Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's “iCloud Private Relay” broke risk based authentication

zitadel.ch

Post reply on HN
Print view View original

171–180 of 211 posts

Re: Apple's “iCloud Private Relay” broke risk based authentication

#171

Post by breakfastduck »

danudey wrote: post #152
barkerja wrote: post #111

Earlier quoted context omitted.

How many average Etsy users do you think would know that iCloud Private Relay is the cause of their issues?

They will google it and find a forum result somewhere that says "If you have iCloud, try turning off Private Relay. This solved the problem for me!" followed by a dozen other people saying 'Thanks so much, this fixed it for me too!" At least, it would if their Etsy accounts weren't getting locked until they can contact support. That said, the Etsy app won't be subject to Private Relay, so if the functionality is ther…

You would, sure.

99.9% of etsy userbase would not.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#172

Post by [deleted] »

headmelted wrote: post #68
marcinzm wrote: post #5

I find authentication the least problematic place where risk based on ip is used. Etsy, for example, will suspend your seller account if it sees too many logins from different IPs or if it's from an IP it has flagged before. It also has terrible seller customer service so it could take weeks to get it un-suspended. Heard of some people using Private Relay getting hit by this during the beta so hopefully Etsy gets rid…

They will be forced to. That’s what’s different with iCloud relay - Apple’s weight to force changes upstream. Either Etsy changes their policy now during the beta (my guess is they will), or they change it in a panic in November when iPhones can no longer access the site to buy anything. (No-one is going to switch off private relay to convenience a single website).

[deleted]

Re: Apple's “iCloud Private Relay” broke risk based authentication

#173

Post by SheinhardtWigCo »

ratww wrote: post #146
supertrope wrote: post #104

Earlier quoted context omitted.

Vendors do that because they’re left holding the bag in chargebacks. Addresses are de facto knowledge based authentication questions in lieu of dynamic credit card codes.

Isn’t 3d Secure a thing in the US? I have a little app in my phone from my credit card company where I confirm when I am really buying something and it looks more secure than relying on fraud detection.

3DS1 isn't because it leads to unacceptable cart abandonment rates, but 3DS2 is designed to address that problem by using SMS or app-based authentication for only high-risk transactions, instead of username and password for every transaction.

SCA is therefore likely to become a requirement in the US once it's reached maturity in Europe, as we saw with EMV.

Further reading: https://www.jonesday.com/en/insights/2020/12/strong-customer...

Re: Apple's “iCloud Private Relay” broke risk based authentication

#174

Post by banana_giraffe »

Boerworz wrote: post #164
knodi wrote: post #138

Earlier quoted context omitted.

There is no Apple's IP address with Private Relay. Apple is using 3rd part companies as its exit nodes to avoid this "whitelist apple ip addresses" concern.

The "Get ready for iCloud Private Relay" session[1] from this year's WWDC makes it seem like there will be a publicly available list of IP addresses used by Private Relay: Private Relay guarantees that users can't use the system to pretend to be from a different region, so you can continue to enforce region-based access restrictions. Details about the proxy IP addresses will be available as an article associated with…

Here's the article:

https://developer.apple.com/support/prepare-your-network-for...

And their IPs, as mentioned in that article:

https://mask-api.icloud.com/egress-ip-ranges.csv

Seems to be mostly Fastly IP addresses right now, but I'm sure that'll change over time.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#176

Post by danudey »

dlivingston wrote: post #163
danudey wrote: post #154

Earlier quoted context omitted.

This is an interesting breakdown, but here's my analysis: Let's say that ~100% of Etsy.com views are through Safari. Of those, 100% have iCloud+. Let's say they did this and 0% of people visit the site through chrome. That's 100% less revenue for them. Pretty amazing that this one feature could completely kill Etsy's revenue stream. (For what it's worth, I agree with you that Etsy is not going to tell Safari users to…

Maybe I’m missing something, but doesn’t your edge case validate my argument? In other words, your comment reads as “if everyone stops visiting Etsy, then they will make $0”, which…yeah. Makes sense to me.

More like "if I can choose arbitrary values for my variables I can make the equation say whatever I want, regardless of what the real values should be".

Re: Apple's “iCloud Private Relay” broke risk based authentication

#177

Post by asdfasgasdgasdg »

xoa wrote: post #40
danceparty wrote: post #10

Earlier quoted context omitted.

Private relay will egress from the same general region as the client source location. So if you’re in switzerland and hopping through a US exit point that is a bug. This is clearly explained in the wwdc video

Yeah, and there are solid performance reasons for that too even beyond any legal/privacy ones. Relaying across an ocean could actually be a fairly significant latency hit in many cases. Services that are completely focused on privacy even against some level of state actions (like Tor) may just accept and eat that, but that's not definitely not the threat scenario Apple is targeting and it would diminish its appeal as…

All depends on where the destination server is. If the destination is in the U.S., you might benefit from your traffic being routed through Apple's private network.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#178

Post by danudey »

user-the-name wrote: post #168
danudey wrote: post #152

Earlier quoted context omitted.

They will google it and find a forum result somewhere that says "If you have iCloud, try turning off Private Relay. This solved the problem for me!" followed by a dozen other people saying 'Thanks so much, this fixed it for me too!" At least, it would if their Etsy accounts weren't getting locked until they can contact support. That said, the Etsy app won't be subject to Private Relay, so if the functionality is ther…

> That said, the Etsy app won't be subject to Private Relay Why? As far as I know it will apply to apps as well.

Per the WWDC talk on it: https://developer.apple.com/videos/play/wwdc2021/10096/

> In iOS 15 and macOS 12, Private Relay will apply to all web browsing in Safari, all DNS name resolution queries, and a small subset of traffic from apps.

> Specifically, this will include all insecure HTTP traffic, such as TCP port 80.

This implies that app traffic won't apply to HTTPS traffic, which supports my assertion, but then later in the video:

> Not all networking done by your app occurs over the public internet, so there are several categories of traffic that are not affected by Private Relay.

> Any connections your app makes over the local network or to private domain names will be unaffected.

> Similarly, if your app provides a network extension to add VPN or app-proxying capabilities, your extension won't use Private Relay and neither will app traffic that uses your extension.

> Traffic that uses a proxy is also exempt.

So this says that HTTPS traffic will be included, which disproves my assertion, and seems more likely to be true.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#179

Post by user-the-name »

danudey wrote: post #178
user-the-name wrote: post #168

Earlier quoted context omitted.

> That said, the Etsy app won't be subject to Private Relay Why? As far as I know it will apply to apps as well.

Per the WWDC talk on it: https://developer.apple.com/videos/play/wwdc2021/10096/ > In iOS 15 and macOS 12, Private Relay will apply to all web browsing in Safari, all DNS name resolution queries, and a small subset of traffic from apps. > Specifically, this will include all insecure HTTP traffic, such as TCP port 80. This implies that app traffic won't apply to HTTPS traffic, which supports my assertion, but then lat…

Yeah, they are not being very clear, which is nothing new for Apple. But usually, you get closest to the truth if you look at what their intent is, and in this case, the intent is to limit the ability to track users, and there is no reason they would make a distinction between web users and app users there.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#180

Post by shuckles »

sneak wrote: post #156
snowwrestler wrote: post #50

Earlier quoted context omitted.

You have no control where your packets get routed on the Internet, by design of the basic protocols. Personal data should be protected by TLS (edit: and/or application-level encryption) so packet routing is irrelevant to privacy and data protection. I am very worried that the demand for protection of personal data (which is good) is mutating into an expectation of fully regional Internets that do not peer with each o…

I thought private relay was supposed to exempt TLS traffic, and serve to protect unencrypted HTTP and DNS?

That’s the (current) rule for app network traffic. Traffic from Safari includes all network connections for iCloud subscribers.
Post reply on HN