4 ms·

> All in all, a very Apple approach: They deny themselves any knowledge of a customer's DNS queries and Web traffic, so if served with a subpoena they have ver

> All in all, a very Apple approach: They deny themselves any knowledge of a customer's DNS queries and Web traffic, so if served with a subpoena they have very little to respond with. Maybe I am missing something but I view this is a rather genius move. They have plausible deniability + actually introduce some protection for their users. Not sure how to read the original post though. Is it praising Apple? Is it mocking them? We don't have to be polar of course, I am just wondering.

yreg 5y ago
>In one move, Apple has taken onion routing from a specialized tool for hackers to something that will be in daily use on billions of devices. Sounds like praise to me.
smoldesu 5y ago
Apple has claimed this shtick several times (as well as many other VPN companies), but it actually requires a pretty intricate software setup to pull off. The best VPN services won't even have hard drives to store logs in: that way, even individuals with a court-issued warrant can't get your info. I'd imagine there's sufficient pressure on Apple from PRISM and other governments to keep some level of rudimentary logs.
- heavyset_go 5y ago
  > The best VPN services won't even have hard drives to store logs in: that way, even individuals with a court-issued warrant can't get your info Courts can compel them to log this information, so all claims about not keeping logs are just theater. The second they're ordered to by a court in the US, they will.
  - pwinnski 5y ago
    IANAL! The legal theory is that US courts can stop you from taking actions, but cannot compel you to take actions. So they can stop you from deleting existing logs, but they cannot require you to collect logs you aren't already collecting. I have no idea how well this idea has been tested in court, but that's the theory on which providers who don't even have hard drives are relying.
    - AaronFriel 5y ago
      IANAL as well, but your first line is definitely not true. A writ of mandamus is one of many such ways a court can compel behavior, though typically a tool of last resort. Courts order individuals, businesses and officials to take actions as a matter of course: to stand trial, to comply with subpoenas, to adhere to a contract, to make restitution, and so on. I am not deeply familiar with lawful intercept law and case law around national security letters (what little there is), but I would not gamble anything of value on the principle that courts cannot compel someone to take actions.
      - pwinnski 5y ago
        Let's assume that your are right, which I think is true. While courts cannot compel companies to do some things, they can certainly compel them to do things that are a normal part of business, like producing paperwork, or in this case, logging activity. With an NSL, they could approach a company and require them to start collecting logs and also to not communicate about the new requirement, at which point a privacy-focused company's only choice would be to either comply or stop offering the VPN service entirely without saying why. Without an NSL, the company would be free to communicate about why it was no longer offering the VPN service, or to announce that they were going to be logging from that point on, giving people an option to stop using the service if that's a problem for them. But not having a hard drive in place currently, that prevents the courts from getting information about any activity before the court order or NSL is issued, as far as I can tell, which I guess is what those companies are counting on. Not an easy business to be in, in any case.
      - smoldesu 5y ago
        If the court did compel a VPN company to log compromising information, I'd imagine most companies would tell you. After all, you're just trying to be transparent to your consumers.
        fomine3 5y ago
        Possibly some fake "#1 is privacy" VPN company will continue their service with FBI logging for profit.
- saurik 5y ago
  (And if Apple has logs of which IP address accessed a resource from which egress provider at a specific time, that is often enough to do what most governments are looking for... such is the limitation of two hops, and why Tor has three. I truly hope Apple has designed their system to avoid logging anything about their ingress packet flows.)

yreg 5y ago

>In one move, Apple has taken onion routing from a specialized tool for hackers to something that will be in daily use on billions of devices. Sounds like praise to me.

smoldesu 5y ago

Apple has claimed this shtick several times (as well as many other VPN companies), but it actually requires a pretty intricate software setup to pull off. The best VPN services won't even have hard drives to store logs in: that way, even individuals with a court-issued warrant can't get your info. I'd imagine there's sufficient pressure on Apple from PRISM and other governments to keep some level of rudimentary logs.

heavyset_go 5y ago
> The best VPN services won't even have hard drives to store logs in: that way, even individuals with a court-issued warrant can't get your info Courts can compel them to log this information, so all claims about not keeping logs are just theater. The second they're ordered to by a court in the US, they will.
- pwinnski 5y ago
  IANAL! The legal theory is that US courts can stop you from taking actions, but cannot compel you to take actions. So they can stop you from deleting existing logs, but they cannot require you to collect logs you aren't already collecting. I have no idea how well this idea has been tested in court, but that's the theory on which providers who don't even have hard drives are relying.
  - AaronFriel 5y ago
    IANAL as well, but your first line is definitely not true. A writ of mandamus is one of many such ways a court can compel behavior, though typically a tool of last resort. Courts order individuals, businesses and officials to take actions as a matter of course: to stand trial, to comply with subpoenas, to adhere to a contract, to make restitution, and so on. I am not deeply familiar with lawful intercept law and case law around national security letters (what little there is), but I would not gamble anything of value on the principle that courts cannot compel someone to take actions.
    - pwinnski 5y ago
      Let's assume that your are right, which I think is true. While courts cannot compel companies to do some things, they can certainly compel them to do things that are a normal part of business, like producing paperwork, or in this case, logging activity. With an NSL, they could approach a company and require them to start collecting logs and also to not communicate about the new requirement, at which point a privacy-focused company's only choice would be to either comply or stop offering the VPN service entirely without saying why. Without an NSL, the company would be free to communicate about why it was no longer offering the VPN service, or to announce that they were going to be logging from that point on, giving people an option to stop using the service if that's a problem for them. But not having a hard drive in place currently, that prevents the courts from getting information about any activity before the court order or NSL is issued, as far as I can tell, which I guess is what those companies are counting on. Not an easy business to be in, in any case.
    - smoldesu 5y ago
      If the court did compel a VPN company to log compromising information, I'd imagine most companies would tell you. After all, you're just trying to be transparent to your consumers.
      - fomine3 5y ago
        Possibly some fake "#1 is privacy" VPN company will continue their service with FBI logging for profit.
saurik 5y ago
(And if Apple has logs of which IP address accessed a resource from which egress provider at a specific time, that is often enough to do what most governments are looking for... such is the limitation of two hops, and why Tor has three. I truly hope Apple has designed their system to avoid logging anything about their ingress packet flows.)