Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPNs on iOS are a scam

michaelhorowitz.com

Post reply on HN
Print view View original

31–40 of 260 posts

Re: VPNs on iOS are a scam

#31

Post by Aaargh20318 »

mike_d wrote: post #22
cmeacham98 wrote: post #7

Earlier quoted context omitted.

That Apple documents that 'normal' VPNs are broken on iOS doesn't change the fact that they're broken.

VPNs were always meant to carry internal traffic to a private network, not the public internet (hence the name Virtual Private Network). The fact that a VPN server can send you a route for 0.0.0.0/0 always was and always will be a happy accident.

> VPNs were always meant to carry internal traffic to a private network, not the public internet

This. And the idea that these so called ‘VPN’ services somehow improve your security and privacy on the internet is laughable. All they do is let you get onto the public, untrusted, internet through a different on-ramp. There is no point to them. The internet is just as untrustworthy through a VPN service as it is through any other internet connection.

Re: VPNs on iOS are a scam

#32

Post by tedunangst »

ceejayoz wrote: post #19
vbezhenar wrote: post #8

Earlier quoted context omitted.

Warp is not designed to hide your address. If website is behind cloudflare, it'll know your IP address. If website is not behind cloudflare, your address will not be available.

That doesn’t sound right. https://blog.cloudflare.com/warp-for-desktop/ > WARP was built on the philosophy that even people who don’t know what “VPN” stands for should be able to still easily get the protection a VPN offers.

Crazy that cloudflare's marketing wouldn't be entirely forthcoming.

Re: VPNs on iOS are a scam

#33

Post by jart »

Youden wrote: post #13
kogir wrote: post #5

I think Apple is transparent about Always on VPN (blocking traffic except over the tunnel) requiring provisioning using MDM tools. Apple Configurator is free and allows anyone to set this up. Any other VPN is just best effort. https://support.apple.com/guide/deployment/vpn-overview-depa...

The issue in the article isn't that the VPN is sometimes inactive, it's that when the VPN is active, some traffic escapes the VPN. As far as I can see the linked page doesn't say that your VPN will leak unless you're using Always On. Plus, that page documents the VPN features built in to iOS itself, not VPNs provided by apps.

The ProtonMail article said it only applies to pre-existing connections, because iOS doesn't force them to close when an app enables its VPN. I'd be reluctant to call that a leak, unless it contradicts Apple's documented behaviors, which as far as I can tell make no mention of a systemwide VPN except for corporate "always on" ones. Besides, is there any reason why you can't just toggle airplane after enabling a consumer VPN to kill off the old connections? Then it should probably be fine.

Re: VPNs on iOS are a scam

#34

Post by hkpack »

I was developing VPN client for one of the popular VPN provider in the past for iOS and the solution was quite simple - enable on-demand VPN for 0.0.0.0/0

In this case, iOS will always wait until connection to VPN is established before sending any packets out.

Without on-demand, VPN may leak.

If I remember correctly, leaks occurred mostly after waking from sleep but before the tunnel had chance to be set up. Or in similar situations. Anyway, on-demand option solved all of them.

Re: VPNs on iOS are a scam

#35

Post by _8j50 »

mike_d wrote: post #22
cmeacham98 wrote: post #7

Earlier quoted context omitted.

That Apple documents that 'normal' VPNs are broken on iOS doesn't change the fact that they're broken.

VPNs were always meant to carry internal traffic to a private network, not the public internet (hence the name Virtual Private Network). The fact that a VPN server can send you a route for 0.0.0.0/0 always was and always will be a happy accident.

[flagged]

Re: VPNs on iOS are a scam

#36

Post by w14 »

Aaargh20318 wrote: post #31
mike_d wrote: post #22

Earlier quoted context omitted.

VPNs were always meant to carry internal traffic to a private network, not the public internet (hence the name Virtual Private Network). The fact that a VPN server can send you a route for 0.0.0.0/0 always was and always will be a happy accident.

> VPNs were always meant to carry internal traffic to a private network, not the public internet This. And the idea that these so called ‘VPN’ services somehow improve your security and privacy on the internet is laughable. All they do is let you get onto the public, untrusted, internet through a different on-ramp. There is no point to them. The internet is just as untrustworthy through a VPN service as it is through…

> There is no point to them.

What about this?

"Under the provisions of the Investigatory Powers (IP) Act, it is now possible for the Law Enforcement Agency (LEA) community to lawfully obtain Internet Connection Records (ICR) in support of their investigations. Following the completion of some initial trial activities, work is now underway to provision a national ICR service."

https://www.digitalmarketplace.service.gov.uk/digital-outcom...

Re: VPNs on iOS are a scam

#37

Post by TazeTSchnitzel »

Airplane Mode used to be a true “all wireless disabled” mode, but Apple have relaxed it a bit over time, possibly because it's so frequently used and there are so many services provided by WiFi and Bluetooth now that aren't related to the Internet (e.g. connecting to AirPods or an Apple Watch). They also relaxed what turning off WiFi and Bluetooth in the Control Center (separately from Airplane Mode) do, so that things like AirDrop still work. But I think the options in the Settings app are still meant to truly turn off wireless, rather than just mostly?

Also: if Settings says you're connected to a WiFi network, but you don't see a WiFi icon at the top of the screen, I think that means there's no working Internet connection.

Re: VPNs on iOS are a scam

#38

Post by Shank »

ceejayoz wrote: post #19
vbezhenar wrote: post #8

Earlier quoted context omitted.

Warp is not designed to hide your address. If website is behind cloudflare, it'll know your IP address. If website is not behind cloudflare, your address will not be available.

That doesn’t sound right. https://blog.cloudflare.com/warp-for-desktop/ > WARP was built on the philosophy that even people who don’t know what “VPN” stands for should be able to still easily get the protection a VPN offers.

> From a technical perspective, WARP is a VPN. But it is designed for a very different audience than a traditional VPN. WARP is not designed to allow you to access geo-restricted content when you’re traveling. It will not hide your IP address from the websites you visit. If you’re looking for that kind of high-security protection then a traditional VPN or a service like Tor are likely better choices for you.

See: https://blog.cloudflare.com/announcing-warp-plus/

Re: VPNs on iOS are a scam

#39

Post by anyfoo »

_8j50 wrote: post #35
mike_d wrote: post #22

Earlier quoted context omitted.

VPNs were always meant to carry internal traffic to a private network, not the public internet (hence the name Virtual Private Network). The fact that a VPN server can send you a route for 0.0.0.0/0 always was and always will be a happy accident.

[flagged]

> You are wrong on this, the private part indicates the privacy it provides not the destination.

I remember using VPNs long before, to my knowledge, people were using them in the way you describe, and I was always under the impression that the "P" in VPN meant "connecting private networks" together over the Internet.

This document from 2001 agrees with me: https://docs.microsoft.com/en-us/previous-versions/windows/i... "From the user’s perspective, the VPN connection is a point-to-point connection between the user’s computer and a corporate server. The nature of the intermediate internetwork is irrelevant to the user because it appears as if the data is being sent over a dedicated private link."

Re: VPNs on iOS are a scam

#40

Post by happyopossum »

_8j50 wrote: post #35
mike_d wrote: post #22

Earlier quoted context omitted.

VPNs were always meant to carry internal traffic to a private network, not the public internet (hence the name Virtual Private Network). The fact that a VPN server can send you a route for 0.0.0.0/0 always was and always will be a happy accident.

[flagged]

> You are wrong on this, the private part indicates the privacy it provides not the destination.

Sorry - that's just not the case, you're retconning VPN terminology. VPNs were originally implemented to replace dedicated WANs and dial-in access to private networks - they were not originally designed to provide privacy for individual access to the Internet. Heck, even the RFC for VPN terminology makes that clear (RFC 2764 is over 20 years old).

Oh, and this: > There have always been client-access VPNs

If your first exposure to VPNs was from shady privacy-snake-oil salesmen, I can see how you'd think this, but take it from the people who were there before client based VPN access was even a thing: Site-to-Site VPN was the original use case for VPN, and you didn't waste tunnel bandwidth (encryption chips were slow and expensive back in the day) routing general internet traffic over your tunnel...

Post reply on HN