3 separate CDNs, just let me watch the
    | fucking news. I eventually subscribed to an illegal IPTV
    | service for that one sodding channel. I don't even need the
    | other 17,000 channels. the BBC drove me to it
 
      | herbstein wrote:
      | Completely off-topic: great choice of name. That number is
      | burned into my mind, and will be forever
 
        | 867-5309 wrote:
        | cheers ;)
 
        | mikecarlton wrote:
        | Still more off-topic: I can only read it as 86-75-309
 
        | 867-5309 wrote:
        | the joy of fitting 7 beats into a 4/4 signature
 
        | UncleEntity wrote:
        | To continue the off-topicness...
        | 
        | That number almost always works for store 'loyalty
        | program' discounts too.
        | 
        |  867-5309
 
      | mavhc wrote:
      | Not running a vpn from your house?
 
        | 867-5309 wrote:
        | the tenants wouldn't approve (they pay for elec and
        | internet). plus I'm away for twelve months so no chance
        | of onsite troubleshooting, physical reboots after power
        | outages, etc.
 
        | larkost wrote:
        | So, you are saying that the TV license you are paying for
        | is actually being used by the renters in the house you
        | own. Is that a fair statement? That puts a bit of a
        | different spin on it.
 
        | 867-5309 wrote:
        | due to the timing of things, I prepaid for ten twelfths
        | of their residence. I didn't seek recompense as I knew I
        | would be consuming one channel. I am unaware if the
        | tenants use a tv
 
      | vanburen wrote:
      | It may be worth looking at the AAISP L2TP Service[1].
      | 
      | They are a domestic ISP, so I guess iplayer should work
      | over the service.
      | 
      | [1]: https://www.aa.net.uk/broadband/l2tp-service/
 
        | 867-5309 wrote:
        | looked interesting, but is around double the price for
        | around max 2 hours viewing per day, with no guaranty of
        | supporting BBC streams. from experience I'll presume they
        | know about this service and are actively blocking their
        | subnet
        | 
        | I'm paying around half the price for unlimited viewing of
        | direct streams (no faffing with client protocols) which
        | come transcoded for home and mobile usage
 
    | criddell wrote:
    | It really hasn't already been paid for. For example, say you
    | are a composer who wrote some music for a BBC series. You get
    | paid more for something in wide release than for something
    | released only in the UK.
 
    | andyjh wrote:
    | Licensing issues aside, it would cost _additional_ money to
    | actually serve all that content to a global audience
    | (shipping bytes over the internet isn't free).
 
      | 867-5309 wrote:
      | yet they deliver over 3 CDNs, yes THREE, for a maximum
      | viewership of one country
 
    | danpalmer wrote:
    | Yes you're right, I was giving a reason more than an excuse.
    | I don't think they should be doing it.
 
    | JumpCrisscross wrote:
    | > _what you 're saying boils down to "it's already paid for,
    | but nobody else can have it anyway"_
    | 
    | This is already paid for but the next show isn't.
    | 
    | If the BBC were sold to the public as a soft dollar
    | expenditure, it would be one thing. But it wasn't. I'm not
    | sure it could be in today's Britain. Ignoring the freeloader
    | problem threatens the support on which the BBC's funding
    | depends.
    | 
    | This is a debate with reasonable arguments on both sides.
 
    | mtsr wrote:
    | It's generally down to the terms for content that networks
    | (BBC in this case) buy licenses to. The IP owners don't want
    | the networks to allow the whole world access to that content
    | for the price that the network is willing to pay to show it
    | to their region.
 
      | subpixel wrote:
      | But also, and mostly, in reverse. The BBC is the producer
      | and license owner of a ton of programming, and rather than
      | offer that to the world for a subscription fee, they choose
      | to offer it to select partners (previously mainly PBS, now
      | Netflix and Amazon) for a licensing fee, or sometimes in a
      | coproduction arrangement.
      | 
      | This is big money, up-front, with no need to build out a
      | global delivery system or deal with millions of customers.
 
        | Mindwipe wrote:
        | > The BBC is the producer and license owner of a ton of
        | programming
        | 
        | The BBC is complete license owner of virtually zero
        | programming. Almost all (as in 99.9%+) of their content
        | uses substantial third party copyright works where the
        | cost implications of selling internationally still apply
        | (just the music rights alone will drive you mad, and it's
        | far from uncommon for BBC content that is shown in the UK
        | to have a different soundtrack to the internationally
        | sold version to the likes of Netflix due to the licensing
        | cost and complexity).
        | 
        | It is also worth noting that the BBC makes a lot less
        | than people think, especially if you consider BBC studios
        | to be a quasi-separate production entity now (which it
        | is!).
 
        | hnlmorg wrote:
        | The BBC aren't allowed to. There are very strict terms in
        | which the BBC can operate. So what they have to do is
        | sell to subsidiaries like BBC America. And there in lies
        | the licensing issues described in the GPs post.
        | 
        | This is one of those classic examples of something that
        | looks really simple from an outsiders perspective but
        | once you have to deal with the details you realise it's
        | anything but simple. And through no fault of the BBC
        | either, I might add. Various commercial stations and news
        | outlets have campaigned relentlessly to shut the Beeb
        | down. It's a miracle the service is still operating, even
        | if their hands are tightly tied.
 
        | kmeisthax wrote:
        | More generally, geographic licensing maximizes revenue
        | without damaging brand goodwill for the vast majority of
        | customers, so pretty much everyone is going to do it.
        | 
        | Hell, I thought the practice would die (or at least slow
        | down) when Netflix started transitioning away from
        | syndicated TV and movies; this never happened. Netflix
        | will totally geoblock _their own shows_ so they can, say,
        | release a cartoon on a weekly basis in Japan but in
        | binge-watchable chunks in America.
        | 
        | You will continue to see anything more premium than a
        | high-subscriber-count YouTube channel be geoblocked until
        | and unless one of two things happens:
        | 
        | - Geoblocking gets so heinous that it starts to push
        | people away from shows and services, beyond ordinary
        | subscriber churn. This is unlikely - the US is the
        | biggest market for a lot of this stuff, and that's a
        | market full of people who have no desire to watch foreign
        | media ahead of an official release. Hell, most of us
        | don't even have _passports_ , and think that you can just
        | move to another country by _asking politely_.
        | 
        | - Some country or trading bloc gets enough of a bug up
        | their butt about getting releases late that they start
        | amending copyright law to ban the practice. AFAIK, I've
        | heard Australia was considering banning region locked DVD
        | players at one point; and that the EU was considering
        | forcing online video providers to license content on an
        | EU-wide basis.
 
        | withinboredom wrote:
        | > the US is the biggest market for a lot of this stuff
        | 
        | I have a funny feeling that a very large percentage of
        | that market comes from VPNs. Everyone I know watches the
        | US Netflix and we aren't in the US.
 
        | 867-5309 wrote:
        | of all the streaming services, I have found Netflix to be
        | the one that cares least about geoblocking. they appear
        | to care on the outside to appease the production outlets,
        | but on the inside they don't appear to block or
        | discourage VPNs at all. unlike the BBC who actively, and
        | aggressively, geoblock their content
 
        | nindalf wrote:
        | GP wanted to watch BBC News in particular. I don't think
        | there's any licensing issue with that, surely?
 
        | Mindwipe wrote:
        | > GP wanted to watch BBC News in particular. I don't
        | think there's any licensing issue with that, surely?
        | 
        | Ha! There's SO SO MUCH. More than you can imagine.
 
    | [deleted]
 
  | Jiocus wrote:
  | > I use a VPN for other reasons (downloading Ubuntu ISOs
  | mostly).
  | 
  | This made me smile. Good one.
  | 
  | For context, copyright trolls recently tried to extort torrent
  | users for downloading and sharing Ubuntu ISOs.
 
    | rrrrrrrrrrrryan wrote:
    | "Linux ISOs" has been slang for a very long time:
    | 
    | https://www.urbandictionary.com/define.php?term=Linux+ISO&am.
    | ..
 
      | Jiocus wrote:
      | Thanks for clarifying. I've not encountered the use before,
      | maybe because here in the Nordics piracy has been -is- very
      | normalized.
      | 
      | The other reply told about a uni tale. I've heard about a
      | similar story about someone torrenting actual Linux ISOs on
      | university network. That resulted in a stern warning else
      | the student would be barred from using the network and
      | computers. Basically an automatic fail for future studies.
 
      | gbil wrote:
      | Anecdote from my MSc year in 2003. In the dorm room I had
      | 10Mbps Internet connection via the University's network
      | which was quite amazing for the time. So among the real
      | Linux ISOs, I tormented also the other kind of ISOs. At
      | some point the Uni NOC reached out telling me that I'm
      | consuming lots of BW for torrents which is against the
      | policy, at which I replied that I download Linux ISOs and
      | I'm happy to schedule it for after midnight, outside of
      | peak hours. After some days I get a reply that please do so
      | from another guy who forgot to remove the quote from his
      | previous colleague which went something like "hey we have a
      | problem with this guy's answer"
      | 
      | So yes, Linux ISOs is an old thing indeed
 
    | judge2020 wrote:
    | If you want to give context, a link to the story would be
    | nice:
    | 
    | https://arstechnica.com/gadgets/2021/05/fake-dmca-
    | takedown-n...
    | 
    | Importantly, OpSec (the company doing this torrent-dmca-for-
    | hire stuff) says the DMCA itself was spoofed
    | 
    | > OpSec Security's DCMA notice sending program was spoofed on
    | Wednesday, May 26, 2021, by unknown parties across multiple
    | streaming platforms.
 
      | DaiPlusPlus wrote:
      | ...who names their company "OpSec"? Are they actively
      | wanting to be made fun-of at the next defcon?
 
        | kalleboo wrote:
        | Is anything worse than "Web Sheriff"?
        | 
        | https://en.wikipedia.org/wiki/Web_Sheriff
        | 
        | https://web.archive.org/web/20090122235038/https://thepir
        | ate...
 
        | zrobotics wrote:
        | I mean, they're willing to work for ISPs doing torrent
        | detection, which has been a scummy business from the
        | start. Somehow, I would imagine they would be even less
        | respected than the feds at defcon, since the feds
        | actually do technically challenging things occasionally.
 
        | [deleted]
 
      | Jiocus wrote:
      | Of course it was a false flag issue, it never made sense
      | from the beginning.
 
        | paranoidrobot wrote:
        | In a world where white noise[1], birdsong[2] and someone
        | playing Beethoven on the piano[3] get copyright
        | strikes/takedown notices - I don't think someone getting
        | a copyright notice for downloading Ubuntu is that far
        | fetched.
        | 
        | [1] https://www.bbc.com/news/technology-42580523
        | 
        | [2] https://news.ycombinator.com/item?id=3637124
        | 
        | [3] https://news.ycombinator.com/item?id=27004577
 
    | wmf wrote:
    | The sad thing is that actual Linux ISOs are so over-mirrored
    | that using BitTorrent generally has no benefit and may be
    | slower.
 
      | Jiocus wrote:
      | High availability (through mirrors) is still a good thing.
      | My experience is that torrent files are sometimes a lot
      | faster, sometimes less so. Just as mirrors.
 
  | mkr-hn wrote:
  | They get some by way of their portion of most Americans' cable
  | bills from BBC America.
 
  | cwizou wrote:
  | > trying to circumvent region locked content
  | 
  | Semi-related to this, but they do offer an option to pick
  | between preserving your approximate location and using a
  | broader location.
  | 
  | The example they took in one of the sessions was, if you live
  | in San Jose, with the first option, you'll get an exit node
  | near San Jose so you can still get local "content". With the
  | second one, you could get an exit node in Los Angeles.
  | 
  | In practice in Europe, it looks a bit different. I do live in
  | the north west of France, and with the first option I regularly
  | get an exit node in the southwest of France (from Fastly),
  | about 700km away (which is pretty fine by me).
  | 
  | With the second one however, I get exit nodes in Germany and
  | the Netherlands (pretty much exclusively Cloudflare), which can
  | become an issue with region locked content. I had the issue
  | with Prime Video last week not offering me a Tennis match for
  | which they only bought rights for in France.
  | 
  | Obviously it's still early and they might tighten a bit the
  | locations outside of the US, but overall it's definitely quick
  | and well thought out.
  | 
  | Last thing, all your traffic from Safari (and presumably some
  | other Apple services ? Still unclear) whether http or https
  | will be routed through it. Only http traffic from 3rd party
  | apps (Firefox, curl etc) is routed through the relays, which I
  | think is a pretty sensible default.
 
  | fnord77 wrote:
  | I wish I could pay for bbc iPlayer service outside old blighty.
  | But they don't allow it.
 
    | ptaffs wrote:
    | This is as much to do with their content license agreements
    | as it is BBC being disinterested. Material BBC licenses to
    | distribute, they are limited to the UK, and content BBC
    | licenses to foreign TV presumably can't be also distributed
    | to that same region. There is a service BBC run which allows
    | those outside the UK to stream some content
    | (https://www.britbox.com/us/).
 
    | xnyan wrote:
    | smartdnsproxy.com - 2 weeks, no credit card needed. Works
    | perfectly and you don't need to use a VPN, just one of their
    | DNS servers.
 
      | fnord77 wrote:
      | this is showing up as a malicious site.
 
      | easrng wrote:
      | I took a look at this, it seems the way it works is when
      | you do a DNS lookup it does a lookup itself and rewrites
      | the IPs before returning to you. It stores a mapping of
      | client IP and rewritten IP to real IP and when it gets a
      | request on the rewritten IP it looks up the original and
      | proxies the request. Pretty cool, but I wouldn't trust it
      | with anything unencrypted. It offers no privacy benefits.
 
    | ska wrote:
    | You still can in some places if I recall correctly. Notably
    | not in US due to licensing disagreements (of course).
 
      | rrrrrrrrrrrryan wrote:
      | Like, commonwealth nations? Or just countries too small to
      | bother with the legal fees?
 
        | ska wrote:
        | Like, you can download BBC iPlayer (or could) and pay a
        | fee. For UK license fee payers, the app and content is
        | free.
        | 
        | I don't think the content was identical, but it was
        | pretty broad. Some EU countries, maybe Canada?, at least.
 
| maxpert wrote:
| I don't really mind paying few bucks for privacy. But I think
| Apple in the process is gonna kill a lot VPN providers. While I
| don't care right now I hope it doesn't make Apple a monopoly.
 
  | gjsman-1000 wrote:
  | It won't harm VPN providers, I don't think, for a few reasons.
  | 
  | - VPNs are actually less private than iCloud+ double hop
  | design, but could be much faster due to only having a single
  | hop.
  | 
  | - Unlike a VPN, you can't choose the location of the server you
  | exit at, and the exit server cannot be in a different nation.
  | If you are in the US, iCloud+'s relays are in the US. No
  | circumventing georestrictions here.
  | 
  | - Apple does not market their service as a VPN and never said
  | it is one. For most customers, they don't know this is a VPN
  | substitute because it doesn't call itself one. So if you have
  | "VPN" in your mind, this isn't something you think of as an
  | option.
 
    | CubsFan1060 wrote:
    | Additionally, this only works for port 80 traffic from apps.
    | Other traffic is not run through this, so a VPN would still
    | be useful in those scenarios.
 
      | mariojv wrote:
      | To clarify: port 80 and 443 (TLS connections), right? Or is
      | TLS traffic only routed through the private relay in
      | Safari, not other apps?
 
        | gjsman-1000 wrote:
        | All traffic in Safari goes through relay. However, in 3rd
        | party apps, all traffic over 80 goes through relay and
        | traffic over 443 is exempt. There is going to be an API
        | though for if you want your 3rd party app's 443 to go
        | over the relay if you desire.
 
        | 0xf00fc7c8 wrote:
        | Not in beta1. I tcpdump'ed traffic from Firefox. HTTP/80
        | traffic is perfectly visible and not pushed to
        | mask.icloud.com
 
      | gcbirzan wrote:
      | Wait, so no HTTPS?
 
  | kalleboo wrote:
  | Everyone I know who uses a VPN doesn't really care about
  | Privacy with a big P (i.e. state actors etc), they either use
  | it to get around geo-blocks or to conceal their use of
  | BitTorrent and maybe porn sites and this only seems to cover
  | the last of those.
 
| whiteboardr wrote:
| Actually surprised how this only shows up on HN now.
| 
| Expected this to take the top spot right after the keynote.
 
| bhaavan wrote:
| Does this mean that all DDoS mitigation techniques need to exist
| before the exit node of this traffic? Which in turn mean, that
| everyone needs to outsource their DDoS mitigation to Apple.
| 
| Also the corollary would be, that anyone who is able to bypass
| the protection mechanisms Apple has in place to control DDoS, can
| use it to DDoS a service like Google, Microsoft and get the
| entire service banned for all iCloud+ users. Right?
 
  | gjsman-1000 wrote:
  | Apple has sort of addressed this with only having it work with
  | Safari and other apps that implement the API, rather than
  | system-wide as something you can connect to. It's probably
  | going to take a lot of reverse engineering before hackers
  | figure out the API and how to get third party devices to
  | connect and authenticate, if at all. If you can't get third
  | party devices to connect, you are missing the first D in DDOS.
 
    | mariojv wrote:
    | There is also almost certainly an authentication mechanism in
    | place, even if you were to reverse engineer the API. You'd
    | need a bunch of paid iCloud accounts to have a DDoS be at all
    | feasible with this service.
    | 
    | Additionally, Cloudflare themselves, one of Apple's third
    | party partners, offer DDoS protection services. Because they
    | see all the exit traffic, they'd be able to detect the DDoS
    | and block it.
 
      | Ensorceled wrote:
      | That's why this concern seemed weird to me; the exit nodes
      | ARE the DDoS protection services.
      | 
      | I can't see Cloudflare putting themselves in the position
      | of needed to protect their clients from themselves ...
 
        | gjsman-1000 wrote:
        | Otherwise, by the poster's logic, why hasn't CloudFlare
        | been a DDoS vector?
 
  | Ensorceled wrote:
  | Why are you assuming this can, and will, be readily used as a
  | DDoS vector?
 
| Operyl wrote:
| So far the two different third parties I've seen are Cloudflare
| and Akamai. Has worked relatively well here, besides the fact
| that some bug has made it so it turns back on randomly, which
| isn't a big deal.
 
| soheil wrote:
| This could also mean now major companies security teams have even
| more incentive to track onion routing users and to check their
| pattern of traffic to ensure they are legitimate Apple users and
| not some tor user instead of just blanket-blocking every tor
| user. This could make tor less secure in the long term if more
| open source/closed source projects (NSA notwithstanding) are
| started and dedicated to analyzing and delayering tor traffic.
 
| vngzs wrote:
| From Apple's statement[0]:
| 
| > The first assigns the user an anonymous IP address that maps to
| their region but not their actual location. The second decrypts
| the web address they want to visit and forwards them to their
| destination. This separation of information protects the user's
| privacy because no single entity can identify both who a user is
| and which sites they visit.
| 
| Apple is not saying nobody can deanonymize you - they are being
| very careful to only state that no single entity can deanonymize
| you. Hence you should still assume this is not a good protection
| against any entity with subpoena power, or the ability to compel
| the cooperation of Apple and their 3rd-party egress relay
| providers.
| 
| [0]: https://9to5mac.com/2021/06/07/apple-icloud-private-relay-
| fe...
 
  | allochthon wrote:
  | That makes me wonder whether an analysis could be done over a
  | long period of time to determine where in the region the user
  | isn't, and thereby narrow down where the user is.
 
    | bjtitus wrote:
    | I'm curious what the details around the anonymous IP address
    | assignment are. Protecting copyright holders seems to be the
    | point of the IP assignment to not break content restrictions.
    | 
    | Are they able to assign a set for an entire country? If so,
    | that doesn't narrow it down all that much. However, major
    | league sports blackouts wouldn't work, so is it by city?
 
| ROARosen wrote:
| > or you can view it as a concession to reality: If Apple didn't
| do this, the video providers would block their exit nodes, as
| they do with any VPN provider that gets large enough for them to
| notice.
| 
| I seriously doubt any reasonable video streaming service would
| cut off such a huge chunk of their user base just because they
| are using an iPhone.
 
  | grantcox wrote:
  | I expect they would just show a message "to view our content,
  | download our app - Safari is not supported"
 
    | spideymans wrote:
    | But when you download the app: "please use safari to pay for
    | subscriptions" :)
 
| modernerd wrote:
| > It's not clear if the API will be public for other browsers or
| applications to use.
| 
| Apple has already confirmed that other app traffic will go
| through iCloud Private Relay "no matter what networking API
| you're using", with some exemptions:
| 
| > Not all networking done by your app occurs over the public
| internet, so there are several categories of traffic that are not
| affected by Private Relay.
| 
| > Any connections your app makes over the local network or to
| private domain names will be unaffected.
| 
| > Similarly, if your app provides a network extension to add VPN
| or app-proxying capabilities, your extension won't use Private
| Relay and neither will app traffic that uses your extension.
| 
| > Traffic that uses a proxy is also exempt.
| 
| From https://developer.apple.com/videos/play/wwdc2021/10096/.
 
  | ls612 wrote:
  | So will this mean if I'm using Cloudflare 1.1.1.1 that I won't
  | get the iCloud private relay since they implement DoH as a VPN
  | in iOS?
 
    | jedisct1 wrote:
    | DNSCloak still works with Private Cloud.
 
    | firloop wrote:
    | Not super familiar with 1.1.1.1, but I use NextDNS and it's
    | no longer implemented as a VPN - they use the native iOS
    | encrypted DNS feature. I wonder how iCloud Private Relay
    | works with that.
 
      | richbradshaw wrote:
      | I have the beta and it currently doesn't appear to work.
 
| beermonster wrote:
| This is interesting. I think overall I approve as it benefits
| people by default.
| 
| It does mean you now have to trust Apple since that's the first
| hop. However you're already doing this when you spin up your AWS
| Lightsail Wireguard instance, say. AWS can see ingress and egress
| traffic and so you just need AWS to not be part of your threat
| model. Same here. Though I dont see this as too much of a problem
| since it applies to devices and services where you've already
| made this explicit choice.
| 
| The app limitation thing is a shame and hopefully there will be
| an API at a later date.
| 
| The exit node choice based on exit-locality kinda makes me think
| Apple either:
| 
| - Want to restrict this service being (ab)used for geolocked
| content (Netflix etc)
| 
| - Want to speed up the service by providing the closest exit node
| (Performance)
| 
| Of course given all the FBI cases, you also have to consider
| other possibilties for the creation of this service.
 
  | joshstrange wrote:
  | Craig Federighi, on the most recent episode of The Talk Show
  | with John Gruber [0] about 47 minutes into the episode, talked
  | about this and I think both your assumptions are correct. For
  | the first one I'm sure they didn't want to deal with the
  | complexity of picking an exit location nor did they want to be
  | a party to getting around geo-locking and so this gave them the
  | best of both worlds, no UI and no issue with geo-blocking. For
  | the second point I think that is also the reason as well as
  | it's often helpful if a website knows your general location
  | (For relevant recommendations, CDN routing, etc) but we'd
  | prefer if the website didn't know exactly where we are coming
  | from (IP-wise) which can be used for tracking/ads.
  | 
  | [0] https://daringfireball.net/thetalkshow/2021/06/11/ep-316
 
| Brajeshwar wrote:
| Does this compare to NextDNS[1]. I moved from Pi Hole[2] to
| NextDNS and I'm happy with it.
| 
| 1. https://nextdns.io
| 
| 2. https://pi-hole.net
 
  | KMnO4 wrote:
  | Just curious, are you on the free tier? Just wondering if 300k
  | queries per month is sufficient for the average person. I have
  | no reference to base that number on.
 
    | gnicholas wrote:
    | I'm on the free tier and haven't hit the cap.
    | 
    | I've also found that I still get creepily-targeted
    | advertising, which is presumably based on IP. For example, I
    | watched a youtube video in Firefox Focus on my iPhone. Later
    | that day, I saw a youtube recommendation for a very similar
    | video (on a topic that I do not ever engage with, except for
    | the single video earlier that days) on my laptop, in Safari.
    | 
    | I use NextDNS on both devices. It's nice, but it's not a
    | silver bullet.
 
    | decrypt wrote:
    | I was on the free tier but hit 300k requests in roughly 25
    | days. My primary smartphone, laptop, and parents'
    | smartphones. Upgraded to NextDNS, happy customer for an year
    | but jumped ship to pihole. Have two pihole devices on the
    | Tailscale network. NextDNS was great. Checks all of my
    | requirements. Just wanted to support open source software. I
    | donate to pihole often instead.
 
    | Brajeshwar wrote:
    | I'm on the paid tier. I pay the yearly subscription. Our
    | family of four (2 kids) easily hit 1+ Million queries a
    | month.
 
  | marceldegraaf wrote:
  | No. NextDNS and Pi-Hole serve DNS requests and are mainly used
  | for ad blocking and content restrictions on your network. They
  | don't tunnel or redirect your actual internet traffic the way a
  | VPN does.
 
    | yegor wrote:
    | Shameless self-plug: NextDNS does not, but ControlD does do
    | that - https://controld.com
 
      | corobo wrote:
      | Your service seems to support the same features as your
      | provider -- are you 1:1 reselling or do you add stuff?
 
        | yegor wrote:
        | Not sure what you mean by that. The features are not the
        | same, see https://kb.controld.com/compare
 
    | lucasverra wrote:
    | This is the correct observation.
    | 
    | - A nextDNS user having that same question answered by
    | official team
 
  | arnvald wrote:
  | Oh, that's interesting. What convinced you to switch? Not
  | having to host it yourself or some specific features?
 
    | aPoCoMiLogin wrote:
    | i'm not the OP but I think it might be the issue with
    | exposing pi-hole to the internet to access the dns outside of
    | your home network. nextdns is cheap, i'm using it on all my
    | devices, without the hassle to expose pi-hole to the
    | internet.
 
    | Brajeshwar wrote:
    | More of Not Hosting it Myself. NextDNS is cheap enough and
    | does the work really well. Part of my lifestyles
    | simplification, especially when it comes to critical
    | services.
    | 
    | Had few instances where some websites do not work when ad
    | scripts are blocked. I had to debug while traveling and my
    | wife is not too keen on tinkering with the Raspberry Pis.
    | 
    | NextDNS have similar issues, lots of newsletter
    | unsubscription just fails. For NextDNS, I can just ask my
    | wife, "Click that Shield Icon and Disable for sometime." For
    | Mobile devices, "Open NextDNS and slide the Disable button."
 
| basisword wrote:
| I'm currently running the beta and this doesn't work on my router
| (provided by one of the largest ISP's in the UK). When I go to
| settings it displays a message that the router is unsupported by
| private relay. Hopefully it's something they can fix before
| launch but if not I wonder how many other routers are
| unsupported?
 
| dcow wrote:
| Isn't iCloud+ "VPN" (Private Relay) just white-labled Cloudflare
| Warp? Is "onion router" a new development or is Jerry
| overzealously inferring there's more than meets the eye here?
 
| ComodoHacker wrote:
| >why don't VPN providers implement a onion router
| 
| ProtonVPN does.
 
| Grustaf wrote:
| > An big tradeoff for some is that the exit node is always chosen
| to be in the same geo location as the entry node. You can view
| this as a sop to the various on-line video providers
| 
| How could it be a "sop" to video services, isn't it exactly what
| they want, no more no less?
 
  | pwinnski wrote:
  | What video services really want is for each user to be
  | identifiable by IP address. This doesn't quite give them that,
  | but it does region-lock them.
 
    | Grustaf wrote:
    | Why do they want that though? They can still remember you,
    | right, since you're logged in?
 
      | pwinnski wrote:
      | Not all media sites require one to be logged in.
      | 
      | However, there are _many_ reasons why a video service might
      | want each user to be individually identifiable by IP.
      | 
      | - Many media items are contractually region-locked
      | 
      | - The same user from too many simultaneous IPs might mean
      | shared credentials, a perceived loss of revenue
      | 
      | - The same user from geographically disparate IPs might
      | also mean shared credentials, even if not simultaneous.
      | 
      | I'm sure there are more.
 
| vmception wrote:
| Apple should release a token for the routing nodes to stake and
| get slashed for poor quality connectivity
 
| a-dub wrote:
| sounds awesome! tor as a system service with a professionally
| managed network. beyond making ad tracking harder, i wonder what
| sorts of new application spaces this may open up. i can already
| think of one! (and no, it's not some shady illegitimate/illegal
| bs)
 
| fossuser wrote:
| I was curious how they would actually implement this, if it's
| actually onion routing that's pretty cool.
| 
| I wonder what advantage this gives over using NextDNS?
 
  | peddling-brink wrote:
  | NextDNS is encrypted DNS. DNS is like using your neighbor
  | across the street for all your directions, except you have to
  | shout.
  | 
  | "YO, WHERE'S THE GROCERY STORE AGAIN? ALSO AFTER THAT I'M
  | VISITING THE STRIP CLUB, AGAIN."
  | 
  | NextDNS turns that shout into a signal/telegram message, to a
  | different neighbor. There's still a neighbor involved, but at
  | least the neighborhood doesn't get to hear anymore.
  | 
  | If they include DNS in the onion routing scheme, it turns into
  | a game of telephone, where the neighbor doesn't know you
  | anymore.
  | 
  | Your traffic, and directions become more private.
 
| xnx wrote:
| This is great. I hope this spurs Google to make their VPN
| (https://one.google.com/about/vpn) more widely available. A few
| audiences they could expand it to: any ChromeOS device, any Pixel
| phone, any Android phone, any mobile Chrome user, any Chrome
| user.
 
  | crossroadsguy wrote:
  | They'll release that as a Chrome app.
 
  | irae wrote:
  | A lot of people think of VPN as escaping Google mega-giga-
  | tracking schemes. So growing their own would be doomed to fail.
 
  | unknown_error wrote:
  | Because Google is definitely the most trustworthy company when
  | it comes to data governance and respecting user privacy. No
  | chance they'd use it to put you into a FLoC-type thing,
  | benefiting their own advertising business while shutting out
  | competitors.
  | 
  | Google, the engineering company, always plays second fiddle to
  | Google, the advertising company.
 
    | xnx wrote:
    | I trust Google and Apple 100x more (low estimate) than I do
    | Comcast/Verizon, AT&T, etc.
 
      | foobiekr wrote:
      | I agree on the Apple, but not on Google. AT&T, Comcast,
      | Verizon, Deutschetelekom, British Telecom, NTT, etc. Have
      | spent the last 15 to 20 years being absolutely deskilled by
      | people leaving for better jobs in the hyperscalers. If
      | you're worried about any telecom carrier looking at your
      | traffic then all you need to do is make sure that encrypted
      | client hello and DNS over HTTPS are used by the devices
      | that you have. The products that they use to do deep packet
      | inspection are all falling apart at this point and since
      | they have no internal technologist they are busy asking
      | vendors to fix it for them, and the vendors can't fix it
      | either.
      | 
      | Worrying about the carriers was really hot for a while
      | especially post Snowden, but it's really not a genuine
      | threat.
 
      | unknown_error wrote:
      | True.
 
      | dmitriid wrote:
      | Meanwhile even Google's employees don't know what data
      | Google collects, how to turn it off, and de-google their
      | phones. A thread with unsealed documents:
      | https://twitter.com/jason_kint/status/1398353211220807682
 
      | LegitShady wrote:
      | I don't trust google and apple equally. I trust google
      | about the same level as comcast/etc.
      | 
      | apple having less advertising influence is more
      | trustworthy, I think, in terms of privacy. don't lump
      | google in with them.
      | 
      | Meanwhile apple has many many anti consumer anti
      | competitive policies so while I may trust my privacy with
      | them more, I wouldn't trust them to fight for my privacy
      | rights in the long run.
 
    | smoldesu wrote:
    | To be fair, Apple's software has always played second fiddle
    | to their hardware. I trust Apple with a VPN about as much as
    | I do Google.
 
      | unknown_error wrote:
      | They don't have an inherent conflict of interest the way
      | Google does (advertising vs privacy in the same company).
      | The App Store makes them plenty of money, and if anything,
      | enhancing user "privacy" by limiting access of other adtech
      | vendors only strengthens their walled garden and increases
      | revenue. Even something like Fortnite or the Epic store...
      | as long as they can dictate their entire stack from
      | hardware to software (very much unlike Google + OEMs +
      | third-party stores), they'll have a huge advantage over
      | Google in terms of being able to limit your personal info
      | being used by third parties, while still retaining it for
      | their own use.
 
| nuker wrote:
| I hope it'll not bring captcha hell, as Google does for using
| VPNs. Twitter is simply blocking my VPN provider. eBay sends
| scary email every time I login.
 
  | acdha wrote:
  | This will come down to reputation. VPN providers which don't do
  | a good job managing abuse from their networks get blocked a lot
  | more readily than better run networks, and in this case they'd
  | be able to make pretty strong assurances that they can link
  | activity to a single user.
 
  | xnx wrote:
  | Because Apple is so large and well respected, issues will be
  | blamed on whoever is putting up the captcha, not Apple.
 
  | NorwegianDude wrote:
  | You can disable the captcha by paying the site a 30 % cut of
  | the purchase price of the Apple device and the subscription./s
 
| jameshart wrote:
| Interesting. I thought I recalled talking about this on HN
| previously:
| 
| https://news.ycombinator.com/item?id=10355868
| _-__--- on Oct 8, 2015 | parent | favorite | on: Verizon revives
| "zombie cookie" device tracking on...              Tor as an OS-
| level feature may not spark the best reaction. It's been given a
| bad name ("deep web," silk road, etc) in mass media and many
| people don't understand it enough to think of it as anything
| other than bad.         I think that it'd be cool to have, but I
| don't think that Apple would ever implement it.
| jameshart on Oct 8, 2015 [-]                  Agree, it's
| phenomenally unlikely, but then again there is a part of me which
| could actually imagine Apple doing something like it. They
| wouldn't use Tor, of course, they'd build a proprietary
| equivalent, and then come out on a black stage to 'introduce
| Apple Undercover, a revolutionary enhancement to personal network
| privacy and security'.
 
  | Legion wrote:
  | I love the moments when you can point back to an old post and
  | say, "called that!"
  | 
  | (No snark, I really do love it.)
  | 
  | Enjoy the moment, future seer.
 
    | amznthrwaway wrote:
    | I mean, he also said it was phenomenally unlikely.... Maybe
    | 1/2 a point.
 
  | headmelted wrote:
  | Your prediction of it being called Apple Undercover is
  | _significantly_ more 80's though. And I like it.
  | 
  | So much so that I would accept Apple using something other than
  | Helvetica this one time for a Miami Vice typeface and a Michael
  | Knight and Kitt intro at WWDC.
  | 
  | I cannot stress enough that Hasselhoff needs to stay in
  | character the entire time or the whole concept doesn't work.
 
    | mkr-hn wrote:
    | Hasselhoff drifts on to stage in KITT, jumps out, and tackles
    | Tim Cook. They then get up, shake, laugh, and take turns
    | explaining how iCloud+ VPN makes it look like everything you
    | do online comes from Apple.
 
      | headmelted wrote:
      | He may sing in German as the musical guest they sometimes
      | have at the end of the keynotes, but that's as much
      | flexibility as I'm willing to allow.
 
        | mkr-hn wrote:
        | Can William Daniels at least voice the car saying "one
        | more thing" before throwing it to Hasselhoff?
 
        | MobileVet wrote:
        | The Hoff MUST sing 'Jump in my car' for this to really
        | land.
        | 
        | https://youtu.be/dm7jEA3frY4
 
    | tobr wrote:
    | > I would accept Apple using something other than Helvetica
    | 
    | At this point, Helvetica itself would give a retro feeling if
    | used by Apple. They've been all in on San Francisco for
    | several years.
 
      | watersb wrote:
      | Nobody goes there anymore. It's too crowded.
      | 
      | https://imgur.com/gallery/2eBXYnT
 
  | mikeiz404 wrote:
  | No offense or anything but what's the point of making this
  | comment outside of showing that you were right? Good
  | prediction.
 
    | jameshart wrote:
    | (Fair question. I just found it amusing. I'm annoyed it got
    | voted to the top. For substantive discussion, people should
    | look down page)
 
  | shoto_io wrote:
  | Hey there, can I call you? I have some questions about the
  | future!
 
  | toxik wrote:
  | An even more impressive prediction in 2015, a time when Apple
  | was not positioned as some type of savior of user privacy.
 
    | jameshart wrote:
    | I'm not so sure. If you read back up that thread, the thought
    | that triggered it was from qzervaas:                  Apple's
    | already shown they don't like this behaviour with their
    | randomised MAC addresses in iOS 8+.
    | 
    | And elsewhere in the thread people called out the fact apple
    | had already introduced support for ad blocking. So Apple's
    | privacy-positive posture was already in the air.
    | 
    | I think there is a sense in which privacy was already a
    | differentiator for Apple in iOS (as contrasted with Google's
    | motives in android in particular of course) - so this did
    | feel like a not completely implausible way they could go to
    | double down on that differentiator.
 
      | simonh wrote:
      | Steve Jobs talking about this at D8 in 2010, and of course
      | the privacy features he talks about were baked into the OS
      | APIs from the start.
      | 
      | Apple's rift with Google over user data collection in
      | Google Maps goes back to 2009 when Google held Apple to
      | ransom for the user data in return for turn-by-turn
      | directions. Apple refused and started building their own
      | maps service, buying Placebase in July that year.
      | 
      | https://www.youtube.com/watch?v=39iKLwlUqBo
 
        | shaicoleman wrote:
        | If anyone's interested in reading more, here's an article
        | which discusses why Apple switched from Google Maps:
        | 
        | http://allthingsd.com/20120926/apple-google-maps-talks-
        | crash...
 
    | hlau wrote:
    | I actually wrote a deep dive on Apple's pivot to privacy.
    | https://saturation.substack.com/p/apple-facebook-and-the-
    | glo...
 
    | tialaramex wrote:
    | It's really not about privacy though, the insight needed (not
    | that I'm saying it was easy to make this particular
    | prediction) is that Apple is all about the Walled Garden. It
    | can't be Tor because Apple doesn't own Tor, and so that's not
    | inside the Walled Garden, whereas "Apple Undercover" even if
    | it were functionally no better or worse than Tor, is
    | magically blessed by the Apple branding. And Apple have been
    | all about Walled Gardens for decades.
 
      | yarcob wrote:
      | Tor has reputation problems. Lots of services block tor
      | exit nodes because of all the abuse that comes from them.
      | 
      | By making it a feature for paying subscribers only, Apple
      | probably hopes that their solution won't be interesting for
      | criminals. (Apple will likely cooperate with law
      | enforcement)
 
    | [deleted]
 
      | [deleted]
 
  | nabla9 wrote:
  | Apple is in crossfire:
  | 
  | (a) There is pressure from many governments to give backdoor
  | for surveillance. Or just comply with subpoenas that are
  | against human rights.
  | 
  | (b) Complying with local laws generates PR damage. It makes
  | privacy and ethics as a brand strategy look disingenuous.
  | 
  | The solution is, of course, to generate truly secure system
  | where Apple can't make backdoors. Those services may not be
  | available in some countries, but then it's just missing
  | service, not a compromised system.
 
    | gjsman-1000 wrote:
    | This is something Apple is increasingly working on. For
    | example, in Fall 2020 they actually revised their CPU designs
    | (including older CPUs) with a new Secure Enclave design that
    | uses mailboxes to more securely store the number
    | authentication attempts inside the secure enclave.
    | 
    | The goal of this is to make it so that even if the FBI had an
    | incident similar to 2016, Apple would not be able to fulfill
    | their request to make a backdoor, and the FBI wouldn't be
    | able to make a backdoor even if they had the power to sign
    | and run any code they wanted on the phone.
    | 
    | That's how you make a secure system these days. You can't
    | just make it secure to everyone but yourself and fight the
    | government - you need to secure it from yourself as well.
 
      | shard wrote:
      | That only works if you don't give control of the servers
      | over to a third party and also use encryption on the
      | servers. Which Apple has not been able to do across the
      | board.
 
  | matt-attack wrote:
  | Wow props for quite a prediction. You definitely deserve some
  | recognition for that one.
 
| gordon_freeman wrote:
| Does anybody know, how iCloud+ VPN would compare with Cloudflare
| WARP in terms of better privacy protection.
 
  | dustyharddrive wrote:
  | Don't forget that neither is a pure VPN, though that's not
  | always a bad thing -- Private Relay is better than a VPN
  | because onion routing means "no one party"[1] can correlate
  | your connections and identity.
  | 
  | However WARP, being more like a VPN, requires you to trust
  | Cloudflare to not log DNS lookups / the servers you connect to
  | and associate that with your origin IP.
  | 
  | Why do I hesitate to call WARP a real VPN? It reveals your
  | actual IP address to websites you visit via X-Forwarded-For.
  | [2]
  | 
  | Also I think the fact that iCloud Private Relay will be built-
  | in makes it more private than WARP -- more users' traffic will
  | come out of each node.
  | 
  | [1]: Obviously this is imperfect because the Apple (which knows
  | your IP) and third-party (which knows the network traffic)
  | nodes will likely be in the same jurisdiction as each other,
  | subject to the same laws, as mentioned by other commenters.
  | 
  | [2]: https://twitter.com/eastdakota/status/1176987146177196032
  | 
  | edit: typo, line break, clarified Private Relay concept
 
| GoofballJones wrote:
| I liked this little article as it reminds me of when the Web was
| still young and mainly just text with no formatting or graphics
| yet. Takes me right back to 1991!
 
| [deleted]
 
| defaultname wrote:
| https://developer.apple.com/videos/play/wwdc2021/10096/
| 
| A pretty decent overview of the scope of the product.
| 
| As mentioned in the video, the service also is involved if your
| app does HTTP over port 80, offering at least some marginal level
| of improvement. Otherwise it leaves your app traffic as is.
| 
| As to Mail, the linked comment mentions that but I don't remember
| it being a part of the solution (nor does it seem feasible that
| it could be). Apple offers privacy improvements in mail, but not
| via the private relay.
 
  | floatingatoll wrote:
  | https://developer.apple.com/wwdc21/10085
  | 
  | Privacy Relay is also discussed in the privacy pillars video
  | for a few minutes, starting at 24m30s.
 
  | Jyaif wrote:
  | To be exact, the video says that it includes all insecure HTTP
  | traffic, so if you use HTTPS for now you are saved.
 
| neximo64 wrote:
| It just re routes traffic to your nearest Fastly pop and mixes
| traffic up with everyone else nearby.
 
  | judge2020 wrote:
  | It specifically goes through an Apple proxy first and fastly
  | (or other partners like Akamai and Cloudflare) don't see the
  | incoming IP address.
 
| theonlybutlet wrote:
| I'm curious how does the second hop work? are the third parties
| contracted by Apple to provide the service? What's in it for
| them?
 
| res0nat0r wrote:
| Is this like Cloudflare Warp then?
| 
| https://1.1.1.1/
 
  | alpb wrote:
  | the beta seems to be using Warp actually.
 
| pilif wrote:
| My experience with this so far was... mixed.
| 
| - This breaks DNS resolution for company-internal domains.
| 
| - This routes all my traffic through CloudFlare or another CDN I
| might or might not trust (yes, the IP is hidden, but not the
| data)
| 
| - it significantly slows down my internet access on my location.
| 
| - it tends to turn itself on again without my intervention
| 
| especially the last point is very problematic for me
 
  | defaultname wrote:
  | To use it you're clearly using early beta software. Clearly it
  | isn't going to "turn itself on again".
  | 
  | I turned it on and actually forgot I did. Performance is decent
  | here. I mean _of course_ it 's going to be worse than native,
  | but that's the compromise.
  | 
  | As to trusting Cloudflare -- what do you mean? You understand
  | your connection is still TLS end-to-end encrypted (presuming
  | that's what we're talking about), right? I mean...presuming the
  | site your talking to isn't using Cloudflare SSL. In no way does
  | this reduce that security. If you're talking about HTTP, well
  | everyone in between can already see that.
 
    | kerng wrote:
    | [Clearly not turn itself on.]
    | 
    | Funny story, I was shocked and quite annoyed that an iPhone
    | automatically turns on Wifi and stuff every day by itself -
    | even if you turn it off...
    | 
    | Still dont know how to actually turn it off
 
      | mvanbaak wrote:
      | If you disable it from the control center thingie overlay
      | it even states that is only for this day ...
      | 
      | If you disable it from settings, it stays off.
 
      | klaushardt wrote:
      | If you tap the wifi button in your controll center it just
      | turns it off for 24 hours or when you switch locations. If
      | you turn it off in the Settings App then it stays off.
 
      | permo-w wrote:
      | if you disable from quick menu, it turns back on. if you
      | disable from settings, it doesn't
 
        | nucleardog wrote:
        | And when you do so it does flash a message along the
        | lines of "Disconnecting nearby wifi until tomorrow".
        | 
        | Which makes it pretty clear it's not a wifi kill switch
        | but just a "my current connection is shit, let me use
        | cellular" button.
 
    | marmaduke wrote:
    | > Clearly it isn't going to "turn itself on again"
    | 
    | Why is it so clear? An iPhone hotspot turns itself off as
    | soon as a device disconnects, with no option to leave it on,
    | presumably for security or battery reasons.
 
  | gjsman-1000 wrote:
  | It directs to an Apple server, then CloudFlare, so considering
  | it's basically a double VPN speed decreases have been
  | reasonable.
  | 
  | The fact they can see unencrypted HTTP data is a downside with
  | all VPNs. At least you have the double hop going in your favor.
  | 
  | As for turning on by itself, it's annoying, but it is the very
  | first developer-only preview so I'm not complaining yet.
 
  | yunohn wrote:
  | > This breaks DNS resolution for company-internal domains.
  | 
  | Is this not the case for any VPN or proxying service? In fact,
  | it could even be a security flaw if your internal domains were
  | accessible on external VPN style endpoints?
 
    | gjsman-1000 wrote:
    | Also it's developer preview 1. People like the OP who gripe
    | about bugs on such an unfinished product are the reason why
    | Apple doesn't make those first builds available to anyone but
    | their registered developers for the first month.
 
    | krageon wrote:
    | > Is this not the case for any VPN or proxying service?
    | 
    | No, it's not.
    | 
    | > In fact, it could even be a security flaw if your internal
    | domains were accessible on external VPN style endpoints?
    | 
    | It would be, but then this is not something that happens on a
    | network configured in the way you describe.
 
      | krferriter wrote:
      | It is for any VPN client that routes DNS traffic through
      | the VPN as well as HTTP and other web traffic. It's not out
      | of the ordinary for this to happen.
 
      | yunohn wrote:
      | I use NordVPN. It specifically has an opt-in setting to use
      | locally discovered DNS in favor of their in-network DNS.
      | This is crucial since out-of-network DNS can leak activity.
      | 
      | I'm not sure what kind of network you believe I described,
      | but would be useful to have a clearer explanation from you.
 
      | defaultname wrote:
      | "No, it's not"
      | 
      | The root's observation is that it doesn't use the machine
      | configured DNS. The overwhelming majority of VPNs also
      | don't use the machine configured DNS. Maybe not "any", but
      | if you're using a VPN you're generally going to want your
      | DNS going over it as well.
      | 
      | But it is worth noting if you're on a corporate network, or
      | if you use a DNS solution like NextDNS -- when you turn on
      | PR those no longer play a part, at least to Safari traffic.
 
  | williamtwild wrote:
  | "yes, the IP is hidden, but not the data"
  | 
  | Using TLS it certainly should be.
 
    | stock_toaster wrote:
    | Does it work like an https proxy (with CONNECT) or a socks
    | proxy?
    | 
    | Because if it is instead actually unwrapping the connection
    | somehow (eg. mitm) then they would be able to see the
    | content, and that seems like a huge no-go -- both for the
    | users, AND for apple as I would think it would open them up
    | to liability.
    | 
    | note: they certainly would be able to see unencrypted http
    | traffic regardless though.
 
  | EveYoung wrote:
  | Does Apple preserve the client source IP in the request
  | (similar to Cloudflare's VPN) or will the server only see the
  | IP of the exit node?
 
    | dividuum wrote:
    | The whole point of the service is to hide the client source
    | IP.
 
      | EveYoung wrote:
      | Not necessarily. I thought it was mainly about encrypting
      | traffic in untrusted networks. Cloudflare already does it
      | like this in their VPN service.
 
        | dividuum wrote:
        | Correct. I guess it wasn't really obvious from the linked
        | mail. The introduction video at
        | https://developer.apple.com/videos/play/wwdc2021/10096/
        | is a lot clearer.
 
        | defaultname wrote:
        | Not sure why you said correct, as it's both. A big part
        | of private relay -- I would say the most significant part
        | -- is to allow people to talk to websites without giving
        | up their personal IP (and from that pretty tight
        | geolocation, and with fingerprinting a correlation with
        | loads of other data they collect). Apple makes a big deal
        | about it being about maintaining privacy, not just
        | against snooping of traffic -- which is unlikely -- but
        | against fingerprinting and targeting from the services
        | and sites you connect to.
        | 
        | And to answer the original guy, no Apple does not add any
        | headers or details to tell the destination what your IP
        | address is. They just see that they're talking to an exit
        | node somewhere approximal of your general region.
 
  | wolverine876 wrote:
  | > the IP is hidden, but not the data
  | 
  | Isn't the great majority of your traffic HTTPS?
 
  | xiphias2 wrote:
  | > This breaks DNS resolution for company-internal domains.
  | 
  | Why would it? The WWDC developer video clearly states that it's
  | only for public domains.
 
    | ec109685 wrote:
    | I believe the DNS requests are routed through their ingress
    | proxy, so there's no chance to hit an internal split horizon
    | DNS server.
 
___________________________________________________________________
(page generated 2021-06-16 23:00 UTC)