3 ms·

I'm a bit more concerned at the idea that Apple wants to enable it by default, and route the entire internet through their servers!

by ars 5y ago

olliej 5y ago
They published a paper on how it works: unlike regular VPNs apple does not see what you are requesting , so even if they were logging everything that they see they would not have anything other than you using the relay.
- ars 5y ago
  Their exit nodes can still see the IP though, they can't connect it to an individual, but they can measure [mobile] popularity of any site on the internet.
  - olliej 5y ago
    re: [mobile] The relay is available on Mac and iOS (and for good measure landline ISPs in the US also have a history of selling and modifying user data) Apple sees your IP address when you make the request, but not the content of the request, the egress point knows your approximate location (if you've asked it to maintain general location). As I interpret the white paper everything that is downloaded goes [destination site]->egress CDN->apple->you so the CDN can at best determine the most popular sites in a region, and apple can know you're using the internet. In terms of knowing the popularity of various websites, apple says they're using large CDN companies, given that there are only a few CDNs large enough to handle potentially a large portion of apple's user base (who knows what the numbers will actually end up being) those CDNs likely already know the popularity. The end result is that private relay is superior for privacy of web traffic, but of course only applies to insecure http requests, or requests from safari. Presumably this is the best mix of "don't leak arbitrary plaintext from user systems" and "don't interfere with other company's apps". So if you want general privacy from your ISP a traditional VPN seems to be what you want, but that VPN sees everyone/thing you connect to, so you're trading your ISP knowing what you're doing for the VPN company knowing what you're doing.
    - tinus_hn 5y ago
      How are you stepping from ‘Apple can see your IP address’ to you should use a VPN company that can see what you’re doing?
      - olliej 5y ago
        I think you misunderstood me. It’s not a matter of apple seeing your IP address. It’s that private relay only applies to plain http traffic, or traffic from safari. So if you want to prevent your ISP from watching ssh/irc/discord what have you, you would need a VPN. If you’re just browsing the web in safari then iCloud proxy is strictly superior to a regular VPN company.

I'm a bit more concerned at the idea that Apple wants to enable it by default, and route the entire internet through their servers!

by ars 5y ago

I'm a bit more concerned at the idea that Apple wants to enable it by default, and route the entire internet through their servers!

olliej 5y ago

They published a paper on how it works: unlike regular VPNs apple does not see what you are requesting , so even if they were logging everything that they see they would not have anything other than you using the relay.

ars 5y ago
Their exit nodes can still see the IP though, they can't connect it to an individual, but they can measure [mobile] popularity of any site on the internet.
- olliej 5y ago
  re: [mobile] The relay is available on Mac and iOS (and for good measure landline ISPs in the US also have a history of selling and modifying user data) Apple sees your IP address when you make the request, but not the content of the request, the egress point knows your approximate location (if you've asked it to maintain general location). As I interpret the white paper everything that is downloaded goes [destination site]->egress CDN->apple->you so the CDN can at best determine the most popular sites in a region, and apple can know you're using the internet. In terms of knowing the popularity of various websites, apple says they're using large CDN companies, given that there are only a few CDNs large enough to handle potentially a large portion of apple's user base (who knows what the numbers will actually end up being) those CDNs likely already know the popularity. The end result is that private relay is superior for privacy of web traffic, but of course only applies to insecure http requests, or requests from safari. Presumably this is the best mix of "don't leak arbitrary plaintext from user systems" and "don't interfere with other company's apps". So if you want general privacy from your ISP a traditional VPN seems to be what you want, but that VPN sees everyone/thing you connect to, so you're trading your ISP knowing what you're doing for the VPN company knowing what you're doing.
  - tinus_hn 5y ago
    How are you stepping from ‘Apple can see your IP address’ to you should use a VPN company that can see what you’re doing?
    - olliej 5y ago
      I think you misunderstood me. It’s not a matter of apple seeing your IP address. It’s that private relay only applies to plain http traffic, or traffic from safari. So if you want to prevent your ISP from watching ssh/irc/discord what have you, you would need a VPN. If you’re just browsing the web in safari then iCloud proxy is strictly superior to a regular VPN company.