Apple's “iCloud Private Relay” broke risk based authentication • Hacker News Board

Re: Apple's “iCloud Private Relay” broke risk based authentication

#41

Post by ryanlol » Wed, Jul 07, 2021, 3:07 PM UTC

danceparty wrote: post #10

csunbird wrote: post #4

> As of writing this blog I was in Switzerland and the IP used to egress my traffic was in a region located in the US. If this also tends to change a lot and fast you can basically throw away IP addresses as data of your RIBA. Wait, so my data will be routed to US servers, as an EU resident, where the data protection laws are not as strong as where I live? This is a really bad idea, as US is known to tap any data the…

Private relay will egress from the same general region as the client source location. So if you’re in switzerland and hopping through a US exit point that is a bug. This is clearly explained in the wwdc video

Actual egress location and locations returned by various geoip databases have little to do with each other.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#42

Post by ffo » Wed, Jul 07, 2021, 3:08 PM UTC

ffo wrote: post #31

gkop wrote: post #28

Author, since you “dearly recommend” a related blog post of yours, please link to that post .

Whops, good catch! There is definitely the link missing. Going to correct that ASAP. In the meantime: https://zitadel.ch/blog/imo-passkey-in-icloud-keychain/

It is patched now.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#43

Post by outloudvi » Wed, Jul 07, 2021, 3:12 PM UTC

I thought Private Relay will not change the geo-region of users (e.g., proxy to IPs of the same country) in order to let online streaming companies (e.g,. Netflix) happy. This is different from what said in this post. Is it no longer the case or never the case?

Re: Apple's “iCloud Private Relay” broke risk based authentication

#44

Post by zie » Wed, Jul 07, 2021, 3:14 PM UTC

csunbird wrote: post #4

> As of writing this blog I was in Switzerland and the IP used to egress my traffic was in a region located in the US. If this also tends to change a lot and fast you can basically throw away IP addresses as data of your RIBA. Wait, so my data will be routed to US servers, as an EU resident, where the data protection laws are not as strong as where I live? This is a really bad idea, as US is known to tap any data the…

> This is a really bad idea, as US is known to tap any data they can get on their soil.

I think you meant to say, the US is known to tap ALL data we can get our grubby little paws on. We don't care if it's on our soil or not.

AIUI, it's arguably harder if it's on our soil, as then we might be spying on US citizens which requires a touch more paperwork.

NOTE: I'm not condoning this behaviour, just stating my understanding of it.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#45

Post by ffo » Wed, Jul 07, 2021, 3:16 PM UTC

outloudvi wrote: post #43

I thought Private Relay will not change the geo-region of users (e.g., proxy to IPs of the same country) in order to let online streaming companies (e.g,. Netflix) happy. This is different from what said in this post. Is it no longer the case or never the case?

With the Developer Beta 2 it was more consistent in staying somewhat in the region. But still if you IP is consistently changing it is hard to adapt. Btw. Oftentimes Geo Databases are wrong as well.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#46

Post by marcinzm » Wed, Jul 07, 2021, 3:17 PM UTC

fps_doug wrote: post #30

marcinzm wrote: post #5

I find authentication the least problematic place where risk based on ip is used. Etsy, for example, will suspend your seller account if it sees too many logins from different IPs or if it's from an IP it has flagged before. It also has terrible seller customer service so it could take weeks to get it un-suspended. Heard of some people using Private Relay getting hit by this during the beta so hopefully Etsy gets rid…

Compared to Google, where you can't contact anybody at all if you're not on a payed account. Yes, it's free, why do you expect service, but they're still making money off me with ads etc., so locking an account down forever because of suspicious activity seems a bit over the top in that case.

Sometimes Etsy customer service will just say "we no longer have a business relationship and we cannot talk further". So it may be weeks using un-documented email addresses and escalation processes that you only learn about on unofficial subreddits.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#47

Post by Mindwipe » Wed, Jul 07, 2021, 3:25 PM UTC

danceparty wrote: post #10

csunbird wrote: post #4

> As of writing this blog I was in Switzerland and the IP used to egress my traffic was in a region located in the US. If this also tends to change a lot and fast you can basically throw away IP addresses as data of your RIBA. Wait, so my data will be routed to US servers, as an EU resident, where the data protection laws are not as strong as where I live? This is a really bad idea, as US is known to tap any data the…

Private relay will egress from the same general region as the client source location. So if you’re in switzerland and hopping through a US exit point that is a bug. This is clearly explained in the wwdc video

> Private relay will egress from the same general region as the client source location.

It's supposed to, but that is definitely not currently the case.

If that will be fixed during the beta period is unclear.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#48

Post by Mindwipe » Wed, Jul 07, 2021, 3:26 PM UTC

tylrprtr wrote: post #13

csunbird wrote: post #4

> As of writing this blog I was in Switzerland and the IP used to egress my traffic was in a region located in the US. If this also tends to change a lot and fast you can basically throw away IP addresses as data of your RIBA. Wait, so my data will be routed to US servers, as an EU resident, where the data protection laws are not as strong as where I live? This is a really bad idea, as US is known to tap any data the…

I don't believe that's the case. Just listened to Craig Federighi on Jon Gruber's podcast say that the intent is that the relay is regionalized. Your IP will be anonymized, but it will at least correspond to the general location you are in. Possibly this was just a bug in the beta?

It's very buggy so far.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#49

Post by md_ » Wed, Jul 07, 2021, 3:26 PM UTC

SahAssar wrote: post #11

jarym wrote: post #2

"But please stop relying on RIBA for the plain authentication of a user!" Well I'm not sure everyone will be happy to do that. Tying session tokens to source IP addresses is usually not a bad practice and is rarely the only mitigation used.

Token binding was a much better way to do this where you'd bind a cookie to a certain client TLS key. Unfortunately only MS implemented support, and that disappeared when they moved to chromium so I'm guessing it's dead.

Hmm, I'm not convinced it's better—but it depends a lot on your threat model.

For preventing malware from using stolen cookies on a botnet, it's reasonable to argue that it's easier for the malware to steal the TLS client cert (which is no less accessible than the cookie jar itself) than it is for the malware to maintain access to the "good" client IP. As silly as IP-binding of sessions is.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#50

Post by snowwrestler » Wed, Jul 07, 2021, 3:39 PM UTC

csunbird wrote: post #4

> As of writing this blog I was in Switzerland and the IP used to egress my traffic was in a region located in the US. If this also tends to change a lot and fast you can basically throw away IP addresses as data of your RIBA. Wait, so my data will be routed to US servers, as an EU resident, where the data protection laws are not as strong as where I live? This is a really bad idea, as US is known to tap any data the…

You have no control where your packets get routed on the Internet, by design of the basic protocols.

Personal data should be protected by TLS (edit: and/or application-level encryption) so packet routing is irrelevant to privacy and data protection.

I am very worried that the demand for protection of personal data (which is good) is mutating into an expectation of fully regional Internets that do not peer with each other (which IMO is bad).