9 ms·
> As of writing this blog I was in Switzerland and the IP used to egress my traffic was in a region located in the US. If this also tends to change a lot and fa
by csunbird 5y ago
> As of writing this blog I was in Switzerland and the IP used to egress my traffic was in a region located in the US. If this also tends to change a lot and fast you can basically throw away IP addresses as data of your RIBA.
Wait, so my data will be routed to US servers, as an EU resident, where the data protection laws are not as strong as where I live? This is a really bad idea, as US is known to tap any data they can get on their soil.
- x4e 5y agoWell Switzerland is not completely EU so I’m not sure if it has the same data protection laws.
- ffo 5y agoWe still have separate laws here. But we are moving towards the EU regulations in small steps.
- occamrazor 5y agoIn terms of privacy, the Swiss law is essentially equivalent to the GDPR.
- danceparty 5y agoPrivate relay will egress from the same general region as the client source location. So if you’re in switzerland and hopping through a US exit point that is a bug. This is clearly explained in the wwdc video
- ffo 5y agoYou can choose in the OS to use a general location or stick to something in your proximity. At least in the Developer Beta 2
- defaultname 5y agoThe two options are basically city-level or country but same TZ level. e.g. Toronto, or somewhere in Canada in Eastern time (which I mean would almost certainly be limited to Toronto -- presumably these options make more sense on say the East Coast for the US where there are a number of possible major locations that fit) There are clearly some bugs. Occasionally I, in Canada, get routed through the US. This guy got routed through the US. Neither case should happen by Apple's description. Apple is quite intentionally trying to avoid their relays getting around geo-restrictions (likely to avoid them getting blacklisted).
- deleted 5y ago[deleted]
- xoa 5y agoYeah, and there are solid performance reasons for that too even beyond any legal/privacy ones. Relaying across an ocean could actually be a fairly significant latency hit in many cases. Services that are completely focused on privacy even against some level of state actions (like Tor) may just accept and eat that, but that's not definitely not the threat scenario Apple is targeting and it would diminish its appeal as a fairly transparent service. Even purely in the browser people do engage in a certain amount of real-time activity. I can't see Apple considering adding thousands of miles worth of RTT ideal.
- asdfasgasdgasdg 5y agoAll depends on where the destination server is. If the destination is in the U.S., you might benefit from your traffic being routed through Apple's private network.
- ryanlol 5y agoActual egress location and locations returned by various geoip databases have little to do with each other.
- Mindwipe 5y ago> Private relay will egress from the same general region as the client source location. It's supposed to, but that is definitely not currently the case. If that will be fixed during the beta period is unclear.
- tylrprtr 5y agoI don't believe that's the case. Just listened to Craig Federighi on Jon Gruber's podcast say that the intent is that the relay is regionalized. Your IP will be anonymized, but it will at least correspond to the general location you are in. Possibly this was just a bug in the beta?
- Mindwipe 5y agoIt's very buggy so far.
- coldcode 5y agoApple Beta's in July are still very early. If it still happened in late August I might be concerned.
- ykat7 5y agoYep. I've found the setting seems to exist in two places, and it turns itself back on at times (that said, it's a beta): 1. Settings -> Apple ID -> Private Relay 2. Settings -> Network -> Use iCloud Private Relay
- tehbeard 5y agoI'm more bemused as why it picked a US server in the first place, as the options panel screenshot suggests it should be presevering the rough location (i.e. pick Belgium or France or somewhere european). Is private relay still in Beta? That might explain it if the serve side component only got deployed in one or two of Apple's US datacentres.
- zie 5y ago> This is a really bad idea, as US is known to tap any data they can get on their soil. I think you meant to say, the US is known to tap ALL data we can get our grubby little paws on. We don't care if it's on our soil or not. AIUI, it's arguably harder if it's on our soil, as then we might be spying on US citizens which requires a touch more paperwork. NOTE: I'm not condoning this behaviour, just stating my understanding of it.
- snowwrestler 5y agoYou have no control where your packets get routed on the Internet, by design of the basic protocols. Personal data should be protected by TLS (edit: and/or application-level encryption) so packet routing is irrelevant to privacy and data protection. I am very worried that the demand for protection of personal data (which is good) is mutating into an expectation of fully regional Internets that do not peer with each other (which IMO is bad).
- csunbird 5y agoIt is easier for US to ask Apple to monitor the traffic for a specific user, if the exit node is in US soil. Although the sibling comments say that it is probably a bug, and I hope that it actually is.
- djrogers 5y agoThanks to the design of Private Relay, apple can’t monitor a specific user’s traffic.
- ffo 5y agoFrom a design perspective you are right. But from a threat model I would dare to say, if you control the platform (OS, Cloud Service) you can easy bypass encryption or deploy your own keys as well. In the end it is still a trust question.
- Forbo 5y agoUntil I see a subpoena that fails to yield any user information, I'll continue to be doubtful as to their claims.
- dividedbyzero 5y agoIf personal data from EU citizens is routed through the US in the clear or in a decryptable form, that's probably forbidden under the GDPR. There are exceptions, but this doesn't look like one of these. And while I may not have direct control over where my data is actually routed, but there absolutely are legal restrictions on where companies may route them.
- cratermoon 5y agoThe laws specifically mention "at rest". Where your traffic goes while in flight is not regulated. Legally, the US service can't grab and store your data, but that doesn't mean they can't analyze and use your data as it flows through.
- dannyw 5y agoIt is not clear what the laws say as FISA intrepretations are secret.
- cratermoon 5y agoYou're correct. I'm paraphrasing guidelines from a previous employer's legal department. The Ireland data center was our EU presence, and we needed to know the boundaries of "what happens in Ireland stays in Ireland", so to speak.
- snug 5y agoJust because the IP is assigned to the US, does not mean the node was in the US
- deleted 5y ago[deleted]