Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's “iCloud Private Relay” broke risk based authentication

zitadel.ch

Post reply on HN
Print view View original

91–100 of 211 posts

Re: Apple's “iCloud Private Relay” broke risk based authentication

#91

Post by 2OEH8eoCRo0 »

TurningCanadian wrote: post #56

Did it actually break risk based authentication though? Sure, legitimate users will be using Apple's Relay, but what's stopping attackers from using it? If the users of the service are choosing to be indistinguishable from attackers, then that's on them. I think of it like reputation in real life. If you come knocking on my door, and I can see and recognize you, I'll open it. If you cover up my peephole or hide yours…

>If the users of the service are choosing to be indistinguishable from attackers, then that's on them.

No. It's not on me to justify my use-case. How the hell did we get here?

Re: Apple's “iCloud Private Relay” broke risk based authentication

#92

Post by djrogers »

TurningCanadian wrote: post #74
cratermoon wrote: post #60

Earlier quoted context omitted.

It broke it in the sense that it removed a signal that would allow the service to distinguish legit users from possibly malicious ones. In the case of a legit user that has in the past always authenticated from an IP address or address block geolocated to say, Seattle, the service can look at any authentication attempt from elsewhere as anomalous and raise additional challenges. However, with Relay, that signal is lo…

Why would my visitor be surprised that I'm suspicious though? They're choosing to be suspicious. Another analogy I could make is someone that is blocking their caller ID. Should they be surprised that fewer people will take their call? They're lumping themselves in with spammers. I think Apple -- and anonymizing proxy/VPN services in general -- should be communicating that to their customers.

Whoah there Nelly! That’s a huge leap from ‘using built in privacy protection features of my phone’ to ‘choosing to be suspicious’.

Why should everyone between me and my data have access to an IP address that is tied to my personal data? And when did choosing to not allow that become a shady thing to do?

— edited autocorrect of ruins to features

Re: Apple's “iCloud Private Relay” broke risk based authentication

#93

Post by marcinzm »

headmelted wrote: post #68
marcinzm wrote: post #5

I find authentication the least problematic place where risk based on ip is used. Etsy, for example, will suspend your seller account if it sees too many logins from different IPs or if it's from an IP it has flagged before. It also has terrible seller customer service so it could take weeks to get it un-suspended. Heard of some people using Private Relay getting hit by this during the beta so hopefully Etsy gets rid…

They will be forced to. That’s what’s different with iCloud relay - Apple’s weight to force changes upstream. Either Etsy changes their policy now during the beta (my guess is they will), or they change it in a panic in November when iPhones can no longer access the site to buy anything. (No-one is going to switch off private relay to convenience a single website).

>(No-one is going to switch off private relay to convenience a single website)

If you're a seller and a decent chunk of your income comes from Etsy you definitely would. They already do that with avoiding VPNs to not get suspended.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#94

Post by djrogers »

klohto wrote: post #36
donohoe wrote: post #32

Just occurred to me that Apple’s upcoming iCloud Private Relay will break nearly all GDPR solutions. Am guessing this has been written up already be someone. Any good perspectives?

How? The data stays in EU. Routing to US is clearly a bug (that violates it, yes)

Doubt it violates anything - the packets may route through a US based relay, but they’re encrypted when they do, and don’t expose any data.

The very nature of the internet makes it impossible to guarantee that none of your packets ever route through a specific country (especially one as connected as the US).

Re: Apple's “iCloud Private Relay” broke risk based authentication

#95

Post by gregsadetsky »

r1ch wrote: post #76
matwood wrote: post #73

Earlier quoted context omitted.

It's buggy, but I've noticed the location has settled down and has me located in my same city now. Initially my IP was showing up all over the US. My guess is they were working on the logic and adding more CDNs. So far I've seen Cloudflare and Fastly.

How on earth are they proxying through Fastly? I would expect Fastly only sends requests to their customers origins, yet Apple is proxying requests through them to arbitrary websites. I wonder if you could abuse this to bypass ACLs on Fastly customers that block direct origin traffic.

Is it possible that the proxying is done via Cloudflare and Fastly's edge computing platforms? It'd be interesting to see where are the Relay requests coming from (i.e. what is the destination server seeing -- who's connecting to it?)

Great point about the ACL.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#96

Post by ffo »

djrogers wrote: post #86
csunbird wrote: post #52

Earlier quoted context omitted.

It is easier for US to ask Apple to monitor the traffic for a specific user, if the exit node is in US soil. Although the sibling comments say that it is probably a bug, and I hope that it actually is.

Thanks to the design of Private Relay, apple can’t monitor a specific user’s traffic.

From a design perspective you are right.

But from a threat model I would dare to say, if you control the platform (OS, Cloud Service) you can easy bypass encryption or deploy your own keys as well.

In the end it is still a trust question.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#98

Post by ffo »

meepmorp wrote: post #89
vmception wrote: post #61

“Welcome back! Hey looks like you are using a new device, how about we just ignore that greeting and use this other separate login process every fucking session”

secure, httponly cookies exist and just might help in easing that pain point.

hey don't forget samesite ;-)

Re: Apple's “iCloud Private Relay” broke risk based authentication

#99

Post by grishka »

wyager wrote: post #90
james_pm wrote: post #34

We're anticipating having to make some changes to our fraud scoring which uses things like location vs. credit card address as signals.

Good. I’m tired of wasting my time with dumb bullshit like vendors thinking my credit card billing address is “suspicious” somehow.

So many companies insist I provide them a "billing address", except I don't have one, it's a uniquely North American thing. Filling that form with gibberish usually does the trick for me.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#100

Post by nuker »

TurningCanadian wrote: post #74
cratermoon wrote: post #60

Earlier quoted context omitted.

It broke it in the sense that it removed a signal that would allow the service to distinguish legit users from possibly malicious ones. In the case of a legit user that has in the past always authenticated from an IP address or address block geolocated to say, Seattle, the service can look at any authentication attempt from elsewhere as anomalous and raise additional challenges. However, with Relay, that signal is lo…

Why would my visitor be surprised that I'm suspicious though? They're choosing to be suspicious. Another analogy I could make is someone that is blocking their caller ID. Should they be surprised that fewer people will take their call? They're lumping themselves in with spammers. I think Apple -- and anonymizing proxy/VPN services in general -- should be communicating that to their customers.

> someone that is blocking their caller ID.

They do give you valid login and password, why is that not enough?

Post reply on HN