No post body was provided.
iOS VPNs have leaked traffic for years, researcher claims
11–20 of 40 posts
Re: iOS VPNs have leaked traffic for years, researcher claims
#12You can mitigate this by using a VPN router. I have a little GL.Inet router I use that ensures all traffic is passed through the VPN. The only caveat is you can’t travel with it even though they’re advertised as ‘travel routers’. You could use it in a hotel if you don’t trust random Wi-Fi hotspots. All I need is a .OVPN config file which I upload in the router’s admin dashboard, copy and paste my username and password and I’m set. A nice feature is if the VPN connection drops, the router doesn’t leak your IP.
Re: iOS VPNs have leaked traffic for years, researcher claims
#13The real issue here is that VPNs for security purposes has always been a hack or misuse of virtual private networks. The real intended use case for VPNs is right there in the name: extending a private network remotely. Persistent connection to this remote network and guarantees that all network traffic uses this virtual interface is not what VPNs are built for.
Re: iOS VPNs have leaked traffic for years, researcher claims
#14You can mitigate this by using a VPN router. I have a little GL.Inet router I use that ensures all traffic is passed through the VPN. The only caveat is you can’t travel with it even though they’re advertised as ‘travel routers’. You could use it in a hotel if you don’t trust random Wi-Fi hotspots. All I need is a .OVPN config file which I upload in the router’s admin dashboard, copy and paste my username and passwor…
Apple App Store mandates that their Apple network infrastructure shall not be impacted by an app (VPN, TailScale, WireGuard, et. al.)
In addition to unimpeded Apple network pathway, DNS resolver is being resolved by Apple DNS recursive DNS server during your tunneling setup, arguably resolving even just the IP address(es) as well as DNS names of VPN server.
More on this sad saga of Apple iOS and VPN, et. al.:
https://www.michaelhorowitz.com/VPNs.on.iOS.are.scam.php#whe...
Edit: of course, an external router would only leverage the WiFi part of iOS. We could use just the WiFi part of iOS and totally ignore the mysterious cellular traffic.
Re: iOS VPNs have leaked traffic for years, researcher claims
#15What about MacOS?
macOS networking is closer to BSD/Linux and is more able to be secured against any tunneling into Apple Network Infrastructure.
There is some pseudo netdev being used for tunneling into Apple Network infrastructure and they are blockable.
Re: iOS VPNs have leaked traffic for years, researcher claims
#16You can mitigate this by using a VPN router. I have a little GL.Inet router I use that ensures all traffic is passed through the VPN. The only caveat is you can’t travel with it even though they’re advertised as ‘travel routers’. You could use it in a hotel if you don’t trust random Wi-Fi hotspots. All I need is a .OVPN config file which I upload in the router’s admin dashboard, copy and paste my username and passwor…
Apple App Store mandates that their Apple network infrastructure shall not be impacted by an app (VPN, TailScale, WireGuard, et. al.) In addition to unimpeded Apple network pathway, DNS resolver is being resolved by Apple DNS recursive DNS server during your tunneling setup, arguably resolving even just the IP address(es) as well as DNS names of VPN server. More on this sad saga of Apple iOS and VPN, et. al.: https:/…
I’m not talking about an app. I’m talking about a router that VPN-ifies all your traffic to mitigate any form of leak. That article talks about iOS leaking traffic when using VPN apps. A VPN router is the only solution to stop this from happening.
Re: iOS VPNs have leaked traffic for years, researcher claims
#17Even WireGuard is also impacted on iOS. The author of WireGuard lamented that certain network pathway must be preserved for existing Apple infrastructure before WireGuard app can be approved and made available by Apple App Store. So, there is no easy way to catalogue what kind of cellular data traffic unless we magically ran a network capture (WireSHARK) at cell tower level or root our iOS phone. I do do know for iOS…
Man, it sure would be nice if you could just... install an app without Apple's permission. Sure seems like they aren't looking out for your privacy or safety, in this situation.
Re: iOS VPNs have leaked traffic for years, researcher claims
#18Earlier quoted context omitted.
Apple App Store mandates that their Apple network infrastructure shall not be impacted by an app (VPN, TailScale, WireGuard, et. al.) In addition to unimpeded Apple network pathway, DNS resolver is being resolved by Apple DNS recursive DNS server during your tunneling setup, arguably resolving even just the IP address(es) as well as DNS names of VPN server. More on this sad saga of Apple iOS and VPN, et. al.: https:/…
I’m not talking about an app. I’m talking about a router that VPN-ifies all your traffic to mitigate any form of leak. That article talks about iOS leaking traffic when using VPN apps. A VPN router is the only solution to stop this from happening.
Or you can just use a different device. There's plenty of hardware/software that respects your VPN routing rules, Apple is the outlier here. You don't need a complicated racked-and-stacked Ubiquiti when kernel-level WireGuard will do the trick.
Re: iOS VPNs have leaked traffic for years, researcher claims
#19This is why I use a "slug" when I use a VPN:
https://john.kozubik.com/pub/NetworkSlug/tip.html
"A Network Slug, or "Slug", is a transparent layer 2 firewall running on a device with only two interfaces ..."
"So, while the device participates on the physical layer of the (probably ethernet) network, it does not have an IP address and cannot answer IP (or even ICMP) requests ..."
In my case, if I needed a VPN, I would use the excellent 'sshuttle' on, for instance, port 40 and then set the slug to allow only TCP port 40 and nothing else.
No misconfiguration possible. No footguns.
Re: iOS VPNs have leaked traffic for years, researcher claims
#20Even WireGuard is also impacted on iOS. The author of WireGuard lamented that certain network pathway must be preserved for existing Apple infrastructure before WireGuard app can be approved and made available by Apple App Store. So, there is no easy way to catalogue what kind of cellular data traffic unless we magically ran a network capture (WireSHARK) at cell tower level or root our iOS phone. I do do know for iOS…
Man, it sure would be nice if you could just... install an app without Apple's permission. Sure seems like they aren't looking out for your privacy or safety, in this situation.
That would have no effect on the situation being described.
A side loaded app would still be beholden to the OS networking stack.