Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay

mysk.blog

Post reply on HN
Print view View original

11–20 of 45 posts

Re: IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay

#11

Post by internet2000 »

walrus01 wrote: post #9

Weird advertising on site: "Psylo is our privacy-first browser for iOS and iPadOS" Correct me if I'm wrong but doesn't Apple disallow any actual 3rd party browser engines? Like, any browser on iOS that isn't the standard safari is just a skin on top of webkit/safari. It doesn't exactly inspire confidence that some third party browser will be able to implement things any better (as compared to like, running Firefox on…

Networking is not handled by the rendering engine, which is an only a part of a browser app. That’s a credible claim.

Re: IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay

#12

Post by dabbz »

exabrial wrote: post #4
TechRemarker wrote: post #3

Earlier quoted context omitted.

You can turn if off in settings > iCloud. Either temporary for a day and auto back on, or permanently until you turn it back on.

Yep, but one cannot script that, make it a part of a bash or automator actions, which is a problem.

There's a PLIST entry possibly relevant to it in `~/Library/Preferences/com.apple.networkserviceproxy.plist`

I couldn't figure out how to get any changes to reflect but maybe it's a good pointer towards a solution?

EDIT: Reading into this, looks like they're very intentional about not allowing arbitrary enable/disable calls to it, likely to prevent a hostile entity from switching it off on unsuspecting users. The systems setting calls an XPC into a daemon that makes a web request, then validates the response from the API to update the PLIST structure.

Re: IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay

#13

Post by TingPing »

internet2000 wrote: post #11
walrus01 wrote: post #9

Weird advertising on site: "Psylo is our privacy-first browser for iOS and iPadOS" Correct me if I'm wrong but doesn't Apple disallow any actual 3rd party browser engines? Like, any browser on iOS that isn't the standard safari is just a skin on top of webkit/safari. It doesn't exactly inspire confidence that some third party browser will be able to implement things any better (as compared to like, running Firefox on…

Networking is not handled by the rendering engine, which is an only a part of a browser app. That’s a credible claim.

Networking is very core to webkit of course. But it has apis to block and modify requests.

Re: IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay

#14

Post by hnav »

walrus01 wrote: post #9

Weird advertising on site: "Psylo is our privacy-first browser for iOS and iPadOS" Correct me if I'm wrong but doesn't Apple disallow any actual 3rd party browser engines? Like, any browser on iOS that isn't the standard safari is just a skin on top of webkit/safari. It doesn't exactly inspire confidence that some third party browser will be able to implement things any better (as compared to like, running Firefox on…

My read is that the main value prop is that they configure the WKWebView to not share any state cross-tabs. In the post they state that they've disabled DNS prefetch, WebTransport and WebAuthn so obviously they're hardening beyond what ships in Safari (though some of this may already be covered by lockdown mode).

Re: IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay

#15

Post by afavour »

internet2000 wrote: post #11
walrus01 wrote: post #9

Weird advertising on site: "Psylo is our privacy-first browser for iOS and iPadOS" Correct me if I'm wrong but doesn't Apple disallow any actual 3rd party browser engines? Like, any browser on iOS that isn't the standard safari is just a skin on top of webkit/safari. It doesn't exactly inspire confidence that some third party browser will be able to implement things any better (as compared to like, running Firefox on…

Networking is not handled by the rendering engine, which is an only a part of a browser app. That’s a credible claim.

But WKWebView does handle its own networking. You’re able to implement block lists, just the same as you can via browser plugin, but in this instance networking definitely is handled by WebKit.

Re: IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay

#16

Post by klausa »

TechRemarker wrote: post #3
exabrial wrote: post #2

I love iCloud private relay, but I need a way to turn it off. A command line utility would be amazing, along with the ability to turn off/on DNS-over-HTTP.

You can turn if off in settings > iCloud. Either temporary for a day and auto back on, or permanently until you turn it back on.

I desperately wish there was a "Turn off for five minutes, I'm dealing with dumb corpsec auth stuff" option.

Re: IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay

#17

Post by Aaargh20318 »

afavour wrote: post #15
internet2000 wrote: post #11

Earlier quoted context omitted.

Networking is not handled by the rendering engine, which is an only a part of a browser app. That’s a credible claim.

But WKWebView does handle its own networking. You’re able to implement block lists, just the same as you can via browser plugin, but in this instance networking definitely is handled by WebKit.

Networking is handled by WebKit but based on the article it looks like the app configures itself as a HTTP proxy for WebKit and uses that to handle networking.

Re: IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay

#18

Post by sam_lowry_ »

goalieca wrote: post #8
rickstanley wrote: post #7

When I go to https://leaks.psylo.app on "Possible IP leaks" side I see only "WebAuthn" with my real IP and, occasionally, WebTransport with an incorrect IP. For "HTTPS Traffic" it always show some other relay. Using Safari 26.5 I'm not sure what would I use WebAuthn for, if ever, maybe I could disable it through "Feature Flags" menu?; regardless, I never treat Apple's services as "premium", since the email fingerprin…

Webauthn is the api for Passkeys and things.

So WebAuthn leaks real IPs, who would have thought!

Re: IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay

#19

Post by inigyou »

Aaargh20318 wrote: post #17
afavour wrote: post #15

Earlier quoted context omitted.

But WKWebView does handle its own networking. You’re able to implement block lists, just the same as you can via browser plugin, but in this instance networking definitely is handled by WebKit.

Networking is handled by WebKit but based on the article it looks like the app configures itself as a HTTP proxy for WebKit and uses that to handle networking.

So it can't do anything about proxy leaks.

Re: IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay

#20

Post by user43928 »

exabrial wrote: post #4
TechRemarker wrote: post #3

Earlier quoted context omitted.

You can turn if off in settings > iCloud. Either temporary for a day and auto back on, or permanently until you turn it back on.

Yep, but one cannot script that, make it a part of a bash or automator actions, which is a problem.

osascript with System Events seems to work for opening the right modal in Settings and flipping the switch On, in a quick test.

I did not verify whether it works reliably.

If it does, one could probably package it as a .app and grant only that the Accessibility permission.

Post reply on HN