Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS allows DNS request to escape the VPN tunnel

twitter.com

Post reply on HN
Print view View original

21–30 of 78 posts

Re: iOS allows DNS request to escape the VPN tunnel

#21

Post by culturestate »

jaywalk wrote: post #10
RetpolineDrama wrote: post #7

Earlier quoted context omitted.

Wallet at least has a semi-plausible non-evil answer: Users who kick their VPN on to another country and try to use apple pay at checkout will unexpectedly get declined (because the purchase would appear to be coming from another country perhaps?). Apple could fix that with proper UI though.

I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS.

> I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS.

I don't think contactless Apple Pay actually uses device geo[1] for authorization, but it's still worth noting that iOS devices without cell connectivity (ie WiFi-only iPads) don't have GPS anyway.

You can use Apple Pay on websites in Safari, though, which IIRC doesn't require location permissions to work.

1. You have to be able to use it in the same places you'd use a normal card, which means you can't rely on network connectivity of any kind.

Re: iOS allows DNS request to escape the VPN tunnel

#22

Post by joshstrange »

account-5 wrote: post #19
emptyparadise wrote: post #11

iOS devices are leaky as hell. I once tried blackholing all requests besides those to a VPN service on a router level, and even then my iPhone would just fall back to mobile data for notifications and other Apple services.

I can't even imagine the uproar that would be a thread about Google doing this!

https://mullvad.net/en/blog/2022/10/10/android-leaks-connect... and I'll bet good money Android does the same thing if it can't get internet access over WiFi

Re: iOS allows DNS request to escape the VPN tunnel

#23

Post by joshstrange »

emptyparadise wrote: post #11

iOS devices are leaky as hell. I once tried blackholing all requests besides those to a VPN service on a router level, and even then my iPhone would just fall back to mobile data for notifications and other Apple services.

Completely different situation. The iPhone falls back to mobile data if it can't get to the internet over WiFi.

Re: iOS allows DNS request to escape the VPN tunnel

#24

Post by addingnumbers »

tablespoon wrote: post #17
giobox wrote: post #14

Earlier quoted context omitted.

This doesn't stop apps using things like DNS over HTTPS etc. PiHole works pretty great today, but developers are getting sneakier and sneakier about how to obtain outbound DNS. It's not just unencrypted port 53 all the time anymore. Eventually devices will get the IP for the DNS record they want just fine, if they really want to. PiHole arguably is getting less effective with each passing year as alternate DNS resolu…

> PiHole arguably is getting less effective with each passing year as alternate DNS resolution methods like DNS over HTTPS etc gain traction, and defeating DNS over HTTPS is s a whack-a-mole game today, all you can really do is try to blacklist known DNS over HTTPS server IPs, which is a running battle. Aren't blocking ads another whack-a-mole? So it seems like more of the same. Also, aren't there proxies that you ca…

> Also, aren't there proxies that you can setup that can inspect HTTPS connections (so long as you install the proxy's cert on your machine).

It's common for apps to prevent this with certificate pinning. They'll ignore the certs you've installed manually and will only connect to servers with certs signed by their in-house certificate authority.

Re: iOS allows DNS request to escape the VPN tunnel

#25

Post by addingnumbers »

kube-system wrote: post #6
disabled wrote: post #4

Last that I heard, Raspberry Pi with VPN installed along with PiHole that you SSH/VNC (via iOS app) in to is your best option.

SSHing to another machine isn’t a solution, you’re just using a different machine. The way to solve it and still continue to use iOS is to implement your VPN at the network layer. e.g. use one of those wifi routers with a VPN client built in.

They circumvent this by forcing certain traffic to circumvent your hardened WiFi by using the mobile network radios.

Re: iOS allows DNS request to escape the VPN tunnel

#26

Post by giobox »

tablespoon wrote: post #17
giobox wrote: post #14

Earlier quoted context omitted.

This doesn't stop apps using things like DNS over HTTPS etc. PiHole works pretty great today, but developers are getting sneakier and sneakier about how to obtain outbound DNS. It's not just unencrypted port 53 all the time anymore. Eventually devices will get the IP for the DNS record they want just fine, if they really want to. PiHole arguably is getting less effective with each passing year as alternate DNS resolu…

> PiHole arguably is getting less effective with each passing year as alternate DNS resolution methods like DNS over HTTPS etc gain traction, and defeating DNS over HTTPS is s a whack-a-mole game today, all you can really do is try to blacklist known DNS over HTTPS server IPs, which is a running battle. Aren't blocking ads another whack-a-mole? So it seems like more of the same. Also, aren't there proxies that you ca…

The key difference is the point of control:

For PiHole today, most everything comes over port 53, and thus easy to track, monitor and block as required.

Tomorrow, DNS requests can be on any port, to any server, on any protocol. This makes trying to use a single point of control like the PiHole so much harder than it was in the past. Who is to say next week its HTTPS as the encrypted transport for DNS? Use whatever bizarre encryption scheme you like. It's your app... The app can just ignore whatever DNS server you suggested via DHCP or whatever and go back to its homebrew domain name resolution system.

Re: iOS allows DNS request to escape the VPN tunnel

#27

Post by account-5 »

joshstrange wrote: post #22
account-5 wrote: post #19

Earlier quoted context omitted.

I can't even imagine the uproar that would be a thread about Google doing this!

https://mullvad.net/en/blog/2022/10/10/android-leaks-connect... and I'll bet good money Android does the same thing if it can't get internet access over WiFi

I'm not defending Google in anyway, I'm sure they do, and I'd be the first to deride them too. But HN generally has a lot more forgiveness for apple, for some reason.

Re: iOS allows DNS request to escape the VPN tunnel

#28

Post by saurik »

giobox wrote: post #26
tablespoon wrote: post #17

Earlier quoted context omitted.

> PiHole arguably is getting less effective with each passing year as alternate DNS resolution methods like DNS over HTTPS etc gain traction, and defeating DNS over HTTPS is s a whack-a-mole game today, all you can really do is try to blacklist known DNS over HTTPS server IPs, which is a running battle. Aren't blocking ads another whack-a-mole? So it seems like more of the same. Also, aren't there proxies that you ca…

The key difference is the point of control: For PiHole today, most everything comes over port 53, and thus easy to track, monitor and block as required. Tomorrow, DNS requests can be on any port, to any server, on any protocol. This makes trying to use a single point of control like the PiHole so much harder than it was in the past. Who is to say next week its HTTPS as the encrypted transport for DNS? Use whatever bi…

> Who is to say next week its HTTPS as the encrypted transport for DNS?

That ship has already set sail, my friend :(.

Re: iOS allows DNS request to escape the VPN tunnel

#29

Post by pphysch »

bierjunge wrote: post #18
jaywalk wrote: post #10

Earlier quoted context omitted.

I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS.

GPS can be easily spoofed. Back in the university days, we (me + a few friends) used to get some radios and antennas to create a signal stronger than the one coming from satellites. It was always fun when the semester started and all freshmen were using Google Maps to navigate through the campus, but the map always showed their location in North Korea. Good ol' times.

I thought GPS worked by triangulation? How did you use one transmitter to specifically misdirect receivers to believing they were in North Korea?

Re: iOS allows DNS request to escape the VPN tunnel

#30

Post by ballenf »

pphysch wrote: post #29
bierjunge wrote: post #18

Earlier quoted context omitted.

GPS can be easily spoofed. Back in the university days, we (me + a few friends) used to get some radios and antennas to create a signal stronger than the one coming from satellites. It was always fun when the semester started and all freshmen were using Google Maps to navigate through the campus, but the map always showed their location in North Korea. Good ol' times.

I thought GPS worked by triangulation? How did you use one transmitter to specifically misdirect receivers to believing they were in North Korea?

> some radios and antennas

Still an impressive feat.

Post reply on HN