Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS VPNs have leaked traffic for years, researcher claims

arstechnica.com

Post reply on HN
Print view View original

21–30 of 40 posts

Re: iOS VPNs have leaked traffic for years, researcher claims

#21

Post by Terretta »

smoldesu wrote: post #17
egberts1 wrote: post #2

Even WireGuard is also impacted on iOS. The author of WireGuard lamented that certain network pathway must be preserved for existing Apple infrastructure before WireGuard app can be approved and made available by Apple App Store. So, there is no easy way to catalogue what kind of cellular data traffic unless we magically ran a network capture (WireSHARK) at cell tower level or root our iOS phone. I do do know for iOS…

Man, it sure would be nice if you could just... install an app without Apple's permission. Sure seems like they aren't looking out for your privacy or safety, in this situation.

Who is “you”?

Multiply “you” by all possible “yous”, multiplied by downsides of “just install an app” not vetted, for those “yous”. What’s the net effect on total privacy or safety of all yous out there?

If “you” are here on HN, odds are you are a vanishingly small part of the venn diagram of yous that should inform an iPhone PdM’s thinking on this issue.

EXCEPT, of course, for the NPS (net promotor score) / influencer aspect of you. Because we’re still in an era where the IT person in a circle causes others to make choices. HN users still have a disproportionate voice in tech trend setting.

But, as that person, you also have a responsibility to advise in well considered ways that help the person being advised, not yourself. As engineers, our entire purpose is to pay a blood/sweat/tears price to make technology accessible and useful to non-engineers.

You know what to do. They don’t. This device is for them.

Re: iOS VPNs have leaked traffic for years, researcher claims

#22

Post by thfuran »

responsible wrote: post #12

You can mitigate this by using a VPN router. I have a little GL.Inet router I use that ensures all traffic is passed through the VPN. The only caveat is you can’t travel with it even though they’re advertised as ‘travel routers’. You could use it in a hotel if you don’t trust random Wi-Fi hotspots. All I need is a .OVPN config file which I upload in the router’s admin dashboard, copy and paste my username and passwor…

>The only caveat is you can’t travel with it even though they’re advertised as ‘travel routers’.

Why not?

Re: iOS VPNs have leaked traffic for years, researcher claims

#23

Post by rsync »

responsible wrote: post #12

You can mitigate this by using a VPN router. I have a little GL.Inet router I use that ensures all traffic is passed through the VPN. The only caveat is you can’t travel with it even though they’re advertised as ‘travel routers’. You could use it in a hotel if you don’t trust random Wi-Fi hotspots. All I need is a .OVPN config file which I upload in the router’s admin dashboard, copy and paste my username and passwor…

See my comment elsewhere in the thread about using your normal network setup, but inserting a "slug" that only allows your VPN port and/or endpoint(s).

Since the slug is invisible, and has no IP address, and runs no daemons, etc., the only misconfiguration possible would be the initial one.

Once the slug is in place, there is no more "accidentally didn't use the VPN..."

Re: iOS VPNs have leaked traffic for years, researcher claims

#24

Post by simscitizen »

egberts1 wrote: post #2

Even WireGuard is also impacted on iOS. The author of WireGuard lamented that certain network pathway must be preserved for existing Apple infrastructure before WireGuard app can be approved and made available by Apple App Store. So, there is no easy way to catalogue what kind of cellular data traffic unless we magically ran a network capture (WireSHARK) at cell tower level or root our iOS phone. I do do know for iOS…

iOS has supported tcpdump for end users since...I can't remember, maybe iOS 4?

https://developer.apple.com/documentation/network/recording_...

Re: iOS VPNs have leaked traffic for years, researcher claims

#25

Post by egberts1 »

responsible wrote: post #16
egberts1 wrote: post #14

Earlier quoted context omitted.

Apple App Store mandates that their Apple network infrastructure shall not be impacted by an app (VPN, TailScale, WireGuard, et. al.) In addition to unimpeded Apple network pathway, DNS resolver is being resolved by Apple DNS recursive DNS server during your tunneling setup, arguably resolving even just the IP address(es) as well as DNS names of VPN server. More on this sad saga of Apple iOS and VPN, et. al.: https:/…

I’m not talking about an app. I’m talking about a router that VPN-ifies all your traffic to mitigate any form of leak. That article talks about iOS leaking traffic when using VPN apps. A VPN router is the only solution to stop this from happening.

Noted and edited.

Re: iOS VPNs have leaked traffic for years, researcher claims

#27

Post by responsible »

thfuran wrote: post #22
responsible wrote: post #12

You can mitigate this by using a VPN router. I have a little GL.Inet router I use that ensures all traffic is passed through the VPN. The only caveat is you can’t travel with it even though they’re advertised as ‘travel routers’. You could use it in a hotel if you don’t trust random Wi-Fi hotspots. All I need is a .OVPN config file which I upload in the router’s admin dashboard, copy and paste my username and passwor…

>The only caveat is you can’t travel with it even though they’re advertised as ‘travel routers’. Why not?

Well I have a Gl.inet mango router which I think supports 3g USB modems, so you could hook up that and power the router with a power bank. You can use it traveling, but not when driving as you would need some sort of Wi-Fi hotspot in the car. You could setup one on your phone though this is where everything gets complicated and not for the average user.

Re: iOS VPNs have leaked traffic for years, researcher claims

#28

Post by thrapple »

This isn't news, really - folks who actually work with large-scale deployments (and management) of iOS devices (particularly devices with cellular connectivity or which need to access random wifi networks) already know that the only real always-on VPN capability in iOS is IKEv2 pushed via your MDM system of choice. This has been true since the capability was first released in (IIRC) iOS 8. Yes, it's hella-lame Apple buries this information.

FWIW, this capability IS available to individuals using the free Apple Configurator application. The only catch is you'll need a machine running the latest MacOS to run the latest Apple Configurator.

Re: iOS VPNs have leaked traffic for years, researcher claims

#29

Post by semi-extrinsic »

Terretta wrote: post #21
smoldesu wrote: post #17

Earlier quoted context omitted.

Man, it sure would be nice if you could just... install an app without Apple's permission. Sure seems like they aren't looking out for your privacy or safety, in this situation.

Who is “you”? Multiply “you” by all possible “yous”, multiplied by downsides of “just install an app” not vetted, for those “yous”. What’s the net effect on total privacy or safety of all yous out there? If “you” are here on HN, odds are you are a vanishingly small part of the venn diagram of yous that should inform an iPhone PdM’s thinking on this issue. EXCEPT, of course, for the NPS (net promotor score) / influenc…

Well, Android has been successful for years now with a model where it is possible to sideload an APK on any device, but it's buried sufficiently deep that the people who shouldn't be using it can't find it.

Why not replicate that (IMO) success?

Because if I understand GP correctly, they are talking about the ability for devs and white hats to install software which enables debugging and logging so it becomes much easier to find stuff like this?

Re: iOS VPNs have leaked traffic for years, researcher claims

#30

Post by ryp35 »

rsync wrote: post #19

This is why I use a "slug" when I use a VPN: https://john.kozubik.com/pub/NetworkSlug/tip.html "A Network Slug, or "Slug", is a transparent layer 2 firewall running on a device with only two interfaces ..." "So, while the device participates on the physical layer of the (probably ethernet) network, it does not have an IP address and cannot answer IP (or even ICMP) requests ..." In my case, if I needed a VPN, I would…

Hi! Would you please spare some time and provide more details of your setup? Thanks in advance
Post reply on HN