Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's “iCloud Private Relay” broke risk based authentication

zitadel.ch

Post reply on HN
Print view View original

71–80 of 211 posts

Re: Apple's “iCloud Private Relay” broke risk based authentication

#71

Post by dannyw »

cratermoon wrote: post #62
csunbird wrote: post #4

> As of writing this blog I was in Switzerland and the IP used to egress my traffic was in a region located in the US. If this also tends to change a lot and fast you can basically throw away IP addresses as data of your RIBA. Wait, so my data will be routed to US servers, as an EU resident, where the data protection laws are not as strong as where I live? This is a really bad idea, as US is known to tap any data the…

The laws specifically mention "at rest". Where your traffic goes while in flight is not regulated. Legally, the US service can't grab and store your data, but that doesn't mean they can't analyze and use your data as it flows through.

It is not clear what the laws say as FISA intrepretations are secret.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#72

Post by dehrmann »

snowwrestler wrote: post #50
csunbird wrote: post #4

> As of writing this blog I was in Switzerland and the IP used to egress my traffic was in a region located in the US. If this also tends to change a lot and fast you can basically throw away IP addresses as data of your RIBA. Wait, so my data will be routed to US servers, as an EU resident, where the data protection laws are not as strong as where I live? This is a really bad idea, as US is known to tap any data the…

You have no control where your packets get routed on the Internet, by design of the basic protocols. Personal data should be protected by TLS (edit: and/or application-level encryption) so packet routing is irrelevant to privacy and data protection. I am very worried that the demand for protection of personal data (which is good) is mutating into an expectation of fully regional Internets that do not peer with each o…

> Personal data should be protected by TLS

I guess it's sort of a good thing that Apple is getting into the business of giving away snake oil to combat people selling it. The big iOS privacy changes that would help are DNS over HTTPS (maybe it already does this and requiring permissions for non-HTTPS network access. Maybe they could limit relay routing to non-HTTPS browser traffic?

Re: Apple's “iCloud Private Relay” broke risk based authentication

#73

Post by matwood »

outloudvi wrote: post #43

I thought Private Relay will not change the geo-region of users (e.g., proxy to IPs of the same country) in order to let online streaming companies (e.g,. Netflix) happy. This is different from what said in this post. Is it no longer the case or never the case?

It's buggy, but I've noticed the location has settled down and has me located in my same city now.

Initially my IP was showing up all over the US. My guess is they were working on the logic and adding more CDNs. So far I've seen Cloudflare and Fastly.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#74

Post by TurningCanadian »

cratermoon wrote: post #60
TurningCanadian wrote: post #56

Did it actually break risk based authentication though? Sure, legitimate users will be using Apple's Relay, but what's stopping attackers from using it? If the users of the service are choosing to be indistinguishable from attackers, then that's on them. I think of it like reputation in real life. If you come knocking on my door, and I can see and recognize you, I'll open it. If you cover up my peephole or hide yours…

It broke it in the sense that it removed a signal that would allow the service to distinguish legit users from possibly malicious ones. In the case of a legit user that has in the past always authenticated from an IP address or address block geolocated to say, Seattle, the service can look at any authentication attempt from elsewhere as anomalous and raise additional challenges. However, with Relay, that signal is lo…

Why would my visitor be surprised that I'm suspicious though? They're choosing to be suspicious.

Another analogy I could make is someone that is blocking their caller ID. Should they be surprised that fewer people will take their call? They're lumping themselves in with spammers.

I think Apple -- and anonymizing proxy/VPN services in general -- should be communicating that to their customers.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#75

Post by coldcode »

Mindwipe wrote: post #48
tylrprtr wrote: post #13

Earlier quoted context omitted.

I don't believe that's the case. Just listened to Craig Federighi on Jon Gruber's podcast say that the intent is that the relay is regionalized. Your IP will be anonymized, but it will at least correspond to the general location you are in. Possibly this was just a bug in the beta?

It's very buggy so far.

Apple Beta's in July are still very early. If it still happened in late August I might be concerned.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#76

Post by r1ch »

matwood wrote: post #73
outloudvi wrote: post #43

I thought Private Relay will not change the geo-region of users (e.g., proxy to IPs of the same country) in order to let online streaming companies (e.g,. Netflix) happy. This is different from what said in this post. Is it no longer the case or never the case?

It's buggy, but I've noticed the location has settled down and has me located in my same city now. Initially my IP was showing up all over the US. My guess is they were working on the logic and adding more CDNs. So far I've seen Cloudflare and Fastly.

How on earth are they proxying through Fastly? I would expect Fastly only sends requests to their customers origins, yet Apple is proxying requests through them to arbitrary websites.

I wonder if you could abuse this to bypass ACLs on Fastly customers that block direct origin traffic.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#78

Post by cglong »

marcinzm wrote: post #5

I find authentication the least problematic place where risk based on ip is used. Etsy, for example, will suspend your seller account if it sees too many logins from different IPs or if it's from an IP it has flagged before. It also has terrible seller customer service so it could take weeks to get it un-suspended. Heard of some people using Private Relay getting hit by this during the beta so hopefully Etsy gets rid…

My guess is that they'll just say Safari isn't supported and push people to Chrome.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#79

Post by meepmorp »

cratermoon wrote: post #60
TurningCanadian wrote: post #56

Did it actually break risk based authentication though? Sure, legitimate users will be using Apple's Relay, but what's stopping attackers from using it? If the users of the service are choosing to be indistinguishable from attackers, then that's on them. I think of it like reputation in real life. If you come knocking on my door, and I can see and recognize you, I'll open it. If you cover up my peephole or hide yours…

It broke it in the sense that it removed a signal that would allow the service to distinguish legit users from possibly malicious ones. In the case of a legit user that has in the past always authenticated from an IP address or address block geolocated to say, Seattle, the service can look at any authentication attempt from elsewhere as anomalous and raise additional challenges. However, with Relay, that signal is lo…

IIRC, in one of the WWDC talks, Apple's advice is stop relying on IP address as a signal of the user's location. Either make use of the location APIs on the platform or work out something different.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#80

Post by djrogers »

cglong wrote: post #78
marcinzm wrote: post #5

I find authentication the least problematic place where risk based on ip is used. Etsy, for example, will suspend your seller account if it sees too many logins from different IPs or if it's from an IP it has flagged before. It also has terrible seller customer service so it could take weeks to get it un-suspended. Heard of some people using Private Relay getting hit by this during the beta so hopefully Etsy gets rid…

My guess is that they'll just say Safari isn't supported and push people to Chrome.

You can’t really do that for iOS. Sure, I mean you technically could, but mobile chrome usage is so low that the blowback would be enormous.
Post reply on HN