4 ms·

No, Tor and a VPN are not compareable services. The Apple VPN is a closed network run on servers run by Apple, so you have to put 100% of your trust in Apple, a

No, Tor and a VPN are not compareable services. The Apple VPN is a closed network run on servers run by Apple, so you have to put 100% of your trust in Apple, as opposed to the open network of Tor, where trust is (ideally) distributed among many different actors.

4ad 5y ago
That's not how iCloud Private Relay works, and it's not a VPN. The ingress nodes are currently ran by Apple, the eggress nodes are ran by other providers, mostly Cloudfare, Akamai and Fastly. The ingress nodes who you are[1], but they can't see who you're connecting to, the egress nodes see the traffic, but they don't know who you are. You still have to trust Apple, but not because iCloud Private Relay is ran by Apple, but because the client is proprietary software running on a proprietary operating system that Apple has control of. But this is true if you chose to use macs in general, using iCloud Private Relay doesn't add new requirements to the level of trust. As for correlation attacks from a 3rd party, they can be both easier and harder compared to Tor depending on the attacker. For a global attacker they are harder, because the circuit is geographically limited in scope and the attacker would have to have access to your particular network, and of course the attacker can't install new exit nodes. However, for a local attacker that for whatever reason has visibility into the network hosting the circuit, they are easier since there are only two nodes in the circuit. And of course, for a government iCloud Private Relay would pose no problem whatsoever, since all operators are commercial entities and you need a paid account[1] to use iCloud Private Relay... But even in that case, it requires the collusion of both the exit node provider and Apple to unmask you. [1] Certain type of traffic is always sent unauthenticated through the relay, even when iCloud Private Relay is not enabled.
- noident 5y ago
  > But even in that case, it requires the collusion of both the exit node provider and Apple to unmask you. So it takes two national security letters to unmask you instead of one?
  - 4ad 5y ago
    Pretty much. If you are worried about NSLs, iCloud Private Relay is not a technology you should rely on.

4ad 5y ago

That's not how iCloud Private Relay works, and it's not a VPN. The ingress nodes are currently ran by Apple, the eggress nodes are ran by other providers, mostly Cloudfare, Akamai and Fastly. The ingress nodes who you are[1], but they can't see who you're connecting to, the egress nodes see the traffic, but they don't know who you are. You still have to trust Apple, but not because iCloud Private Relay is ran by Apple, but because the client is proprietary software running on a proprietary operating system that Apple has control of. But this is true if you chose to use macs in general, using iCloud Private Relay doesn't add new requirements to the level of trust. As for correlation attacks from a 3rd party, they can be both easier and harder compared to Tor depending on the attacker. For a global attacker they are harder, because the circuit is geographically limited in scope and the attacker would have to have access to your particular network, and of course the attacker can't install new exit nodes. However, for a local attacker that for whatever reason has visibility into the network hosting the circuit, they are easier since there are only two nodes in the circuit. And of course, for a government iCloud Private Relay would pose no problem whatsoever, since all operators are commercial entities and you need a paid account[1] to use iCloud Private Relay... But even in that case, it requires the collusion of both the exit node provider and Apple to unmask you. [1] Certain type of traffic is always sent unauthenticated through the relay, even when iCloud Private Relay is not enabled.

noident 5y ago
> But even in that case, it requires the collusion of both the exit node provider and Apple to unmask you. So it takes two national security letters to unmask you instead of one?
- 4ad 5y ago
  Pretty much. If you are worried about NSLs, iCloud Private Relay is not a technology you should rely on.