Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's iCloud+ “VPN”

metzdowd.com

Post reply on HN
Print view View original

91–100 of 413 posts

Re: Apple's iCloud+ “VPN”

#91

Post by Nextgrid »

gjsman-1000 wrote: post #64
anonymouse008 wrote: post #59

Earlier quoted context omitted.

I've never understood how a VPN doesn't get too carried away to pull a MITM with some central cert

Because if you used a central cert, every device would have to whitelist that cert, and just clocking the lock icon in your browser would reveal it.

On the other hand, a lot of VPNs provide proprietary client software (even though all the major OSes have built-in support for the common VPN protocols such as IPSec, L2TP, etc) so they could very well sneak the root cert in there too.

Re: Apple's iCloud+ “VPN”

#92

Post by fnord77 »

danpalmer wrote: post #9

Props to Apple for the design of this service. It doesn't hit all the privacy targets that long-time personal VPN users might be looking for, and it doesn't get into the game of trying to circumvent region locked content*, but otherwise it's likely to be a solid privacy improvement for almost all users in a careful and deliberate way. I use a VPN for other reasons (downloading Ubuntu ISOs mostly) but I'll probably tu…

I wish I could pay for bbc iPlayer service outside old blighty. But they don't allow it.

Re: Apple's iCloud+ “VPN”

#93

Post by mariojv »

gjsman-1000 wrote: post #57
bhaavan wrote: post #51

Does this mean that all DDoS mitigation techniques need to exist before the exit node of this traffic? Which in turn mean, that everyone needs to outsource their DDoS mitigation to Apple. Also the corollary would be, that anyone who is able to bypass the protection mechanisms Apple has in place to control DDoS, can use it to DDoS a service like Google, Microsoft and get the entire service banned for all iCloud+ users…

Apple has sort of addressed this with only having it work with Safari and other apps that implement the API, rather than system-wide as something you can connect to. It’s probably going to take a lot of reverse engineering before hackers figure out the API and how to get third party devices to connect and authenticate, if at all. If you can’t get third party devices to connect, you are missing the first D in DDOS.

There is also almost certainly an authentication mechanism in place, even if you were to reverse engineer the API. You'd need a bunch of paid iCloud accounts to have a DDoS be at all feasible with this service.

Additionally, Cloudflare themselves, one of Apple's third party partners, offer DDoS protection services. Because they see all the exit traffic, they'd be able to detect the DDoS and block it.

Re: Apple's iCloud+ “VPN”

#94

Post by mariojv »

CubsFan1060 wrote: post #86
gjsman-1000 wrote: post #17

Earlier quoted context omitted.

It won’t harm VPN providers, I don’t think, for a few reasons. - VPNs are actually less private than iCloud+ double hop design, but could be much faster due to only having a single hop. - Unlike a VPN, you can’t choose the location of the server you exit at, and the exit server cannot be in a different nation. If you are in the US, iCloud+‘s relays are in the US. No circumventing georestrictions here. - Apple does no…

Additionally, this only works for port 80 traffic from apps. Other traffic is not run through this, so a VPN would still be useful in those scenarios.

To clarify: port 80 and 443 (TLS connections), right? Or is TLS traffic only routed through the private relay in Safari, not other apps?

Re: Apple's iCloud+ “VPN”

#95

Post by gcbirzan »

CubsFan1060 wrote: post #86
gjsman-1000 wrote: post #17

Earlier quoted context omitted.

It won’t harm VPN providers, I don’t think, for a few reasons. - VPNs are actually less private than iCloud+ double hop design, but could be much faster due to only having a single hop. - Unlike a VPN, you can’t choose the location of the server you exit at, and the exit server cannot be in a different nation. If you are in the US, iCloud+‘s relays are in the US. No circumventing georestrictions here. - Apple does no…

Additionally, this only works for port 80 traffic from apps. Other traffic is not run through this, so a VPN would still be useful in those scenarios.

Wait, so no HTTPS?

Re: Apple's iCloud+ “VPN”

#96

Post by gjsman-1000 »

TedDoesntTalk wrote: post #77
nojito wrote: post #69

Earlier quoted context omitted.

What would the logs contain? I believe everything is encrypted on device before being sent to Apple.

Timestamp, source and destination ip addresses, username. In the case of the exit node, url.

We don’t know that Apple keeps logs. These are things they could theoretically keep, but we don’t know if they store them or not.

Re: Apple's iCloud+ “VPN”

#97

Post by Brajeshwar »

arnvald wrote: post #34
Brajeshwar wrote: post #28

Does this compare to NextDNS[1]. I moved from Pi Hole[2] to NextDNS and I'm happy with it. 1. https://nextdns.io 2. https://pi-hole.net

Oh, that's interesting. What convinced you to switch? Not having to host it yourself or some specific features?

More of Not Hosting it Myself. NextDNS is cheap enough and does the work really well. Part of my lifestyles simplification, especially when it comes to critical services.

Had few instances where some websites do not work when ad scripts are blocked. I had to debug while traveling and my wife is not too keen on tinkering with the Raspberry Pis.

NextDNS have similar issues, lots of newsletter unsubscription just fails. For NextDNS, I can just ask my wife, "Click that Shield Icon and Disable for sometime." For Mobile devices, "Open NextDNS and slide the Disable button."

Re: Apple's iCloud+ “VPN”

#98

Post by matt-attack »

jameshart wrote: post #90

Interesting. I thought I recalled talking about this on HN previously: https://news.ycombinator.com/item?id=10355868 _-__--- on Oct 8, 2015 | parent | favorite | on: Verizon revives "zombie cookie" device tracking on... Tor as an OS-level feature may not spark the best reaction. It's been given a bad name ("deep web," silk road, etc) in mass media and many people don't understand it enough to think of it as anything…

Wow props for quite a prediction. You definitely deserve some recognition for that one.

Re: Apple's iCloud+ “VPN”

#99

Post by yepthatsreality »

headmelted wrote: post #45

I've been trying to point this out to people but YouTube personalities have a louder voice than anyone else so you end up with bad information. Props to Apple for offering an (albeit low entropy) onion router on their own infrastructure. I can't imagine this is going to win them any friends in government circles but it's definitely a step in the right direction. I'd also really like to see Apple come clean about the…

Apple won't come clean until they can sweep it under the rug like they did with the other debacles (see: keyboards). Being honest about those things undermines their "Apple knows best" image attempt.

Re: Apple's iCloud+ “VPN”

#100

Post by gjsman-1000 »

mariojv wrote: post #94
CubsFan1060 wrote: post #86

Earlier quoted context omitted.

Additionally, this only works for port 80 traffic from apps. Other traffic is not run through this, so a VPN would still be useful in those scenarios.

To clarify: port 80 and 443 (TLS connections), right? Or is TLS traffic only routed through the private relay in Safari, not other apps?

All traffic in Safari goes through relay. However, in 3rd party apps, all traffic over 80 goes through relay and traffic over 443 is exempt. There is going to be an API though for if you want your 3rd party app’s 443 to go over the relay if you desire.
Post reply on HN