Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's “iCloud Private Relay” broke risk based authentication

zitadel.ch

Post reply on HN
Print view View original

131–140 of 211 posts

Re: Apple's “iCloud Private Relay” broke risk based authentication

#131

Post by TurningCanadian »

__david__ wrote: post #129
TurningCanadian wrote: post #56

Did it actually break risk based authentication though? Sure, legitimate users will be using Apple's Relay, but what's stopping attackers from using it? If the users of the service are choosing to be indistinguishable from attackers, then that's on them. I think of it like reputation in real life. If you come knocking on my door, and I can see and recognize you, I'll open it. If you cover up my peephole or hide yours…

> If you cover up my peephole or hide yourself so that I can't recognize you, why would I even let you know I'm home? Even if you tell me who you are, shouldn't I be worried that someone is impersonating you? Perhaps… but if the culture changes and _everyone_ starts covering the peephole, regardless of their intentions, you'll eventually stop looking because you know it's pointless. That doesn't necessarily mean you'…

How would that alternative way of proving their unmaliciousness/identity not be a reinvention of the peephole?

Re: Apple's “iCloud Private Relay” broke risk based authentication

#132

Post by yunohn »

marcinzm wrote: post #5

I find authentication the least problematic place where risk based on ip is used. Etsy, for example, will suspend your seller account if it sees too many logins from different IPs or if it's from an IP it has flagged before. It also has terrible seller customer service so it could take weeks to get it un-suspended. Heard of some people using Private Relay getting hit by this during the beta so hopefully Etsy gets rid…

> I find authentication the least problematic place where risk based on ip is used.

I’m not an expert on Risk Based authentication, but your Etsy example sounds exactly like RBA. They use IP address as a factor in determining the risk associated with allowing the login, and suspend accounts with random IPs to prevent the “attacker” from wreaking havoc.

RBA: https://en.wikipedia.org/wiki/Risk-based_authentication

Re: Apple's “iCloud Private Relay” broke risk based authentication

#133

Post by Wowfunhappy »

marcinzm wrote: post #5

I find authentication the least problematic place where risk based on ip is used. Etsy, for example, will suspend your seller account if it sees too many logins from different IPs or if it's from an IP it has flagged before. It also has terrible seller customer service so it could take weeks to get it un-suspended. Heard of some people using Private Relay getting hit by this during the beta so hopefully Etsy gets rid…

I personally would like the ability to—for example—disable logging into my password manager from outside the US. It's been a decade since I last left the country (no particular reason), and if that changes, I can change the setting before I leave.

Could an attacker use a VPN? Sure—and there are also plenty of evildoers in the US. But it's an extra barrier.

What I really don't want, however, is for my password manager (or any other service) to make these decisions for me. I will probably travel some day, and when I do, I don't want to be locked out of my account due to "unusual traffic" (yes, it is unusual for me to travel, that doesn't mean it won't happen).

Re: Apple's “iCloud Private Relay” broke risk based authentication

#134

Post by [deleted] »

dividedbyzero wrote: post #57
snowwrestler wrote: post #50

Earlier quoted context omitted.

You have no control where your packets get routed on the Internet, by design of the basic protocols. Personal data should be protected by TLS (edit: and/or application-level encryption) so packet routing is irrelevant to privacy and data protection. I am very worried that the demand for protection of personal data (which is good) is mutating into an expectation of fully regional Internets that do not peer with each o…

If personal data from EU citizens is routed through the US in the clear or in a decryptable form, that's probably forbidden under the GDPR. There are exceptions, but this doesn't look like one of these. And while I may not have direct control over where my data is actually routed, but there absolutely are legal restrictions on where companies may route them.

[deleted]

Re: Apple's “iCloud Private Relay” broke risk based authentication

#135

Post by vinay_ys »

headmelted wrote: post #68
marcinzm wrote: post #5

I find authentication the least problematic place where risk based on ip is used. Etsy, for example, will suspend your seller account if it sees too many logins from different IPs or if it's from an IP it has flagged before. It also has terrible seller customer service so it could take weeks to get it un-suspended. Heard of some people using Private Relay getting hit by this during the beta so hopefully Etsy gets rid…

They will be forced to. That’s what’s different with iCloud relay - Apple’s weight to force changes upstream. Either Etsy changes their policy now during the beta (my guess is they will), or they change it in a panic in November when iPhones can no longer access the site to buy anything. (No-one is going to switch off private relay to convenience a single website).

More likely to happen: Apple's IP addresses get allowlisted.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#136

Post by frumper »

TurningCanadian wrote: post #127
djrogers wrote: post #92

Earlier quoted context omitted.

Whoah there Nelly! That’s a huge leap from ‘using built in privacy protection features of my phone’ to ‘choosing to be suspicious’. Why should everyone between me and my data have access to an IP address that is tied to my personal data? And when did choosing to not allow that become a shady thing to do? — edited autocorrect of ruins to features

It comes back to reputation. In the real world, we build up a reputation and people can choose to trust us based on it. That also means that they get to know us. I personally like being able to interact with people that I've built up a positive relationship with. Why doesn't that carry over to the virtual world though? I think everyone's view is tinted by the over-collection of data that some companies are doing. A r…

I understand what you're saying, but my mom sure will think its frustrating that a company she does business with is going to challenge her beyond the normal experience because apple lets her protect her privacy. After all, she's telling the company who she is by logging in.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#137

Post by snowwrestler »

dividedbyzero wrote: post #57
snowwrestler wrote: post #50

Earlier quoted context omitted.

You have no control where your packets get routed on the Internet, by design of the basic protocols. Personal data should be protected by TLS (edit: and/or application-level encryption) so packet routing is irrelevant to privacy and data protection. I am very worried that the demand for protection of personal data (which is good) is mutating into an expectation of fully regional Internets that do not peer with each o…

If personal data from EU citizens is routed through the US in the clear or in a decryptable form, that's probably forbidden under the GDPR. There are exceptions, but this doesn't look like one of these. And while I may not have direct control over where my data is actually routed, but there absolutely are legal restrictions on where companies may route them.

GDPR covers processing and storage of personal data. Packet routing is neither.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#138

Post by knodi »

vinay_ys wrote: post #135
headmelted wrote: post #68

Earlier quoted context omitted.

They will be forced to. That’s what’s different with iCloud relay - Apple’s weight to force changes upstream. Either Etsy changes their policy now during the beta (my guess is they will), or they change it in a panic in November when iPhones can no longer access the site to buy anything. (No-one is going to switch off private relay to convenience a single website).

More likely to happen: Apple's IP addresses get allowlisted.

There is no Apple's IP address with Private Relay. Apple is using 3rd part companies as its exit nodes to avoid this "whitelist apple ip addresses" concern.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#139

Post by frumper »

TurningCanadian wrote: post #128
cratermoon wrote: post #118

Earlier quoted context omitted.

> Why would my visitor be surprised that I'm suspicious though? They're choosing to be suspicious. I didn't say that. In the example I gave, you looked through your peephole and couldn't identify the visitor. Perhaps there's a problem with the peephole.

In the Apple Relay case, the person is deliberately making it impossible for me to determine who they are. It isn't a problem with my peephole. If there is a problem with my peephole, I'm still not trusting the person at the door until I can check it out and fix it.

The person at the door is changing one aspect of many and it's not even one that the person may even have any understanding about. They are very clearly saying their name to you.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#140

Post by Spooky23 »

donmcronald wrote: post #18

When Google Workplace locks users because of this, and I’m fairly sure they will because they’re super aggressive with IPs that change via VPN, they'll bounce incoming mail for that user. Have fun everyone!

IIRC that is a configuration choice by the company admin.

I can think of a few orgs that aggressively block VPN traffic from employees - in some cases the metadata leaked by the end user is a security risk. (Ie you’re doing work stuff in one tab and researching or doing related matters in another)

Post reply on HN