Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPNs on iOS are a scam

michaelhorowitz.com

Post reply on HN
Print view View original

181–190 of 260 posts

Re: VPNs on iOS are a scam

#181

Post by rayhaanj »

agileAlligator wrote: post #177
_0w8t wrote: post #175

Earlier quoted context omitted.

To support multiple sites per IP the browser has to send DNS name of the site to the web server. Moreover, since certificates that the server uses for encryption depends on the site name, the name cannot be encrypted within HTTPS. So the browser sends the name in clear when initiating the connection. This is called SNI, server-name-identification. It is possible to encrypt SNI, but most sites do not support that as t…

Huh So HTTPS doesn't really stop tracking, it only prevents people from snooping on what data you are sending to and receiving from the website

There has been some work on encrypted server name indication: https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn...

Re: VPNs on iOS are a scam

#182

Post by ulimn »

alanfranz wrote: post #155

I think the analysis has some good points, but the author is lacking a bit of networking skills, so I’m not sure how trustworthy this can be. Two yellow flags: * vpn gateway address can be different from public vpn exit address. What is the surprising part? * I don’t know what pings your “uncloaked” public ip address, but still, when using a vpn, you’re using your own ip address to connect to the gateway. So, there’s…

> If you trust such a device for total anonymity, you’re doing it wrong from the start.

I think it greatly depends on your threat level and who you're hiding from.

Re: VPNs on iOS are a scam

#183

Post by sneak »

dcow wrote: post #145

I wonder if the author tried using an On Demand VPN rule for the default route. That's always what I've done when setting this stuff up. Correct me if I'm wrong, but you don't need a device management profile to enable an on-demand VPN for all traffic. Then, reboot your phone and all application traffic, or traffic that isn't something system (APNS) or management/link-local (dhcp, mdns, etc.) will use the tunnel.

APNS client cert is linked to your hardware serial, so by linking all your non-VPN client IPs together by serial, Apple gets your travel history due to city-level client IP geolocation.

Enough points (APNS is always connected, so whenever your phone is on) and this uniquely identifies you (even if the serial number wasn’t bought with your own credit card).

Then they have to give it to DHS/ICE/FBI/CIA without a warrant on demand, thanks to FAA702.

They, of course, already have all of the cell tower association records, as well as all of the Secure Flight program data from the TSA. It’s not a difficult query to figure out which serial numbers are which IMEIs are which humans.

Re: VPNs on iOS are a scam

#184

Post by eru »

Aaargh20318 wrote: post #31
mike_d wrote: post #22

Earlier quoted context omitted.

VPNs were always meant to carry internal traffic to a private network, not the public internet (hence the name Virtual Private Network). The fact that a VPN server can send you a route for 0.0.0.0/0 always was and always will be a happy accident.

> VPNs were always meant to carry internal traffic to a private network, not the public internet This. And the idea that these so called ‘VPN’ services somehow improve your security and privacy on the internet is laughable. All they do is let you get onto the public, untrusted, internet through a different on-ramp. There is no point to them. The internet is just as untrustworthy through a VPN service as it is through…

> There is no point to them.

There might be no point to their security and privacy, but they are still good for getting foreign-country Netflix.

Re: VPNs on iOS are a scam

#185

Post by sneak »

martin1975 wrote: post #4

This should trend to the top of HN. Apple bills themselves as a privacy-centric company. I hope they clean this up asap.

It is clear that Apple’s privacy efforts are only aimed at privacy for you from organisations that aren’t Apple.

Apple doesn’t really care about preserving your privacy from Apple (and by extension the FBI).

They maintain backdoors in iMessage specifically to preserve the ability of Apple/FBI to read your messages:

https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

The fact that Apple OSes leak your true IP (and thus city-level location) to Apple around your VPN is not an issue to Apple; it may even be intentionally preserved this way to aid investigations.

Re: VPNs on iOS are a scam

#186

Post by FabHK »

jart wrote: post #33
Youden wrote: post #13

Earlier quoted context omitted.

The issue in the article isn't that the VPN is sometimes inactive, it's that when the VPN is active, some traffic escapes the VPN. As far as I can see the linked page doesn't say that your VPN will leak unless you're using Always On. Plus, that page documents the VPN features built in to iOS itself, not VPNs provided by apps.

The ProtonMail article said it only applies to pre-existing connections, because iOS doesn't force them to close when an app enables its VPN. I'd be reluctant to call that a leak, unless it contradicts Apple's documented behaviors, which as far as I can tell make no mention of a systemwide VPN except for corporate "always on" ones. Besides, is there any reason why you can't just toggle airplane after enabling a consu…

> toggle airplane after enabling a consumer VPN to kill off the old connections?

That's discussed in the article.

Re: VPNs on iOS are a scam

#187

Post by FabHK »

1vuio0pswjnm7 wrote: post #115

"Data is leaving my iPad and not traveling through the VPN tunnel." It is is interesting how the iPad purchaser refers to "my iPad". He owns the computer. But how much control does he have over it. He runs an OS controlled by a HW manufacturer turned trillion dollar tracking and data collection company. (Apple computers are extremely chatty on any network and phone home 24/7. Apple is fervent about its need to collec…

> Today's Apple computers require some connection in the beginning to "sign-up", "register", download "approved" software, etc.

I believe that is not the case. It is strongly suggested during the sign-up process, and some functionality depends on it, but it is not required, as far as I know.

Re: VPNs on iOS are a scam

#189

Post by DavideNL »

...and then there is the Apple Watch which doesn't support VPN's as far as i know.

So, when apps can communicate from iPhone->Watch, even with a perfectly functioning VPN on the iPhone your public IP can leak via the Watch (if the app is also installed on the Watch.)

Re: VPNs on iOS are a scam

#190

Post by dTal »

Shared404 wrote: post #143
autoexec wrote: post #75

Earlier quoted context omitted.

> All they do is let you get onto the public, untrusted, internet through a different on-ramp. There is no point to them. Not true, at all. There are several good reasons to use VPNs to get a different on-ramp to the otherwise untrusted internet. - Avoid ISP tracking: Your ISP should see only traffic to and from the VPN. - Access content intended for those in other regions: Many sites and services only show certain c…

Thank you for saving me the typing. No it's not gonna make you an invisible unhackable ghost, but at least I don't have to worry about my ISP screwing me over.

Why are you worried about your ISP tracking you but not the VPN company? In effect you've simply added another ISP on top.
Post reply on HN