Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's iCloud+ “VPN”

metzdowd.com

Post reply on HN
Print view View original

251–260 of 413 posts

Re: Apple's iCloud+ “VPN”

#251

Post by bitcurious »

path2power wrote: post #206
bitcurious wrote: post #38

Correct me if I’m wrong, but as I understand it a two-hop onion network is still trivially breakable with (two) warrants, especially since both Apple and Cloudflare/etc., are US companies. Which would make it a VPN in the duck-type sense.

If your threat model includes state level actors, there is no commercially available solution that will make you 100% safe. This is about privacy from private corporations and making it more difficult and more costly for governments to get your data. But the latter is always possible when you use the web.

>If your threat model includes state level actors

My personal threat model doesn't include state level actors, but if it did I would certainly differentiate between a solution that the NSA can break with some expense and one that my local police department can break with a warrant.

My actual threat model is advertisers, so I think the Apple solution is quite elegant and will serve me well. It shouldn't be conflated with TOR though.

Re: Apple's iCloud+ “VPN”

#252

Post by unknown_error »

smoldesu wrote: post #247
unknown_error wrote: post #241

Earlier quoted context omitted.

Because Google is definitely the most trustworthy company when it comes to data governance and respecting user privacy. No chance they'd use it to put you into a FLoC-type thing, benefiting their own advertising business while shutting out competitors. Google, the engineering company, always plays second fiddle to Google, the advertising company.

To be fair, Apple's software has always played second fiddle to their hardware. I trust Apple with a VPN about as much as I do Google.

They don't have an inherent conflict of interest the way Google does (advertising vs privacy in the same company). The App Store makes them plenty of money, and if anything, enhancing user "privacy" by limiting access of other adtech vendors only strengthens their walled garden and increases revenue. Even something like Fortnite or the Epic store... as long as they can dictate their entire stack from hardware to software (very much unlike Google + OEMs + third-party stores), they'll have a huge advantage over Google in terms of being able to limit your personal info being used by third parties, while still retaining it for their own use.

Re: Apple's iCloud+ “VPN”

#253

Post by unknown_error »

xnx wrote: post #250
unknown_error wrote: post #241

Earlier quoted context omitted.

Because Google is definitely the most trustworthy company when it comes to data governance and respecting user privacy. No chance they'd use it to put you into a FLoC-type thing, benefiting their own advertising business while shutting out competitors. Google, the engineering company, always plays second fiddle to Google, the advertising company.

I trust Google and Apple 100x more (low estimate) than I do Comcast/Verizon, AT&T, etc.

True.

Re: Apple's iCloud+ “VPN”

#254

Post by mkr-hn »

headmelted wrote: post #200
jameshart wrote: post #90

Interesting. I thought I recalled talking about this on HN previously: https://news.ycombinator.com/item?id=10355868 _-__--- on Oct 8, 2015 | parent | favorite | on: Verizon revives "zombie cookie" device tracking on... Tor as an OS-level feature may not spark the best reaction. It's been given a bad name ("deep web," silk road, etc) in mass media and many people don't understand it enough to think of it as anything…

Your prediction of it being called Apple Undercover is significantly more 80’s though. And I like it. So much so that I would accept Apple using something other than Helvetica this one time for a Miami Vice typeface and a Michael Knight and Kitt intro at WWDC. I cannot stress enough that Hasselhoff needs to stay in character the entire time or the whole concept doesn’t work.

Hasselhoff drifts on to stage in KITT, jumps out, and tackles Tim Cook. They then get up, shake, laugh, and take turns explaining how iCloud+ VPN makes it look like everything you do online comes from Apple.

Re: Apple's iCloud+ “VPN”

#255

Post by vngzs »

From Apple's statement[0]:

> The first assigns the user an anonymous IP address that maps to their region but not their actual location. The second decrypts the web address they want to visit and forwards them to their destination. This separation of information protects the user’s privacy because no single entity can identify both who a user is and which sites they visit.

Apple is not saying nobody can deanonymize you - they are being very careful to only state that no single entity can deanonymize you. Hence you should still assume this is not a good protection against any entity with subpoena power, or the ability to compel the cooperation of Apple and their 3rd-party egress relay providers.

[0]: https://9to5mac.com/2021/06/07/apple-icloud-private-relay-fe...

Re: Apple's iCloud+ “VPN”

#256

Post by mkr-hn »

danpalmer wrote: post #9

Props to Apple for the design of this service. It doesn't hit all the privacy targets that long-time personal VPN users might be looking for, and it doesn't get into the game of trying to circumvent region locked content*, but otherwise it's likely to be a solid privacy improvement for almost all users in a careful and deliberate way. I use a VPN for other reasons (downloading Ubuntu ISOs mostly) but I'll probably tu…

They get some by way of their portion of most Americans' cable bills from BBC America.

Re: Apple's iCloud+ “VPN”

#257

Post by vngzs »

dannyw wrote: post #216
headmelted wrote: post #164

Earlier quoted context omitted.

Let's be really frank about it - no large company is going to offer end-to-end encryption of photos because of what kind of photos might end up on their infrastructure if they do. And honestly I don't blame them at all . I'd just like to see Apple be more transparent with this one particular issue because it undermines so much of what they're advertising to the consumer. A transparency label for iCloud backup showing…

Are you really arguing that because child pornography exists, no large company should offer ETE photos? Despite there been reasonable solutions like bloom filters and client sided hash detection, so that known child abuse material can be detected, without it needing to compromise the privacy of 99.99999% of users? And that photos present some of the most sensitive materials on your device: - geo-IP location showing b…

In the bloom filter example, what device calculates the hash inputs for the bloom filters? If it's the server, then the server needs a copy of the image to check. So is it the client? If so, how can you prevent a malicious client from forging their hashes to be those of known-safe images?

Not saying it's not possible to build an E2E image storage service that also has the protections society tends to demand. Just saying that I haven't seen anyone do it yet, because these problems are subtle.

Re: Apple's iCloud+ “VPN”

#258

Post by tgragnato »

smoldesu wrote: post #243
headmelted wrote: post #164

Earlier quoted context omitted.

Let's be really frank about it - no large company is going to offer end-to-end encryption of photos because of what kind of photos might end up on their infrastructure if they do. And honestly I don't blame them at all . I'd just like to see Apple be more transparent with this one particular issue because it undermines so much of what they're advertising to the consumer. A transparency label for iCloud backup showing…

Any large company can offer E2E encryption, as long as they don't have extenuating interests that could make them liable for the way I use their services. Unless Apple is harvesting my data on the regular, they should have no problem with me being the sole keyholder for my iCloud account.

I think Apple would need to ship a different OS in China.

Cloud services offered there must store data in the country and be operated by Chinese companies. (Apple is complying with this)

But Chinese companies HAVE TO assist the authorities in obtaining systematic access to private sector data. (This is not possible with E2E for backups and photos)

Re: Apple's iCloud+ “VPN”

#260

Post by ska »

opheliate wrote: post #215
ska wrote: post #209

Earlier quoted context omitted.

How would that help you identify all of a particular users interactions (rather than one)? Why would you expect them to log it?

If Apple logged (incoming IP from user, outgoing port to exit node) pairs for each session, and the exit node logged all requests, this should be sufficient to associate all requests with a given user IP, right? Or am I misunderstanding you? I wouldn’t expect them to log it, personally, I think that can only lead to headaches down the line. My reason for responding is just that I disagree that there is no way for ano…

We are thinking about this the same way. Individual sessions don't do you much good, but there is traceability iff both parties keep complete logs. Which seems unlikely unless coerced.
Post reply on HN