Live data from Hacker News

VPNs on iOS are a scam

michaelhorowitz.com

91–100 of 260 posts

Re: VPNs on iOS are a scam

#91
If only you could easily print out the routing table and/or modify it so you could direct the traffic exactly where you want it (i.e. stuff it all through the VPN tunnel)...

...and that's when you realise that trying to configure a device to which you do not actually have full control of is a futile endeavour.

As such, in agreement with many of the others here, I don't consider this much of a bug nor a "scam". It's merely an effect of what VPNs are (an additional network interface) and how routing works, combined with a device whose manufacturer deliberately does not want to put users in full control of the routing table.

Re: VPNs on iOS are a scam

#92
post #83

Earlier quoted context omitted.

VPNs were used primarily by companies to allow secure access to their network from the outside. It doesn't surprise me that documents aimed at businesses running Windows servers would describe them in the context of that use case. It doesn't mean that was the entire point, or purpose. It's just one thing they were commonly used for.

> VPNs were used primarily by companies to allow secure access to their network from the outside. Yeah, that was the entire argument.

At the same time that I was working at an ISP on a product that would let employees from various companies connect via dial up and VPN into their corporate networks (whose gateways were also on our network) several of my co-workers were using a VPN of their own to connect to their home networks, but not to access the resources on those home networks (although some did that too). They wanted to use the internet from their machines at home in order to hide their internet activity from our IT department.

This is basically the same thing people do with VPNs now, only instead of hiding their internet activity from IT, they hide it from their ISP.

VPNs were always used for things other than connecting someone to a corporate network, it's just that most of the general internet population at that time (and I'm guessing you're old enough to remember this) were not aware of the technology and not tech savvy enough to set it up. This is true even for the employees of the companies we had as customers. We had to build entire software products that did nothing but hand hold people through setting up a dial up networking connection. It's not surprising that corporations were the majority users of VPN technology until the rest of the public (who don't have IT staff) caught up, at which point it became increasingly more common for people to use it to hide their internet traffic.

Re: VPNs on iOS are a scam

#93
post #22

Earlier quoted context omitted.

That Apple documents that 'normal' VPNs are broken on iOS doesn't change the fact that they're broken.

VPNs were always meant to carry internal traffic to a private network, not the public internet (hence the name Virtual Private Network). The fact that a VPN server can send you a route for 0.0.0.0/0 always was and always will be a happy accident.

Maybe that wasn't the original intent, but it's a designed and supported configuration. Many places don't want a fleet of Windows laptops to become network bridges to their intranet. The default configuration for most VPN setups is to route all traffic. If you want to selectively route traffic, you have to specifically set up a split tunnel.

While you could only route client traffic to an intranet endpoint and prevent access to any external services, that wouldn't be very practical in most deployments so a proxy is added on top. This type of deployment is common and has been used for decades.

Re: VPNs on iOS are a scam

#94
post #22

Earlier quoted context omitted.

That Apple documents that 'normal' VPNs are broken on iOS doesn't change the fact that they're broken.

VPNs were always meant to carry internal traffic to a private network, not the public internet (hence the name Virtual Private Network). The fact that a VPN server can send you a route for 0.0.0.0/0 always was and always will be a happy accident.

We should start calling them vISP or something.

Re: VPNs on iOS are a scam

#95
post #83

Earlier quoted context omitted.

> VPNs were used primarily by companies to allow secure access to their network from the outside. Yeah, that was the entire argument.

At the same time that I was working at an ISP on a product that would let employees from various companies connect via dial up and VPN into their corporate networks (whose gateways were also on our network) several of my co-workers were using a VPN of their own to connect to their home networks, but not to access the resources on those home networks (although some did that too). They wanted to use the internet from t…

I don't doubt that, I was replying to this:

> You are wrong on this, the private part indicates the privacy it provides not the destination.

In your own recollection, what do you think "Virtual Private Network" stood for? Connecting private networks together, or privacy?

Re: VPNs on iOS are a scam

#97
post #62

It's also worth pointing out that tethered/hotspot data shared to the iPhone with a VPN enabled at the iPhone level will not travel through the VPN, but will rather leak your phone's IP: https://apple.stackexchange.com/questions/266871/is-there-a-...

That seems like expected behavior, or at least one worth testing with an IP checker or something on the tethered device. I would be pretty surprised if I connected to a VPN on my mobile device, then tethered to it, and my traffic went over the VPN tunnel. I would just establish a VPN tunnel on the tethered device if I wanted that.

Re: VPNs on iOS are a scam

#98
post #45

This should trend to the top of HN. Apple bills themselves as a privacy-centric company. I hope they clean this up asap.

iOS devices create lot of weird traffic on local network. And the only meanigful-ish other packet trace seems like APNS subscription update and some kind of iCloud traffic, there is probably zero reason why would you want that to go through “VPN” tunnel.

There are times when it might be useful to separate out different types of traffic to separate interfaces. I kind of wish there was an easy way to set rules like "Anything I do over these applications should go through the VPN, some of the random traffic my OS constantly spews in the background should be sent through the unsecured connection, but anything going out to these networks should just be blackholed" but I haven't come across one.

Re: VPNs on iOS are a scam

#99

Airplane Mode used to be a true “all wireless disabled” mode, but Apple have relaxed it a bit over time, possibly because it's so frequently used and there are so many services provided by WiFi and Bluetooth now that aren't related to the Internet (e.g. connecting to AirPods or an Apple Watch). They also relaxed what turning off WiFi and Bluetooth in the Control Center (separately from Airplane Mode) do, so that thin…

I think airplane mode is intended to comply with the rules for using the device on an airplane. That used to be no radios whatsoever (and device turned off during takeoff and landing). The rules on aircraft changed, so the feature was updated.

I suspect they wanted the feature changed because it gives them better data when tracking you and other nearby devices and that once the rules for airlines changed they figured they could get away with giving users a false sense of security, which is why the feature is still called "airplane mode" which the public understands to mean everything is disconnected even though that's no longer the case.

Re: VPNs on iOS are a scam

#100
post #55

Earlier quoted context omitted.

Tailscale + Pihole works well, https://tailscale.com/kb/1114/pi-hole/

I use this setup to get mobile adblock while on Verizon (iOS sadly has never let you override the default DNS server for cellular, just wifi). It works more or less perfectly, albeit with a noticeable hit to device battery life... so much so my wife who otherwise loves PiHole on the home network refuses to use it on her iPhone. Using iOS's built in support for browser adblockers is largely as effective and doesn't co…

Does the built in blocker block ads outside of the browser though?
Post reply on HN