Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's “iCloud Private Relay” broke risk based authentication

zitadel.ch

Post reply on HN
Print view View original

1–10 of 211 posts

Re: Apple's “iCloud Private Relay” broke risk based authentication

#4

Post by csunbird »

> As of writing this blog I was in Switzerland and the IP used to egress my traffic was in a region located in the US. If this also tends to change a lot and fast you can basically throw away IP addresses as data of your RIBA.

Wait, so my data will be routed to US servers, as an EU resident, where the data protection laws are not as strong as where I live? This is a really bad idea, as US is known to tap any data they can get on their soil.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#5

Post by marcinzm »

I find authentication the least problematic place where risk based on ip is used. Etsy, for example, will suspend your seller account if it sees too many logins from different IPs or if it's from an IP it has flagged before. It also has terrible seller customer service so it could take weeks to get it un-suspended. Heard of some people using Private Relay getting hit by this during the beta so hopefully Etsy gets rid of that system.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#7

Post by tehbeard »

tester89 wrote: post #6

> IMO = In My Opinion is a blog format where a author reflects his own opinion Did they just reïnvent opinion pieces?

Given how many acronyms get slung around on the broader web with 0 context, are you really going to nitpick on one that's labelled in a byline? It just explains the prefix of the blog.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#8

Post by x4e »

csunbird wrote: post #4

> As of writing this blog I was in Switzerland and the IP used to egress my traffic was in a region located in the US. If this also tends to change a lot and fast you can basically throw away IP addresses as data of your RIBA. Wait, so my data will be routed to US servers, as an EU resident, where the data protection laws are not as strong as where I live? This is a really bad idea, as US is known to tap any data the…

Well Switzerland is not completely EU so I’m not sure if it has the same data protection laws.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#9

Post by ffo »

jarym wrote: post #2

"But please stop relying on RIBA for the plain authentication of a user!" Well I'm not sure everyone will be happy to do that. Tying session tokens to source IP addresses is usually not a bad practice and is rarely the only mitigation used.

Well, in the end channel binding would be the best option which really mitigates some threat vectors. For example MITM, secrets extraction out of the browser and so on. But the big issue is that this is not widely supported.

Using the IP as means is IMO nonsense with todays use of CG-NAT, VPN and so on. It does not rely help securing something.

But these are just my 2 cents ;-)

Disclaimer: I wrote the article

Re: Apple's “iCloud Private Relay” broke risk based authentication

#10

Post by danceparty »

csunbird wrote: post #4

> As of writing this blog I was in Switzerland and the IP used to egress my traffic was in a region located in the US. If this also tends to change a lot and fast you can basically throw away IP addresses as data of your RIBA. Wait, so my data will be routed to US servers, as an EU resident, where the data protection laws are not as strong as where I live? This is a really bad idea, as US is known to tap any data the…

Private relay will egress from the same general region as the client source location. So if you’re in switzerland and hopping through a US exit point that is a bug. This is clearly explained in the wwdc video
Post reply on HN