4 ms·

Correct me if I’m wrong, but as I understand it a two-hop onion network is still trivially breakable with (two) warrants, especially since both Apple and Cloudf

Correct me if I’m wrong, but as I understand it a two-hop onion network is still trivially breakable with (two) warrants, especially since both Apple and Cloudflare/etc., are US companies. Which would make it a VPN in the duck-type sense.

gjsman-1000 5y ago
It depends, whether they do no logs. There are many VPN providers in the US which don’t have logs, so that if they are subpoenaed, they have nothing to give. The beauty of Apple’s double hop is that if one partner was hacked, secretly wiretapped, or had lied about not keeping logs, your connection would still be private. But, that assumes that nobody on this network is keeping logs. If they are, then it could be theoretically possible to piece them together. However considering Apple’s marketing with privacy, it would be interesting to see whether they keep logs on each endpoint or not.
- nojito 5y ago
  What would the logs contain? I believe everything is encrypted on device before being sent to Apple.
  - TedDoesntTalk 5y ago
    Timestamp, source and destination ip addresses, username. In the case of the exit node, url.
    - gjsman-1000 5y ago
      We don’t know that Apple keeps logs. These are things they could theoretically keep, but we don’t know if they store them or not.
      - LegitShady 5y ago
        If they don’t clearly state ‘no logs’ then its unlikely they are not logging. My bet is they’re logging everything, because they have no advantage in not logging.
    - nojito 5y ago
      Only the timestamp and username would be available from Apple.
      - krferriter 5y ago
        Source IP address and next-hop IP address would be as well.
        nojito 5y ago
        Source on the next hop address? Apple doesn’t know where you’re going.
        NorwegianDude 5y ago
        They shouldn't know about the end destination, but they'll know your traffic was sent to eg. Cloudflare or whatever.
        nojito 5y ago
        I would think they batch together all the IPs and pass it off. It's in Apple's best interest to keep the bare minimum information they need from their end-user.
- heavyset_go 5y ago
  > It depends, whether they do no logs Courts can compel them to keep logs.
- wolverine876 5y ago
  > There are many VPN providers in the US which don’t have logs Many claim they don't have logs, and my understanding is that it has been sometimes revealed that they do have logs. Also, how do you run a server without logs? Many think those claims are BS.
atonse 5y ago
That’s the beauty of this. Party 2 only knows Apple’s IP. Apple doesn’t know what site you’re visiting. So how do you assemble “all traffic to this site” even by subpoenaing both parties?
- lxgr 5y ago
  To party 1: "Give us a netflow log of all of this user's traffic." To party 2: "Give us a list of all outbound connections matching this netflow list of inbound proxying requests." It would work the other way around as well (going from visited sites to a given Apple id). If you can monitor all nodes in an onion routing network, you can deanonymize everybody.
  - gjsman-1000 5y ago
    Well, here’s the catch. Even if logs were kept, the 2nd party as far as we know does not have a unique identifier passed onto it. This means that Apple’s logs would say this user authenticated and passed some encrypted stuff to Fastly, and Fastly would say that it received requests from Apple, without an identifier to match it up against the first request. Once this scales and Apple has millions of requests incoming, there will be no way to conclusively prove that two requests are the same. In which case a double subpoena is again useless. And this assuming they keep logs - if they don’t keep logs, which is more likely, it’s even more useless. This also aligns with something we currently know. Apple says they can’t see your requests. This implies that they just pass data along in an encrypted format to their partners. So all Apple does is make it so their partners don’t know your device, and the partners ensure Apple doesn’t know your request. Ultimately, even if logs were kept, there would have to be a unique identifier of some sort that was passed on to the second server from the first server to break the system. You decide the odds that they did that. Sounds a lot like an IP Address, in which case why not just build a classic VPN?
    - opheliate 5y ago
      Surely some "unique" identifier is required for each TCP session between Apple and the exit node so that Apple knows where to send the data it gets back, even if it's just the port on which Apple connect to the exit node as with standard TCP session management.
deleted 5y ago
[deleted]
path2power 5y ago
If your threat model includes state level actors, there is no commercially available solution that will make you 100% safe. This is about privacy from private corporations and making it more difficult and more costly for governments to get your data. But the latter is always possible when you use the web.
- bitcurious 5y ago
  >If your threat model includes state level actors My personal threat model doesn't include state level actors, but if it did I would certainly differentiate between a solution that the NSA can break with some expense and one that my local police department can break with a warrant. My actual threat model is advertisers, so I think the Apple solution is quite elegant and will serve me well. It shouldn't be conflated with TOR though.

gjsman-1000 5y ago

It depends, whether they do no logs. There are many VPN providers in the US which don’t have logs, so that if they are subpoenaed, they have nothing to give. The beauty of Apple’s double hop is that if one partner was hacked, secretly wiretapped, or had lied about not keeping logs, your connection would still be private. But, that assumes that nobody on this network is keeping logs. If they are, then it could be theoretically possible to piece them together. However considering Apple’s marketing with privacy, it would be interesting to see whether they keep logs on each endpoint or not.

nojito 5y ago
What would the logs contain? I believe everything is encrypted on device before being sent to Apple.
- TedDoesntTalk 5y ago
  Timestamp, source and destination ip addresses, username. In the case of the exit node, url.
  - gjsman-1000 5y ago
    We don’t know that Apple keeps logs. These are things they could theoretically keep, but we don’t know if they store them or not.
    - LegitShady 5y ago
      If they don’t clearly state ‘no logs’ then its unlikely they are not logging. My bet is they’re logging everything, because they have no advantage in not logging.
  - nojito 5y ago
    Only the timestamp and username would be available from Apple.
    - krferriter 5y ago
      Source IP address and next-hop IP address would be as well.
      - nojito 5y ago
        Source on the next hop address? Apple doesn’t know where you’re going.
        NorwegianDude 5y ago
        They shouldn't know about the end destination, but they'll know your traffic was sent to eg. Cloudflare or whatever.
        nojito 5y ago
        I would think they batch together all the IPs and pass it off. It's in Apple's best interest to keep the bare minimum information they need from their end-user.
heavyset_go 5y ago
> It depends, whether they do no logs Courts can compel them to keep logs.
wolverine876 5y ago
> There are many VPN providers in the US which don’t have logs Many claim they don't have logs, and my understanding is that it has been sometimes revealed that they do have logs. Also, how do you run a server without logs? Many think those claims are BS.

atonse 5y ago

That’s the beauty of this. Party 2 only knows Apple’s IP. Apple doesn’t know what site you’re visiting. So how do you assemble “all traffic to this site” even by subpoenaing both parties?

lxgr 5y ago
To party 1: "Give us a netflow log of all of this user's traffic." To party 2: "Give us a list of all outbound connections matching this netflow list of inbound proxying requests." It would work the other way around as well (going from visited sites to a given Apple id). If you can monitor all nodes in an onion routing network, you can deanonymize everybody.
- gjsman-1000 5y ago
  Well, here’s the catch. Even if logs were kept, the 2nd party as far as we know does not have a unique identifier passed onto it. This means that Apple’s logs would say this user authenticated and passed some encrypted stuff to Fastly, and Fastly would say that it received requests from Apple, without an identifier to match it up against the first request. Once this scales and Apple has millions of requests incoming, there will be no way to conclusively prove that two requests are the same. In which case a double subpoena is again useless. And this assuming they keep logs - if they don’t keep logs, which is more likely, it’s even more useless. This also aligns with something we currently know. Apple says they can’t see your requests. This implies that they just pass data along in an encrypted format to their partners. So all Apple does is make it so their partners don’t know your device, and the partners ensure Apple doesn’t know your request. Ultimately, even if logs were kept, there would have to be a unique identifier of some sort that was passed on to the second server from the first server to break the system. You decide the odds that they did that. Sounds a lot like an IP Address, in which case why not just build a classic VPN?
  - opheliate 5y ago
    Surely some "unique" identifier is required for each TCP session between Apple and the exit node so that Apple knows where to send the data it gets back, even if it's just the port on which Apple connect to the exit node as with standard TCP session management.

deleted 5y ago

[deleted]

path2power 5y ago

If your threat model includes state level actors, there is no commercially available solution that will make you 100% safe. This is about privacy from private corporations and making it more difficult and more costly for governments to get your data. But the latter is always possible when you use the web.

bitcurious 5y ago
>If your threat model includes state level actors My personal threat model doesn't include state level actors, but if it did I would certainly differentiate between a solution that the NSA can break with some expense and one that my local police department can break with a warrant. My actual threat model is advertisers, so I think the Apple solution is quite elegant and will serve me well. It shouldn't be conflated with TOR though.