Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's “iCloud Private Relay” broke risk based authentication

zitadel.ch

Post reply on HN
Print view View original

181–190 of 211 posts

Re: Apple's “iCloud Private Relay” broke risk based authentication

#181

Post by astrange »

codetrotter wrote: post #161
astrange wrote: post #143

Earlier quoted context omitted.

Which is bad if you ever wanted to make a service without user accounts. Also a strange approach by Cloudflare, who sell IP based risk management.

> Also a strange approach by Cloudflare, who sell IP based risk management. Is it though? To me it seems more like the iCloud Private Relay will make it harder for everyone else maybe but not necessarily much harder for Cloudflare themselves.

Private relay puts you behind 2 proxies (which is almost as good as 7 proxies) so Cloudflare doesn't see your IP either.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#182

Post by lewisinc »

danudey wrote: post #152
barkerja wrote: post #111

Earlier quoted context omitted.

How many average Etsy users do you think would know that iCloud Private Relay is the cause of their issues?

They will google it and find a forum result somewhere that says "If you have iCloud, try turning off Private Relay. This solved the problem for me!" followed by a dozen other people saying 'Thanks so much, this fixed it for me too!" At least, it would if their Etsy accounts weren't getting locked until they can contact support. That said, the Etsy app won't be subject to Private Relay, so if the functionality is ther…

> They will google it

I'm sorry to tell you this, but sooo many people in the US alone are not technically literate enough to know how to debug an issue like this.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#183

Post by outloudvi »

r1ch wrote: post #76
matwood wrote: post #73

Earlier quoted context omitted.

It's buggy, but I've noticed the location has settled down and has me located in my same city now. Initially my IP was showing up all over the US. My guess is they were working on the logic and adding more CDNs. So far I've seen Cloudflare and Fastly.

How on earth are they proxying through Fastly? I would expect Fastly only sends requests to their customers origins, yet Apple is proxying requests through them to arbitrary websites. I wonder if you could abuse this to bypass ACLs on Fastly customers that block direct origin traffic.

Well... Cloudflare Workers does enable you to bypass CAPTCHA walls.

https://www.freebuf.com/articles/web/267964.html (Chinese)

Re: Apple's “iCloud Private Relay” broke risk based authentication

#184

Post by [deleted] »

r1ch wrote: post #103
gregsadetsky wrote: post #95

Earlier quoted context omitted.

Is it possible that the proxying is done via Cloudflare and Fastly's edge computing platforms? It'd be interesting to see where are the Relay requests coming from (i.e. what is the destination server seeing -- who's connecting to it?) Great point about the ACL.

In Cloudflare's case they already have a consumer-facing product that supports relaying over their network (WARP, with separate IP range versus their reverse proxy service) so Apple is likely using a variant of that. I was very surprised when I checked and saw Fastly on my iPad as I wasn't aware Fastly had any similar product, in my mind they are (were?) strictly a reverse proxy CDN.

[deleted]

Re: Apple's “iCloud Private Relay” broke risk based authentication

#185

Post by joshmanders »

danudey wrote: post #176
dlivingston wrote: post #163

Earlier quoted context omitted.

Maybe I’m missing something, but doesn’t your edge case validate my argument? In other words, your comment reads as “if everyone stops visiting Etsy, then they will make $0”, which…yeah. Makes sense to me.

More like "if I can choose arbitrary values for my variables I can make the equation say whatever I want, regardless of what the real values should be".

Except this formula is exactly how businesses determine what operating systems, browsers, and devices they support are.

They plug the numbers into the formula and see "If we block IE11 users from being able to use the site, we lose 1% of our traffic, which equates to X dollars. Is that a substantial amount? If so, we support IE11, if not, IE11 support goes out the door."

So yeah, you can plug in the numbers you did and try to negate his argument, but that doesn't make his argument wrong. Just means you understand the argument but fail to accept it.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#186

Post by Waterluvian »

breakfastduck wrote: post #171
danudey wrote: post #152

Earlier quoted context omitted.

They will google it and find a forum result somewhere that says "If you have iCloud, try turning off Private Relay. This solved the problem for me!" followed by a dozen other people saying 'Thanks so much, this fixed it for me too!" At least, it would if their Etsy accounts weren't getting locked until they can contact support. That said, the Etsy app won't be subject to Private Relay, so if the functionality is ther…

You would, sure. 99.9% of etsy userbase would not.

If there’s one lesson I badly want to see all engineers learn is that odds are they haven’t the faintest clue what it’s like to be a typical user.

99% of computer users do not inhabit the same galaxy as you do when it comes to understanding and managing technical details.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#187

Post by tmp538394722 »

danudey wrote: post #176
dlivingston wrote: post #163

Earlier quoted context omitted.

Maybe I’m missing something, but doesn’t your edge case validate my argument? In other words, your comment reads as “if everyone stops visiting Etsy, then they will make $0”, which…yeah. Makes sense to me.

More like "if I can choose arbitrary values for my variables I can make the equation say whatever I want, regardless of what the real values should be".

This was a better comment than your original sarcastic comment - the internet’s got enough vitriol, please don’t add to it.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#188

Post by Dylan16807 »

danudey wrote: post #176
dlivingston wrote: post #163

Earlier quoted context omitted.

Maybe I’m missing something, but doesn’t your edge case validate my argument? In other words, your comment reads as “if everyone stops visiting Etsy, then they will make $0”, which…yeah. Makes sense to me.

More like "if I can choose arbitrary values for my variables I can make the equation say whatever I want, regardless of what the real values should be".

1. It's weird that the values you pick lead to an example scenario where the person you're disagreeing with is even more right.

2. The point of the math was to show that it's a big deal for basically any reasonable values. It doesn't depend on the exact numbers.

Re: Apple's “iCloud Private Relay” broke risk based authentication

#190

Post by fomine3 »

matwood wrote: post #157
r1ch wrote: post #76

Earlier quoted context omitted.

How on earth are they proxying through Fastly? I would expect Fastly only sends requests to their customers origins, yet Apple is proxying requests through them to arbitrary websites. I wonder if you could abuse this to bypass ACLs on Fastly customers that block direct origin traffic.

> How on earth are they proxying through Fastly? Money solves a lot of problems. Fastly already has a geographically diverse set of servers, so I could see them building a feature like this just for Apple (at least initially).

Possibly supporting own relay is cheaper option than just accepting traffic from other companies' relay, but it depends on how they agreed peering to Apple.
Post reply on HN