28 ms·

T-Mobile begins blocking iPhone users from enabling iCloud Private Relay in US

nerdjon 5y ago
I really hope this doesn't catch on, but I am concerned that settings has a message for this instead of it just mysteriously being not working. Makes me wonder if there is an official way carriers can block this? I know at home since I have pihole setup I got an alert that private relay can't work on my home network.
- Shank 5y ago
  If you block the domains that private relay uses, it won't work. Those are `mask.icloud.com` and `mask-h2.icloud.com`. Then it'll display a message informing you that it doesn't work. I imagine the carrier restriction just shows up in the carrier panel because there isn't a way to access the Internet on cellular via private relay if it's disabled. [0]: https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/ https://developer.apple.com/support/prepare-your-network-for...
  - nerdjon 5y ago
    I guess thinking about it more, it would be fairly simple to say something like "if consistently can't setup private relay" and "on cellular" display this message. For a moment I was thinking it would only trigger with something specific from the carrier, but I see little reason apple would actually work with them on this. They are not really in the business of making the carriers happy. Edit: someone else pointed out it is actually a feature that the carriers can do. that... is disappointing.
- woodruffw 5y ago
  From Apple's developer docs for Private Relay: they're probably displaying that message if either of the well-known endpoints returns NXDOMAIN[1]. They explicitly identify school and enterprise networks as legitimate cases where Private Relay needs to be blocked, so that's probably how carriers are doing it as well. [1]: https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/ https://developer.apple.com/support/prepare-your-network-for...
  - josephcsible 5y ago
    > They explicitly identify school and enterprise networks as legitimate cases where Private Relay needs to be blocked Why are these legitimate? Censorship is wrong even when schools do it.
    - woodruffw 5y ago
      "Legitimate" in the sense of "pre-existing policies," not "I personally believe this is morally acceptable."
    - jeroenhd 5y ago
      I've heard from a tech in one of those "protect you child online" software companies that some American states hold their educational facilities liable for things kids do on school-issued computers (like Chromebooks) or networks (like school WiFi). If a kid Googles porn on a school laptop while doing homework and a parent gets angry, they could actually win a lawsuit in some places, and the situation would be worse if the school doesn't try their hardest to block such things from the school networks. Of course, this is from the perspective of a company selling block boxes, but apparently their story worked out. It's silly (and honestly sad) legislation but these companies were scooping up customers everywhere. If the choice is between "block porn and circumvention" or "no student internet access", choosing the latter could have devastating effects on kids without stable internet access at home. In my opinion, these laws should obviously not reach so far, and anything but a basic DNS block should even be illegal in my opinion, but reality is rarely what I want it to be. In the end, private relays suffer from the same restrictions and DoH and other privacy-enhancing protocols.
- deleted 5y ago
  [deleted]
asimpletune 5y ago
Apple should just start their own carrier
gennarro 5y ago
Can someone explain how it’s possible to block this? Just stop the whole IP range from the network?
- kstrauser 5y ago
  iPhones find the entry servers to Private Relay via DNS. If you drop those hostnames, then it's effectively blocked.
  - gennarro 5y ago
    So with a custom dns server you are fine? Edit: woodruffs above provided docs
    - easton 5y ago
      Yes, but you can't set custom DNS for cellular networks without a configuration profile or an app, so it's unlikely that most people have that set.
    - kstrauser 5y ago
      Depends on the ISP. If they block or re-write DNS packets, then setting your own servers wouldn't fix it. That's a real thing people see in the wild: https://superuser.com/questions/897543/how-can-i-check-if-my-isp-is-intercepting-dns-queries-sent-to-alternative-dns-se https://superuser.com/questions/897543/how-can-i-check-if-my...
    - giobox 5y ago
      While its trivial to edit DNS settings for wifi, its actually quite difficult to change your DNS server on the cellular profile on iOS as comment from Easton here rightly points out. I was kinda surprised the first time I found out you can't edit the cellular DNS server settings via the phone's Settings app. One option that works for me to get custom DNS on iOS cellular connections (I like PiHole ad blocking on my phone) was to setup my own VPN connection to a VPS instance running PiHole for DNS and WireGuard for the VPN. Lets me get custom DNS, pihole adblocking over cellular so long as VPN isn't blocked by your cellular provider etc. Was two trivial Docker containers to get running, costs very little in AWS. Same trick also lets me access region blocked TV services from my iOS devices over US cellular simply by turning a VPN on - I just stand up the containers on a VPS host based in source country and connect to that.
kstrauser 5y ago
"User begins blocking T-Mobile from future consideration." I'm not using an ISP that prevents me from accessing perfectly legal Internet services. No matter how they want to brand themselves, today's telcos are ISPs, no more, no less. When shopping for cell phone providers, our considerations are 1) complete Internet access, 2) coverage, and 3) cost. T-mobile could charge $5 a month for unlimited usage, but if they can't satisfy requirements #1 and #2, then #3 is moot.
- hentrep 5y ago
  If you’re in the US, have you found a wireless provider that meets your criteria?
  - MBCook 5y ago
    As far as I know Verizon doesn’t block things. They have great coverage. They’re not cheap. Woo oligopoly!
    - kstrauser 5y ago
      They block private relay on my phone.
      - zachberger 5y ago
        Strange, I'm on Verizon too and its not blocked
        kstrauser 5y ago
        No kidding? If I go into Settings > iCloud > iCloud > Private Relay (Beta), I see: > Private Relay is turned off for your cellular plan. > Your cellular plan doesn't support iCloud Private Relay.
        kevdev 5y ago
bonyt 5y ago
The message says that the user's "cellular plan doesn’t support iCloud Private Relay," so is this the same thing they've done with other VPN providers? That is, do they just count the traffic against the tethering/hotspot limit, since they can't shape traffic on it to, e.g., limit video quality to 480p when a user has a plan with that limitation? I don't know if they actually do this, but I've heard it before. https://www.reddit.com/r/tmobile/comments/9ja8y1/i_can_confirm_tmobile_does_count_vpn_traffic_as/ https://www.reddit.com/r/tmobile/comments/9ja8y1/i_can_confi...
- jaywalk 5y ago
  No, they do not allow users to enable Private Relay at all because Apple allows carriers to determine whether it's available or not. Even FaceTime over cellular is still something that carriers get to decide whether to allow or not, although I'm not aware of any carriers that don't.
  - amaccuish 5y ago
    iPhones sold in the UAE have FaceTime removed.
  - chinathrow 5y ago
    Why is Apple even giving them an option in this?
    - jaywalk 5y ago
      Because Apple wants to keep their carrier partners happy, so they give them control over things that will have an impact on cellular data. Like I noted with FaceTime over cellular, it's nothing new.
      - joe5150 5y ago
        I can't imagine what kind of leverage they think they have. is any provider going to just drop iPhone support from their network?
withinboredom 5y ago
This is probably a good thing. When Private relay breaks (such as on my network at my house and some public wifi networks at a popular grocery chain), there's literally no indication that private relay is broken. Instead, friends tell me my wifi is broken or suddenly I can't use my grocery store's app to scan my products. When your product causes your customers to call someone else and complain, don't be surprised if that "someone else" disabled access to your product.
- jeffybefffy519 5y ago
  Your iPhone immediately throws up a notification saying “private relay unavailable”.
  - withinboredom 5y ago
    I have notifications disabled.
- ssully 5y ago
  I've had Private Relay stop working for me once and I was served a push notification indicating that it wasn't working.
- kylehotchkiss 5y ago
  I wish there were better visual indications within Safari regarding whether it's on or off. Especially when connecting to a new wifi network with a portal, which almost always break it. Private relay only works within Safari though, why would it affect your grocery store app?
- astrange 5y ago
  Private relay doesn't apply to apps, only Safari. (though the app could use a web sheet)
- djrogers 5y ago
  Pretty sure you're talking about something that's not iCloud Private Relay, because if that's not the case it sounds like you're just making stuff up. First of all, Private Relay doesn't affect your grocery store's app - 3rd party app traffic doesn't use it. It also can't 'break' your home wifi for your friends. And finally, when it's not working, it's automatically disabled, you are notified, and you continue browsing without it.
NaturalPhallacy 5y ago
Anybody know if this applies to companies that use tmobile's network, like Ting?
- jzig 5y ago
  Right, and Mint Mobile
- rgrmrts 5y ago
  AFAIK Google Fi uses T-Mobile, and I’m still able to use private relay.
- selimthegrim 5y ago
  Ting may be transitioning to another network soon if rumors about Dish are to be believed.
diebeforei485 5y ago
Is this because it prevents T-Mobile from monetizing and selling user browsing data?
- kylehotchkiss 5y ago
  Or because they can't throttle video streaming sites down and internet speed test sites up?
  - jaywalk 5y ago
    This is almost certainly the main driver.
  - wlesieutre 5y ago
    Private Relay only touches traffic from Safari, and while people could watch Netflix in the browser instead of the Netflix app, I doubt that many do
  - rolobio 5y ago
    I've always wondered if you could start a internet speed testing website, get in the trusted list of companies like T-Mobile. Then release a VPN on the exact same servers, forcing the companies to provide the best speed to the VPN. Only problem is that you would have to be large enough that the ISPs would care if their scores looked bad.
    - jedberg 5y ago
      This is basically what Netflix did. They launched fast.com, which comes off the same servers as Netflix video. The whole goal was to get people to call their ISP and complain they aren't getting the speeds they paid for and getting them to unthrottle Netflix.
      - rolobio 5y ago
        Didn't know that! Wonderful!!
sprite 5y ago
Is there a list of private relay addresses used by Apple?
- woodruffw 5y ago
  There are currently two subdomains associated with Private Relay. Apple's documentation implies that all connections are initiated through one or the other. mask.icloud.com mask-h2.icloud.com
- seligman99 5y ago
  If you mean IP addresses, then, yes, they publish a .csv with the IP addresses [1] It seems to update once a month [2] [1] https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay https://developer.apple.com/support/prepare-your-network-for... [2] https://imgur.com/a/35HIV5M https://imgur.com/a/35HIV5M (only showing counts for IPv4, they have huge IPv6 blocks)
boringg 5y ago
I think what is also interesting about this article is that EU, long the privacy stalwart, were the original ISPs to block private relay. Seems counter intuitive to me.
- gostsamo 5y ago
  I saw some newstitles that EU carriers want to block it, but I haven't seen them doing it nowhere. Do you have link?
  - boringg 5y ago
    In the article: "Now, in addition to some carriers in Europe, it appears that T-Mobile/Sprint in the United States is also blocking iCloud Private Relay access when connected to cellular data."
    - dathinab 5y ago
      Though as far as I understood the European carriers voiced complains but did not act, thought UK carriers did (which isn't EU anymore). Tbh. the article is just not very well written, I also first thought the article implied that T-Mobile US is an EU carrier operating in the US (it isn't, it's an US carrier owned to around 43% by an EU carrier, with which it shares a bunch of thinks, like trademarks).
      - boringg 5y ago
        Agreed poorly written article.
  - dathinab 5y ago
    > doing it nowhere Reading the article and it's predecessor it seems they are mainly doing it on cheap contracts in the UK?? Which would not be in the EU. I'm not sure if it's even legal to do so in the EU, tbh. it might be against the net neutrality rules in the EU (though they have loop holes, so not sure).
- 5y ago
vmception 5y ago
Does this run counter to current net neutrality regulations? Or is this unrelated. Are there other legal remedies for either the subscriber or from Apple to the ISPs?
- mcherm 5y ago
  Nope - this doesn't violate net neutrality regulations in the US... because there aren't any! This article: https://www.eff.org/deeplinks/2021/12/where-net-neutrality-today-and-what-comes-next-2021-review https://www.eff.org/deeplinks/2021/12/where-net-neutrality-t... talks about how many are hoping that in the near future we will establish some net neutrality regulations, but for now there really isn't anything (at the federal level. Some states have tried).
  - vmception 5y ago
    So this would not be legal to block in California?
- daenney 5y ago
  As much as I don’t like this, I would suspect it’s fine. Disabling this feature is a built-in ability of iOS. It doesn’t depend on ISPs treating the traffic differently.
- thehappypm 5y ago
  Net neutrality doesn’t even apply to mobile networks.
  - vmception 5y ago
    okay, should it? because we can make that happen if enough of us agree
Volker_W 5y ago
Everytime I think carriers cannot get even more scummier, they manage to do it.
gigel82 5y ago
Private Relay was always a sketchy proposition; if privacy is your concern, you're almost always better off using a VPN. Yes, granted, Apple could always extract (and to some extent probably is) your history directly via OS hooks, but the "Private" relay gives them a completely opaque off-device way to centrally track what everyone is visiting, which is just another data point feeding into their rapidly-growing advertisement business. Paranoid? Maybe, but after the whole on-device scanning fiasco I view Apple in the same category as Google, Facebook and Microsoft when it comes to privacy guarantees.
- mindslight 5y ago
  Give credit where credit is due. I haven't owned an Apple device since my trusty IIgs and am not a fan of Disneyland computing in general, but I may seriously ponder buying a Mac mini simply to gain access to their popular VPN that will be impractical for websites to block or CAPTCHA-hell.
- djrogers 5y ago
  > Yes, granted, Apple could always extract (and to some extent probably is) your history directly via OS hooks, but the "Private" relay gives them a completely opaque off-device way to centrally track what everyone is visiting Err, no it doesn't - that's the whole point of the way it's engineered. All Apple sees is your IP address with none of the request details, and your IP is obscured before being sent to the second relay (Cloudflare, fastly, etc) , who only see the request detail with no origin/requestor information. [1] https://www.apple.com/privacy/docs/iCloud_Private_Relay_Overview_Dec2021.PDF https://www.apple.com/privacy/docs/iCloud_Private_Relay_Over...
- atty 5y ago
  The entire point of private relay is that neither Apple nor the third party CDN can match the destination website to an individual. If your argument is “they probably aren’t doing what they say they’re doing” and so you shouldn’t use their tools, then you better start writing your own operating system from scratch and designing and fabbing your own silicon, because there’s no guarantee any of these companies or open source projects aren’t compromised.
somebodythere 5y ago
I wonder why Apple allows this. Do the carriers really have more leverage than Apple here?
- deleted 5y ago
  [deleted]
- josho 5y ago
  Apple has good reasons to allow this. Inside a corporate network for example you may not want DNS queries going to Apple’s servers. So Apple has made it very easy for a network admin to disable private relay. All an admin needs to do is blocking name lookups for relay.Apple.com* *I don’t recall the actual DN used, it’s in Apple’s docs if you are curious.
  - josephcsible 5y ago
    Apple still shouldn't make it so easy to block this wholesale, even on corporate networks. Instead, they should have a way to make only corporate-internal traffic not go through it.
  - somebodythere 5y ago
    The OS should be able to distinguish between a corporate network and mobile carrier, right?
    - easton 5y ago
      It can, but if mask.icloud.com is where the relay connection needs to go that wouldn’t help.
- badlucklottery 5y ago
  I think if you gave most people the choice to either: a) disable this feature (that they likely don't fully understand) or b) change their cellular service provider they're going to choose the former even though migrating your phone number is pretty damn easy nowadays.
ROTMetro 5y ago
gjsman-1000 5y ago
I would think Apple has some leverage to force it if they really wanted. If Apple really wanted to force the issue, they could tell T-Mobile no more iPhone contracts unless you do it. Apple can survive and thrive on fewer networks - the iPhone was AT&T exclusive for a long time at the beginning. If that happened, there would be no way for T-Mobile to get a supply of iPhones. People would need to buy iPhones from Apple and then replace the SIM cards themselves. It would make T-Mobile bend pretty quickly unless they managed to get Verizon and AT&T to join them on the issue. But then Apple has a second card to play, and that's the court of public opinion. If Apple wanted to make a public ad lambasting the carriers for undermining people's privacy, the damage would also force them to bend. Finally, of course, there's the fact that carriers need Apple just as much as Apple needs carriers. However, between the carriers and Apple, who has $200 billion in the bank to do things themselves if they wanted? Edit: Heck, T-Mobile has a market value of $130 billion. AT&T has a market cap of $188B, and Verizon $223 billion. If Verizon and AT&T joined T-Mobile in protest, Apple could theoretically attempt (or at least threaten) a hostile takeover of any of them. That would cause a lot of discussion among the carriers and send a strong message very quickly.
- andrewxdiamond 5y ago
  > If Apple wanted to make a public ad lambasting the carriers for undermining people's privacy, the damage would also force them to bend. That ad would be candy to the Apple PR team trying to push the “Apple is secure and respects your privacy” campaign. I bet we’ll see Apple use the court of public opinion here, and win with it.
  - SloopJon 5y ago
    I'm trying to think of a case in which Apple has used public opinion in this way. The closest I can come up with is Adobe Flash, but Apple was the one blocking a product on its platform then.
    - panny 5y ago
      >What's a computer? Apple trys to manipulate public opinion constantly.
asadlionpk 5y ago
I wonder when will Apple launch their own network. Would be fun!
- tzs 5y ago
  I recall reading that starting their own MVNO was the backup plan under Jobs if they had not been able to convince any existing carriers to allow the iPhone. At the time, the carriers specified much of how the software must work on any phone that they allowed onto their networks, both functionality and UI. Apple wanted the relationship with the carrier to be that Apple was in charge of everything except the low level code for dealing with the cellular network. Cingular agreed, the iPhone was a huge success, the other carriers then agreed, and that's where we are today.
janandonly 5y ago
Does this mean Verizon and t-mobile are also blocking all VPN traffic? Also, how can the "land of the free" not have net-neutrality laws?
- joe-collins 5y ago
  We did, briefly, under Obama. More recently, the previous administration unwound those rules. More technically: NN was implemented via the existing authority of the FCC, rather than any new law. Then the FCC, under new leadership, decided that internet service was outside of that authority, actually, and dropped that enforcement. Under Biden, there has been no change back in the other direction. (And at no point has there been a separate, federal law.)
  - kevin_b_er 5y ago
    The previous administration even attempted to prevent states from having net neutrality by claiming that disclaiming FCC authority was a prohibition on it. Yes, by attempting to claim FCC had no authority to regulate they also simultaneously claimed this prohibited states from regulating it. The paradoxical was a direct reflection of the corruption within the FCC at the hands of the previous administration.
  - jondwillis 5y ago
    If anyone is aware of any grassroots efforts to reinstate NN, please comment. I had basically forgotten about the rollback under Ajit Pai, which, is in my cynical view, exactly what they want.
- thebigjewbowski 5y ago
  You could say our ISPs are free to make deals with whomever wrt bandwidth. Is free, unlimited HD Netflix steaming worth more than private relay? I’m guessing most people would say yes. I’d consider switching. Oddly enough though I was able to turn on private relay on T-Mobile USA.
- skunkworker 5y ago
  No, Verizon is not at least. I will commonly connect to my home network over self-hosted vpn while on Verizon LTE.
divbzero 5y ago
For me, this new policy will be reason enough to switch away from T-Mobile at the nearest opportunity.
AlexCoventry 5y ago
Has T-Mobile given any indication that they're planning to block VPNs more generally?
stbenjam 5y ago
I had turned private relay off during the beta since it seemed flaky when connections were poor. I have a VPN for torrents that I just installed on my phone because of this. Screw T-Mobile.
baby-yoda 5y ago
how long til ATT/Verizon do the same? is there any refuge, like Twilio? alternatively, what would it take to roll your own/DIY private relay? 2 DO droplets, droplet0 runs OpenVPN or something, then private networked to droplet1 which requests are proxied through, and droplet1 recycles IP/region on some scheduled interval?
reaperducer 5y ago
Good timing. My wife is going to get a cellular data plan for her new iPad this week. Now I know to cross T-Mobile off the list.
hnburnsy 5y ago
I wonder if this would this apply to MVNOs who use the TMobile\Sprint network?
- busterarm 5y ago
  That would mean Google Fi VPN wouldn't work. I was using my own always-on VPN w/ GrapheneOS on T-Mobile's network and was having tons of problems with calls and texts not getting through.
- doctorsher 5y ago
  This does not seem to be the case. Elsewhere in the comments, neurobashing said their private relay works fine for an MVNO on T-Mobile.
jrochkind1 5y ago
Can anyone explain the case from T-Mobile's end? (Not asking for sarcastic not-in-good-faith explanations of BS reasons that you are imagining. Asking for anyone who understands more about a cell carrier's needs than I do, to explain what «the feature cuts off networks and servers from accessing vital network data and metadata and could impact “operator’s ability to efficiently manage telecommunication networks.» actually means, to someone who is not a telecom engineer but does understand engineering. And/or other motives, but based on understanding more of their business than I do, not just wild guesses!)
- deleted 5y ago
  [deleted]
- nickhalfasleep 5y ago
  Revenue from tracking customers for advertisements.
- wronglebowski 5y ago
  I belive this functions like a VPN in some ways and blocks video throttling. They use traffic inspection to throttle video streams down to 480p unless you have the most premium of plans.
  - aeonflux 5y ago
    I've never heard that IPS (not the content provider) is throttling down Video Quality by altering the traffic. Do you have some links to back up that claim? This doesn't make much sense, as they would have to download the high quality video anyway, then invest massive CPU power to downscale this. Most content providers will scale down the quality if they detect bad network conditions. If ISP would want lower quality, they could just artifficaly slow the connection.
    - olyjohn 5y ago
      This has been happening for years. They just limit bandwidth to video sites, so your player selects the corresponding stream quality.
tuetuopay 5y ago
This is the worst thing. Not for Apple or Apple users, but for the general internet. If that goes through, and countries effectively end up making Private Relay illegal, that is a very VERY strong precedent to block regular VPNs. And that's terrible. I wonder if the same could happen to TOR, if VPN end up the same way...
- smoldesu 5y ago
  > I wonder if the same could happen to TOR, if VPN end up the same way... It can't, because some of us don't let third-party corporations control what we're allowed to do with our computer.
dathinab 5y ago
Do I see it correctly that this is basically a direct consequence of not getting proper net neutrality rules?
throwaway123x2 5y ago
This is not very uncarrier, is it? Or did they do away with that branding?
- kup0 5y ago
  I expect it to be all downhill since the Sprint merger
luke2m 5y ago
I no longer have an iPhone, but can anyone confirm that T mobile blocks cydia repos on Cellular?
bogomipz 5y ago
>"There’s likely not much that Apple can do here, but it underscores another limitation of Private Relay as a feature as well as the power that carriers hold." Doesn't Apple have a lot that can do there? Wouldn't there be TOS set by Apple that would cover interfering with functionality? I would hope apple would flex some muscle here as this would otherwise set a new dismal precedent where features were only available on a carrier by carrier basis. At one time T-Mobile seemed to try to cultivate a pro-customer perception. I guess those days are long over?
jonathanmayer 5y ago
I previously served as CTO of the FCC Enforcement Bureau. A couple thoughts on the regulatory dimensions of this report. * This could be a Federal Trade Commission problem. T-Mobile, like all major ISPs, has made public representations about upholding net neutrality principles [1]. These voluntary commitments were part of the Trump-era FCC's rationale for repealing net neutrality rules. Breaching the commitments could constitute a deceptive business practice under Section 5 of the Federal Trade Commission Act. * This could also be a Federal Communications Commission problem. When repealing the Obama-era net neutrality rules, the Trump-era FCC left in place a set of transparency requirements [2]. Making an inaccurate statement about network management practices can be actionable under that remaining component of the FCC's net neutrality rules. I haven't seen a comment from T-Mobile, so to be clear, that's just based on the report. [1] https://www.t-mobile.com/responsibility/consumer-info/policies/internet-service https://www.t-mobile.com/responsibility/consumer-info/polici... [2] https://www.ecfr.gov/current/title-47/chapter-I/subchapter-A/part-8 https://www.ecfr.gov/current/title-47/chapter-I/subchapter-A...
- inetknght 5y ago
  > Making an inaccurate statement about network management practices can be actionable under that remaining component of the FCC's net neutrality rules. Who would be responsible for bringing about that action and, if they don't bring about action, what can regular people do about it?
- mariojv 5y ago
  Thank you. Is there a form where one could file a complaint with the FCC to inform them of this? I'm not sure that this would be widely reported. I am also curious if the reports about content filtering being required to deactivate the feature are accurate, and if so, what the default status of that feature is on TMobile's network.
hedgehog 5y ago
These kinds of shenanigans are exactly the reason you shouldn't trust carriers with plain text data. People bash Apple for not adopting RCS over iMessage but it would just lead to more crap like this but for your text messages.
- tomComb 5y ago
  RCS supports E2E encryption, and Google's apps implement it. (And I think the complaints about iMessage are its exclusivity - the best solution is an iMessage for Android.)
  - hedgehog 5y ago
    Thanks, I missed they'd added E2E last summer. It looks like it's only for 1:1 chats and only on some phones depending on handset vendor and carrier, is that accurate? If so it still seems like adding RCS would have pretty limited usefulness vs interop with say WhatsApp. I don't fault any one company on the messiness of the situation, it's kind of a tragedy of the commons situation. Apple isn't willing to compromise the UX complexity of adding more messaging types with different behavior, Google isn't willing to force carriers and handset manufacturers to make RCS really good, and carriers just don't care about anything other than ARPU and being "value added". Oh, and WhatsApp interop will never happen even though that would probably actually be good because Facebook.
    - deleted 5y ago
      [deleted]
  - xanaxagoras 5y ago
    How about Signal pre-installed by iOS and Android with no other default messaging apps?
- ballenf 5y ago
  Carriers generally don't care about payloads, they can monetize you from the metadata. What kind of websites you frequent and when. They don't need to know which color of maternity clothes you're shopping for to know you're pregnant.
finite_jest 5y ago
I think you should avoid T-Mobile if you can. Not just as a matter of principle, but also pragmatism. They have an extremely crude SMS censorship/anti-spam system [1] which even blocks links to lichess.org, the popular online chess website. They have poor security practices like storing passwords in plaintext [2], and they had a large data breach (probably about 100M customers affected) last year. [3] A̶n̶d̶ ̶n̶o̶w̶,̶ ̶i̶t̶ ̶s̶e̶e̶m̶s̶ ̶t̶h̶e̶y̶ ̶a̶r̶e̶ ̶t̶h̶r̶o̶w̶i̶n̶g̶ ̶i̶n̶ ̶s̶o̶m̶e̶ ̶p̶r̶o̶t̶o̶c̶o̶l̶ ̶b̶l̶o̶c̶k̶i̶n̶g̶ ̶t̶o̶o̶.̶ PS: This isn't protocol blocking at the packet/port level, so I may have used "protocol blocking" a bit inappropriately. Apparently Apple allows the carriers to prevent people from enabling iCloud Private Relay, and T-Mobile is doing that. Apple is probably doing so due to the pressure by the carriers. In August, four carriers (Vodafone, Telefonica, Orange and T-Mobile ) signed a letter urging the European Commission to stop Apple from providing Private Relay. (According to a report by The Telegraph: https://archive.fo/BRUS4#selection-915.74-925.194 https://archive.fo/BRUS4#selection-915.74-925.194) This, of course, still quite preposterous. [1]: https://news.ycombinator.com/item?id=29744347 https://news.ycombinator.com/item?id=29744347 [2]: https://news.ycombinator.com/item?id=16776347 https://news.ycombinator.com/item?id=16776347 [3]: https://news.ycombinator.com/item?id=28192423 https://news.ycombinator.com/item?id=28192423 (The first comment by @jonathanmayer has a list of other recent T-Mobile security incidents)
- dbmnt 5y ago
  I'd like to switch, but after testing Verizon, AT&T, and Sprint (prior to the merger) with SIMs in my unlocked iPhone, none of them had reliable coverage at my house. T-Mobile was the only provider that gave me a good signal. I'm in city limits, so it's not what I expected, but I guess the problem is very localized.
- perfectstorm 5y ago
  avoid T-Mobile and join AT&T or Verizon? i'm sure they have their fair share of shady/borderline illegal things they do.
  - manuelabeledo 5y ago
    > i'm sure they have their fair share of shady/borderline illegal things they do. That might be true, but at least AT&T doesn't block private VPNs, nor has plans to do so.
rcarmo 5y ago
Like I pointed out in the sister thread about EU telcos: https://news.ycombinator.com/item?id=29875805 https://news.ycombinator.com/item?id=29875805 Phone carriers do not want to be a dumb pipe - and having Private Relay go through their networks breaks: - HTTP header enrichment (which they use for self-care/customer sites/services), - zero rating (which they set up deals for with social networks, music streaming services, etc., often applying specific QoS tags) and - all sorts of value added services (many using deep packet inspection and DNS analytics) that they offer instead of raw, unfettered connectivity. I don't think many people are aware of exactly how much data telcos are sitting on, anonymized or not. And, of course, it also plays havoc with legal interception because there is no easy way to do MITM. (edit: readability)
- Spooky23 5y ago
  MITM is pretty moot right now with TLS everywhere. Apple is taking this stand because it’s inline with their business. Zero-rating is really bad for Apple. And by making themselves the virtual network layer, they have the ability to roll out their own last mile networks later.
  - r-w 5y ago
    To be fair, you could make the same argument that TLS is moot because everything at the other layers (routing, application, and even hardware) is extremely vulnerable to attack. MITM is still a very real thing. If anything makes it moot, it's not other technology; it's social engineering attacks.
    - paxys 5y ago
      The point of TLS is that every bit of network infrastructure could be compromised but your connection would still be secure as long as your own device and the end server (and the cert authority) remained clean.
- oflannabhra 5y ago
  One big difference in the US is that most telcos also have ad businesses, and this will negatively impact them.
bkmrkr 5y ago
Looks like I am leaving Tmobile
ballenf 5y ago
I would guess Xfinity and other ISPs will be watching this closely. They have the same incentives and Xfinity among others strongly lobbied Congress when there were browsing privacy bills (that failed) in Congress.
amaccuish 5y ago
Ever more convinced it's been a good idea to route all my phone traffic through WireGuard. Though it interests me why mobile networks feel they are able to do this whereas landline ISPs don't tend to in such great numbers. At least, as far as I am aware, Deutsche Telekom aren't adding headers to bare HTTP requests etc. I'm wondering if it's actually worth caving and having my home traffic tunneled to some provider more reputable.
tomjakubowski 5y ago
Weird. I'm a T-Mobile customer, and I just switched to cellular data and was able to enable Private Relay without any issue. whatismyip.com says my ISP is Akamai. Possible T-Mobile are still rolling the block out?
- MiddleEndian 5y ago
  https://twitter.com/MikeSievert/status/1480716872848842752 https://twitter.com/MikeSievert/status/1480716872848842752 According to this it's only for people with content filters.
stephbu 5y ago
> “vital network data and metadata and could impact “operator’s ability to efficiently manage telecommunication networks.” Complete bunk - Their (TMobile et.al) “value add services” are nowt more than network content provider toll-gates that the proxies bypass. Meanwhile they are also selling every bit of user context data (position, DNS/sites, cookies where unencryptable, phone-id’s etc) that they can scrape individually and in aggregate to any and every advertiser. Context is worth serious money to advertisers.
- jeroenhd 5y ago
  If carriers could be trusted (and they clearly can't), I'd actually agree with some of their technical requirements. Netflix's edge boxes work well to keep them from wasting peering capacity on video streams, and dedicated Youtube and Twitch uplinks would save the general-purpose peering links from a lot of unnecessary load. Unmasked routing would help ISPs route their traffic more efficiently and cheaper. Latencies would be lower, and rush hour throughput speeds could be higher. It might even be a small win for the environment to send all of your traffic back and forth between data centers. Sadly, many (American) ISPs are abusing their position to gather and sell personal information from their subscribers. They wasted their "ability to efficiently manage telecommunication networks" the moment they started selling data. They've become adversaries rather than partners because they thought they could have their cake and eat it too. It's sad, really, because with cooperation, everyone would actually be better off with proper network management!
newshorts 5y ago
I smell an opportunity for t-mobile to add a “private relay enabled” tier to their pricing structure. Pay extra for privacy
hendersoon 5y ago
It's very easy to block private relay on your network by simply blocking resolution of two hosts, Apple has this documented. https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/ https://developer.apple.com/support/prepare-your-network-for... There's only one legitimate justification to block it; to better manage their network by caching data locally and not going over the internet. Private relay retains your rough physical location but it obviously connects outside of your ISP's network. Thing is that's a legit reason to block it, but it isn't a strong one.
- josephcsible 5y ago
  That's not a legit reason to block it for everyone on the network. That's a legit reason for individual iPhone owners to turn it off if they value better performance over privacy.
JohnTHaller 5y ago
I'd wager this is the prevent folks from streaming over 480p on the standard 'unlimited' plan, prevent unauthorized hotspot use, prevent hiding DNS for data harvesting, and a few other things. What would make more sense is simply to charge this at hotspot rates, since they can't determine if you're using more phone and low-res streaming bandwidth than your plan permits.
nickysielicki 5y ago
FWIW, it’s working for me on a TMobile MVNO.
Neil44 5y ago
There seems to be a lot of tacit assumption here that phone companies want to do bad things with your browsing metadata and Apple doesn't, but I don't see any firm reason to make that assumption.
ChuckMcM 5y ago
Slowly pushing the data wars into the public field of view. Kudos to Apple for pushing so hard on this front. Now to put some pressure on the FCC to have some rule making done about disallowing telecom interference in the data packets.
- smoldesu 5y ago
  Apple was the one who wrote this error message for T-Mobile. If there is some kind of "data war" going on, it would appear that T-Mobile and Apple are on the same side.
deleted 5y ago
[deleted]
ummonk 5y ago
Well, time for me to consider switching away from T-Mobile.
- op00to 5y ago
  Why? Set up your own VPN and be on your way if you are concerned.
tzs 5y ago
I just tried it. I'm on the cheapest T-Mobile prepaid plan [1]. I turned off WiFi, turned on iCloud Private Relay, and browsed to a site at work while watching the Apache logs for the hit. Site showed up, and the Apache logs showed the hit came from 172.224.242.xx, which is in the block 172.224.0.0/12 which is assigned to Akami. I turned iCloud Private Relay off, hit refresh, and the hit came from 172.58.46.xx, which is in the block 172.32.0.0/11 which is assigned to T-Mobile. I then turned WiFi on and iCloud Private Relay on, hit refresh, and it came from the same IP that it had with it on when WiFi was off. I then turned iCloud Private Relay off, hit refresh, and it came from an IP in the block 73.0.0.0/8 which belongs to Comcast, which is my wired home ISP. Looks like there is no blocking going on for my T-Mobile plan. [1] https://prepaid.t-mobile.com/plan-detail/t-mobile-connect https://prepaid.t-mobile.com/plan-detail/t-mobile-connect
- schipplock 5y ago
  yet! :)
- sigmar 5y ago
  >The change does not appear to be network-wide just yet, but rather it appears T-Mobile is in the process of rolling it out.
- Volker_W 5y ago
  Statement from t-Mobile: Customers who chose plans and features with content filtering (e.g. parent controls) do not have access to the iCloud Private Relay to allow these services to work as designed. All other customers have no restrictions.
  - kuyan 5y ago
    Which may be true, but I'm still suspicious. An update FTA: > However, many of the users we’ve heard from, and tested ourselves, do not have any such content filtering enabled. We’ve followed up with T-Mobile for additional clarification, but have not yet heard back.
op00to 5y ago
I am on tmobile and Private Relay is working fine for me.
stjohnswarts 5y ago
If they do this then I will find a new carrier. I will also loudly announce it on their twitter feeds.
djrogers 5y ago
I’m not a T-Mobile customer, but I am a network architect and have done some work and research on blocking and enabling iCloud private relay. It appears what’s happening here is the T-Mobile is blocking it and people have content filtering enabled, because they can’t filter contact if they can’t see it. [1] https://tmo.report/2022/01/t-mobile-blocking-icloud-private-relay-for-some-but-its-not-what-you-think/ https://tmo.report/2022/01/t-mobile-blocking-icloud-private-...
DanAtC 5y ago
Terrible. The official method for blocking iCloud Relay is via DNS: https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay https://developer.apple.com/support/prepare-your-network-for... I wonder if this is what they're doing. If so, it's a hassle, but you can specify custom DNS servers (even DoH and DoT) for mobile connections using a .mobileconfig file. https://dns.notjakob.com/ https://dns.notjakob.com/ can generate them for you. Probably a good idea to do this anyway to keep your carrier from spying on your DNS requests.
- kotaKat 5y ago
  No, they're (very likely) using the same mobile entitlements system that does tethering/mobile hotspot and WiFi calling enablement checks (the Entitlement Layer Protocol).
eyelidlessness 5y ago
For what it’s worth this reminded me to turn it on/try it out and so far a few hours in I’ve had no problems (T-Mobile/US).
deleted 5y ago
[deleted]
aaronbrethorst 5y ago
Fwiw, the CEO of T-Mobile has been been claiming this story is inaccurate. https://twitter.com/MikeSievert/status/1480716872848842752 https://twitter.com/MikeSievert/status/1480716872848842752
bluSCALE4 5y ago
Guess it's time for regulation.
xbar 5y ago
This kind of brash carrier disregard for consumer choice is a downstream effect of a net-neutrality-free-Ajit-Pai-FCC. Transparency by Apple (and Android, as applicable) to the consumer about what features carriers disable should be mandatory You don't have to punish carriers. If the market (and consumers) cares about such features, let it decide.
oaiey 5y ago
I am careful on what side I am favouring. There is Apple, a company known for its golden cage system and then there are the telcos with their strange extra features. In the end, I want to have a clean network. And that means no private relay for 50% of mobile users and no telcos screwing my DNS, headers, zero rate my traffic whatever. Seems like I am loose-loose situation to me.
michelb 5y ago
Some more info, also in the now updated submission: https://tmo.report/2022/01/t-mobile-blocking-icloud-private-relay-for-some-but-its-not-what-you-think/ https://tmo.report/2022/01/t-mobile-blocking-icloud-private-...
dang 5y ago
This just in: Verizon, AT&T and T-Mobile say they’re not blocking Apple’s iCloud Private Relay - https://news.ycombinator.com/item?id=29901056 https://news.ycombinator.com/item?id=29901056

I really hope this doesn't catch on, but I am concerned that settings has a message for this instead of it just mysteriously being not working. Makes me wonder if there is an official way carriers can block this? I know at home since I have pihole setup I got an alert that private relay can't work on my home network.

Shank 5y ago
If you block the domains that private relay uses, it won't work. Those are `mask.icloud.com` and `mask-h2.icloud.com`. Then it'll display a message informing you that it doesn't work. I imagine the carrier restriction just shows up in the carrier panel because there isn't a way to access the Internet on cellular via private relay if it's disabled. [0]: https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/ https://developer.apple.com/support/prepare-your-network-for...
- nerdjon 5y ago
  I guess thinking about it more, it would be fairly simple to say something like "if consistently can't setup private relay" and "on cellular" display this message. For a moment I was thinking it would only trigger with something specific from the carrier, but I see little reason apple would actually work with them on this. They are not really in the business of making the carriers happy. Edit: someone else pointed out it is actually a feature that the carriers can do. that... is disappointing.
woodruffw 5y ago
From Apple's developer docs for Private Relay: they're probably displaying that message if either of the well-known endpoints returns NXDOMAIN[1]. They explicitly identify school and enterprise networks as legitimate cases where Private Relay needs to be blocked, so that's probably how carriers are doing it as well. [1]: https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/ https://developer.apple.com/support/prepare-your-network-for...
- josephcsible 5y ago
  > They explicitly identify school and enterprise networks as legitimate cases where Private Relay needs to be blocked Why are these legitimate? Censorship is wrong even when schools do it.
  - woodruffw 5y ago
    "Legitimate" in the sense of "pre-existing policies," not "I personally believe this is morally acceptable."
  - jeroenhd 5y ago
    I've heard from a tech in one of those "protect you child online" software companies that some American states hold their educational facilities liable for things kids do on school-issued computers (like Chromebooks) or networks (like school WiFi). If a kid Googles porn on a school laptop while doing homework and a parent gets angry, they could actually win a lawsuit in some places, and the situation would be worse if the school doesn't try their hardest to block such things from the school networks. Of course, this is from the perspective of a company selling block boxes, but apparently their story worked out. It's silly (and honestly sad) legislation but these companies were scooping up customers everywhere. If the choice is between "block porn and circumvention" or "no student internet access", choosing the latter could have devastating effects on kids without stable internet access at home. In my opinion, these laws should obviously not reach so far, and anything but a basic DNS block should even be illegal in my opinion, but reality is rarely what I want it to be. In the end, private relays suffer from the same restrictions and DoH and other privacy-enhancing protocols.
deleted 5y ago
[deleted]

asimpletune 5y ago

Apple should just start their own carrier

gennarro 5y ago

Can someone explain how it’s possible to block this? Just stop the whole IP range from the network?

kstrauser 5y ago
iPhones find the entry servers to Private Relay via DNS. If you drop those hostnames, then it's effectively blocked.
- gennarro 5y ago
  So with a custom dns server you are fine? Edit: woodruffs above provided docs
  - easton 5y ago
    Yes, but you can't set custom DNS for cellular networks without a configuration profile or an app, so it's unlikely that most people have that set.
  - kstrauser 5y ago
    Depends on the ISP. If they block or re-write DNS packets, then setting your own servers wouldn't fix it. That's a real thing people see in the wild: https://superuser.com/questions/897543/how-can-i-check-if-my-isp-is-intercepting-dns-queries-sent-to-alternative-dns-se https://superuser.com/questions/897543/how-can-i-check-if-my...
  - giobox 5y ago
    While its trivial to edit DNS settings for wifi, its actually quite difficult to change your DNS server on the cellular profile on iOS as comment from Easton here rightly points out. I was kinda surprised the first time I found out you can't edit the cellular DNS server settings via the phone's Settings app. One option that works for me to get custom DNS on iOS cellular connections (I like PiHole ad blocking on my phone) was to setup my own VPN connection to a VPS instance running PiHole for DNS and WireGuard for the VPN. Lets me get custom DNS, pihole adblocking over cellular so long as VPN isn't blocked by your cellular provider etc. Was two trivial Docker containers to get running, costs very little in AWS. Same trick also lets me access region blocked TV services from my iOS devices over US cellular simply by turning a VPN on - I just stand up the containers on a VPS host based in source country and connect to that.

kstrauser 5y ago

"User begins blocking T-Mobile from future consideration." I'm not using an ISP that prevents me from accessing perfectly legal Internet services. No matter how they want to brand themselves, today's telcos are ISPs, no more, no less. When shopping for cell phone providers, our considerations are 1) complete Internet access, 2) coverage, and 3) cost. T-mobile could charge $5 a month for unlimited usage, but if they can't satisfy requirements #1 and #2, then #3 is moot.

hentrep 5y ago
If you’re in the US, have you found a wireless provider that meets your criteria?
- MBCook 5y ago
  As far as I know Verizon doesn’t block things. They have great coverage. They’re not cheap. Woo oligopoly!
  - kstrauser 5y ago
    They block private relay on my phone.
    - zachberger 5y ago
      Strange, I'm on Verizon too and its not blocked
      - kstrauser 5y ago
        No kidding? If I go into Settings > iCloud > iCloud > Private Relay (Beta), I see: > Private Relay is turned off for your cellular plan. > Your cellular plan doesn't support iCloud Private Relay.
        kevdev 5y ago

bonyt 5y ago

The message says that the user's "cellular plan doesn’t support iCloud Private Relay," so is this the same thing they've done with other VPN providers? That is, do they just count the traffic against the tethering/hotspot limit, since they can't shape traffic on it to, e.g., limit video quality to 480p when a user has a plan with that limitation? I don't know if they actually do this, but I've heard it before. https://www.reddit.com/r/tmobile/comments/9ja8y1/i_can_confirm_tmobile_does_count_vpn_traffic_as/ https://www.reddit.com/r/tmobile/comments/9ja8y1/i_can_confi...

jaywalk 5y ago
No, they do not allow users to enable Private Relay at all because Apple allows carriers to determine whether it's available or not. Even FaceTime over cellular is still something that carriers get to decide whether to allow or not, although I'm not aware of any carriers that don't.
- amaccuish 5y ago
  iPhones sold in the UAE have FaceTime removed.
- chinathrow 5y ago
  Why is Apple even giving them an option in this?
  - jaywalk 5y ago
    Because Apple wants to keep their carrier partners happy, so they give them control over things that will have an impact on cellular data. Like I noted with FaceTime over cellular, it's nothing new.
    - joe5150 5y ago
      I can't imagine what kind of leverage they think they have. is any provider going to just drop iPhone support from their network?

withinboredom 5y ago

This is probably a good thing. When Private relay breaks (such as on my network at my house and some public wifi networks at a popular grocery chain), there's literally no indication that private relay is broken. Instead, friends tell me my wifi is broken or suddenly I can't use my grocery store's app to scan my products. When your product causes your customers to call someone else and complain, don't be surprised if that "someone else" disabled access to your product.

jeffybefffy519 5y ago
Your iPhone immediately throws up a notification saying “private relay unavailable”.
- withinboredom 5y ago
  I have notifications disabled.
ssully 5y ago
I've had Private Relay stop working for me once and I was served a push notification indicating that it wasn't working.
kylehotchkiss 5y ago
I wish there were better visual indications within Safari regarding whether it's on or off. Especially when connecting to a new wifi network with a portal, which almost always break it. Private relay only works within Safari though, why would it affect your grocery store app?
astrange 5y ago
Private relay doesn't apply to apps, only Safari. (though the app could use a web sheet)
djrogers 5y ago
Pretty sure you're talking about something that's not iCloud Private Relay, because if that's not the case it sounds like you're just making stuff up. First of all, Private Relay doesn't affect your grocery store's app - 3rd party app traffic doesn't use it. It also can't 'break' your home wifi for your friends. And finally, when it's not working, it's automatically disabled, you are notified, and you continue browsing without it.

NaturalPhallacy 5y ago

Anybody know if this applies to companies that use tmobile's network, like Ting?

jzig 5y ago
Right, and Mint Mobile
rgrmrts 5y ago
AFAIK Google Fi uses T-Mobile, and I’m still able to use private relay.
selimthegrim 5y ago
Ting may be transitioning to another network soon if rumors about Dish are to be believed.

diebeforei485 5y ago

Is this because it prevents T-Mobile from monetizing and selling user browsing data?

kylehotchkiss 5y ago
Or because they can't throttle video streaming sites down and internet speed test sites up?
- jaywalk 5y ago
  This is almost certainly the main driver.
- wlesieutre 5y ago
  Private Relay only touches traffic from Safari, and while people could watch Netflix in the browser instead of the Netflix app, I doubt that many do
- rolobio 5y ago
  I've always wondered if you could start a internet speed testing website, get in the trusted list of companies like T-Mobile. Then release a VPN on the exact same servers, forcing the companies to provide the best speed to the VPN. Only problem is that you would have to be large enough that the ISPs would care if their scores looked bad.
  - jedberg 5y ago
    This is basically what Netflix did. They launched fast.com, which comes off the same servers as Netflix video. The whole goal was to get people to call their ISP and complain they aren't getting the speeds they paid for and getting them to unthrottle Netflix.
    - rolobio 5y ago
      Didn't know that! Wonderful!!

sprite 5y ago

Is there a list of private relay addresses used by Apple?

woodruffw 5y ago
There are currently two subdomains associated with Private Relay. Apple's documentation implies that all connections are initiated through one or the other. mask.icloud.com mask-h2.icloud.com
seligman99 5y ago
If you mean IP addresses, then, yes, they publish a .csv with the IP addresses [1] It seems to update once a month [2] [1] https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay https://developer.apple.com/support/prepare-your-network-for... [2] https://imgur.com/a/35HIV5M https://imgur.com/a/35HIV5M (only showing counts for IPv4, they have huge IPv6 blocks)

boringg 5y ago

I think what is also interesting about this article is that EU, long the privacy stalwart, were the original ISPs to block private relay. Seems counter intuitive to me.

gostsamo 5y ago
I saw some newstitles that EU carriers want to block it, but I haven't seen them doing it nowhere. Do you have link?
- boringg 5y ago
  In the article: "Now, in addition to some carriers in Europe, it appears that T-Mobile/Sprint in the United States is also blocking iCloud Private Relay access when connected to cellular data."
  - dathinab 5y ago
    Though as far as I understood the European carriers voiced complains but did not act, thought UK carriers did (which isn't EU anymore). Tbh. the article is just not very well written, I also first thought the article implied that T-Mobile US is an EU carrier operating in the US (it isn't, it's an US carrier owned to around 43% by an EU carrier, with which it shares a bunch of thinks, like trademarks).
    - boringg 5y ago
      Agreed poorly written article.
- dathinab 5y ago
  > doing it nowhere Reading the article and it's predecessor it seems they are mainly doing it on cheap contracts in the UK?? Which would not be in the EU. I'm not sure if it's even legal to do so in the EU, tbh. it might be against the net neutrality rules in the EU (though they have loop holes, so not sure).
5y ago

vmception 5y ago

Does this run counter to current net neutrality regulations? Or is this unrelated. Are there other legal remedies for either the subscriber or from Apple to the ISPs?

mcherm 5y ago
Nope - this doesn't violate net neutrality regulations in the US... because there aren't any! This article: https://www.eff.org/deeplinks/2021/12/where-net-neutrality-today-and-what-comes-next-2021-review https://www.eff.org/deeplinks/2021/12/where-net-neutrality-t... talks about how many are hoping that in the near future we will establish some net neutrality regulations, but for now there really isn't anything (at the federal level. Some states have tried).
- vmception 5y ago
  So this would not be legal to block in California?
daenney 5y ago
As much as I don’t like this, I would suspect it’s fine. Disabling this feature is a built-in ability of iOS. It doesn’t depend on ISPs treating the traffic differently.
thehappypm 5y ago
Net neutrality doesn’t even apply to mobile networks.
- vmception 5y ago
  okay, should it? because we can make that happen if enough of us agree

Volker_W 5y ago

Everytime I think carriers cannot get even more scummier, they manage to do it.

gigel82 5y ago

Private Relay was always a sketchy proposition; if privacy is your concern, you're almost always better off using a VPN. Yes, granted, Apple could always extract (and to some extent probably is) your history directly via OS hooks, but the "Private" relay gives them a completely opaque off-device way to centrally track what everyone is visiting, which is just another data point feeding into their rapidly-growing advertisement business. Paranoid? Maybe, but after the whole on-device scanning fiasco I view Apple in the same category as Google, Facebook and Microsoft when it comes to privacy guarantees.

mindslight 5y ago
Give credit where credit is due. I haven't owned an Apple device since my trusty IIgs and am not a fan of Disneyland computing in general, but I may seriously ponder buying a Mac mini simply to gain access to their popular VPN that will be impractical for websites to block or CAPTCHA-hell.
djrogers 5y ago
> Yes, granted, Apple could always extract (and to some extent probably is) your history directly via OS hooks, but the "Private" relay gives them a completely opaque off-device way to centrally track what everyone is visiting Err, no it doesn't - that's the whole point of the way it's engineered. All Apple sees is your IP address with none of the request details, and your IP is obscured before being sent to the second relay (Cloudflare, fastly, etc) , who only see the request detail with no origin/requestor information. [1] https://www.apple.com/privacy/docs/iCloud_Private_Relay_Overview_Dec2021.PDF https://www.apple.com/privacy/docs/iCloud_Private_Relay_Over...
atty 5y ago
The entire point of private relay is that neither Apple nor the third party CDN can match the destination website to an individual. If your argument is “they probably aren’t doing what they say they’re doing” and so you shouldn’t use their tools, then you better start writing your own operating system from scratch and designing and fabbing your own silicon, because there’s no guarantee any of these companies or open source projects aren’t compromised.

somebodythere 5y ago

I wonder why Apple allows this. Do the carriers really have more leverage than Apple here?

deleted 5y ago
[deleted]
josho 5y ago
Apple has good reasons to allow this. Inside a corporate network for example you may not want DNS queries going to Apple’s servers. So Apple has made it very easy for a network admin to disable private relay. All an admin needs to do is blocking name lookups for relay.Apple.com* *I don’t recall the actual DN used, it’s in Apple’s docs if you are curious.
- josephcsible 5y ago
  Apple still shouldn't make it so easy to block this wholesale, even on corporate networks. Instead, they should have a way to make only corporate-internal traffic not go through it.
- somebodythere 5y ago
  The OS should be able to distinguish between a corporate network and mobile carrier, right?
  - easton 5y ago
    It can, but if mask.icloud.com is where the relay connection needs to go that wouldn’t help.
badlucklottery 5y ago
I think if you gave most people the choice to either: a) disable this feature (that they likely don't fully understand) or b) change their cellular service provider they're going to choose the former even though migrating your phone number is pretty damn easy nowadays.

ROTMetro 5y ago

gjsman-1000 5y ago

I would think Apple has some leverage to force it if they really wanted. If Apple really wanted to force the issue, they could tell T-Mobile no more iPhone contracts unless you do it. Apple can survive and thrive on fewer networks - the iPhone was AT&T exclusive for a long time at the beginning. If that happened, there would be no way for T-Mobile to get a supply of iPhones. People would need to buy iPhones from Apple and then replace the SIM cards themselves. It would make T-Mobile bend pretty quickly unless they managed to get Verizon and AT&T to join them on the issue. But then Apple has a second card to play, and that's the court of public opinion. If Apple wanted to make a public ad lambasting the carriers for undermining people's privacy, the damage would also force them to bend. Finally, of course, there's the fact that carriers need Apple just as much as Apple needs carriers. However, between the carriers and Apple, who has $200 billion in the bank to do things themselves if they wanted? Edit: Heck, T-Mobile has a market value of $130 billion. AT&T has a market cap of $188B, and Verizon $223 billion. If Verizon and AT&T joined T-Mobile in protest, Apple could theoretically attempt (or at least threaten) a hostile takeover of any of them. That would cause a lot of discussion among the carriers and send a strong message very quickly.

andrewxdiamond 5y ago
> If Apple wanted to make a public ad lambasting the carriers for undermining people's privacy, the damage would also force them to bend. That ad would be candy to the Apple PR team trying to push the “Apple is secure and respects your privacy” campaign. I bet we’ll see Apple use the court of public opinion here, and win with it.
- SloopJon 5y ago
  I'm trying to think of a case in which Apple has used public opinion in this way. The closest I can come up with is Adobe Flash, but Apple was the one blocking a product on its platform then.
  - panny 5y ago
    >What's a computer? Apple trys to manipulate public opinion constantly.

asadlionpk 5y ago

I wonder when will Apple launch their own network. Would be fun!

tzs 5y ago
I recall reading that starting their own MVNO was the backup plan under Jobs if they had not been able to convince any existing carriers to allow the iPhone. At the time, the carriers specified much of how the software must work on any phone that they allowed onto their networks, both functionality and UI. Apple wanted the relationship with the carrier to be that Apple was in charge of everything except the low level code for dealing with the cellular network. Cingular agreed, the iPhone was a huge success, the other carriers then agreed, and that's where we are today.

janandonly 5y ago

Does this mean Verizon and t-mobile are also blocking all VPN traffic? Also, how can the "land of the free" not have net-neutrality laws?

joe-collins 5y ago
We did, briefly, under Obama. More recently, the previous administration unwound those rules. More technically: NN was implemented via the existing authority of the FCC, rather than any new law. Then the FCC, under new leadership, decided that internet service was outside of that authority, actually, and dropped that enforcement. Under Biden, there has been no change back in the other direction. (And at no point has there been a separate, federal law.)
- kevin_b_er 5y ago
  The previous administration even attempted to prevent states from having net neutrality by claiming that disclaiming FCC authority was a prohibition on it. Yes, by attempting to claim FCC had no authority to regulate they also simultaneously claimed this prohibited states from regulating it. The paradoxical was a direct reflection of the corruption within the FCC at the hands of the previous administration.
- jondwillis 5y ago
  If anyone is aware of any grassroots efforts to reinstate NN, please comment. I had basically forgotten about the rollback under Ajit Pai, which, is in my cynical view, exactly what they want.
thebigjewbowski 5y ago
You could say our ISPs are free to make deals with whomever wrt bandwidth. Is free, unlimited HD Netflix steaming worth more than private relay? I’m guessing most people would say yes. I’d consider switching. Oddly enough though I was able to turn on private relay on T-Mobile USA.
skunkworker 5y ago
No, Verizon is not at least. I will commonly connect to my home network over self-hosted vpn while on Verizon LTE.

divbzero 5y ago

For me, this new policy will be reason enough to switch away from T-Mobile at the nearest opportunity.

AlexCoventry 5y ago

Has T-Mobile given any indication that they're planning to block VPNs more generally?

stbenjam 5y ago

I had turned private relay off during the beta since it seemed flaky when connections were poor. I have a VPN for torrents that I just installed on my phone because of this. Screw T-Mobile.

baby-yoda 5y ago

how long til ATT/Verizon do the same? is there any refuge, like Twilio? alternatively, what would it take to roll your own/DIY private relay? 2 DO droplets, droplet0 runs OpenVPN or something, then private networked to droplet1 which requests are proxied through, and droplet1 recycles IP/region on some scheduled interval?

reaperducer 5y ago

Good timing. My wife is going to get a cellular data plan for her new iPad this week. Now I know to cross T-Mobile off the list.

hnburnsy 5y ago

I wonder if this would this apply to MVNOs who use the TMobile\Sprint network?

busterarm 5y ago
That would mean Google Fi VPN wouldn't work. I was using my own always-on VPN w/ GrapheneOS on T-Mobile's network and was having tons of problems with calls and texts not getting through.
doctorsher 5y ago
This does not seem to be the case. Elsewhere in the comments, neurobashing said their private relay works fine for an MVNO on T-Mobile.

jrochkind1 5y ago

Can anyone explain the case from T-Mobile's end? (Not asking for sarcastic not-in-good-faith explanations of BS reasons that you are imagining. Asking for anyone who understands more about a cell carrier's needs than I do, to explain what «the feature cuts off networks and servers from accessing vital network data and metadata and could impact “operator’s ability to efficiently manage telecommunication networks.» actually means, to someone who is not a telecom engineer but does understand engineering. And/or other motives, but based on understanding more of their business than I do, not just wild guesses!)

deleted 5y ago
[deleted]
nickhalfasleep 5y ago
Revenue from tracking customers for advertisements.
wronglebowski 5y ago
I belive this functions like a VPN in some ways and blocks video throttling. They use traffic inspection to throttle video streams down to 480p unless you have the most premium of plans.
- aeonflux 5y ago
  I've never heard that IPS (not the content provider) is throttling down Video Quality by altering the traffic. Do you have some links to back up that claim? This doesn't make much sense, as they would have to download the high quality video anyway, then invest massive CPU power to downscale this. Most content providers will scale down the quality if they detect bad network conditions. If ISP would want lower quality, they could just artifficaly slow the connection.
  - olyjohn 5y ago
    This has been happening for years. They just limit bandwidth to video sites, so your player selects the corresponding stream quality.

tuetuopay 5y ago

This is the worst thing. Not for Apple or Apple users, but for the general internet. If that goes through, and countries effectively end up making Private Relay illegal, that is a very VERY strong precedent to block regular VPNs. And that's terrible. I wonder if the same could happen to TOR, if VPN end up the same way...

smoldesu 5y ago
> I wonder if the same could happen to TOR, if VPN end up the same way... It can't, because some of us don't let third-party corporations control what we're allowed to do with our computer.

dathinab 5y ago

Do I see it correctly that this is basically a direct consequence of not getting proper net neutrality rules?

throwaway123x2 5y ago

This is not very uncarrier, is it? Or did they do away with that branding?

kup0 5y ago
I expect it to be all downhill since the Sprint merger

luke2m 5y ago

I no longer have an iPhone, but can anyone confirm that T mobile blocks cydia repos on Cellular?

bogomipz 5y ago

>"There’s likely not much that Apple can do here, but it underscores another limitation of Private Relay as a feature as well as the power that carriers hold." Doesn't Apple have a lot that can do there? Wouldn't there be TOS set by Apple that would cover interfering with functionality? I would hope apple would flex some muscle here as this would otherwise set a new dismal precedent where features were only available on a carrier by carrier basis. At one time T-Mobile seemed to try to cultivate a pro-customer perception. I guess those days are long over?

jonathanmayer 5y ago

I previously served as CTO of the FCC Enforcement Bureau. A couple thoughts on the regulatory dimensions of this report. * This could be a Federal Trade Commission problem. T-Mobile, like all major ISPs, has made public representations about upholding net neutrality principles [1]. These voluntary commitments were part of the Trump-era FCC's rationale for repealing net neutrality rules. Breaching the commitments could constitute a deceptive business practice under Section 5 of the Federal Trade Commission Act. * This could also be a Federal Communications Commission problem. When repealing the Obama-era net neutrality rules, the Trump-era FCC left in place a set of transparency requirements [2]. Making an inaccurate statement about network management practices can be actionable under that remaining component of the FCC's net neutrality rules. I haven't seen a comment from T-Mobile, so to be clear, that's just based on the report. [1] https://www.t-mobile.com/responsibility/consumer-info/policies/internet-service https://www.t-mobile.com/responsibility/consumer-info/polici... [2] https://www.ecfr.gov/current/title-47/chapter-I/subchapter-A/part-8 https://www.ecfr.gov/current/title-47/chapter-I/subchapter-A...

inetknght 5y ago
> Making an inaccurate statement about network management practices can be actionable under that remaining component of the FCC's net neutrality rules. Who would be responsible for bringing about that action and, if they don't bring about action, what can regular people do about it?
mariojv 5y ago
Thank you. Is there a form where one could file a complaint with the FCC to inform them of this? I'm not sure that this would be widely reported. I am also curious if the reports about content filtering being required to deactivate the feature are accurate, and if so, what the default status of that feature is on TMobile's network.

hedgehog 5y ago

These kinds of shenanigans are exactly the reason you shouldn't trust carriers with plain text data. People bash Apple for not adopting RCS over iMessage but it would just lead to more crap like this but for your text messages.

tomComb 5y ago
RCS supports E2E encryption, and Google's apps implement it. (And I think the complaints about iMessage are its exclusivity - the best solution is an iMessage for Android.)
- hedgehog 5y ago
  Thanks, I missed they'd added E2E last summer. It looks like it's only for 1:1 chats and only on some phones depending on handset vendor and carrier, is that accurate? If so it still seems like adding RCS would have pretty limited usefulness vs interop with say WhatsApp. I don't fault any one company on the messiness of the situation, it's kind of a tragedy of the commons situation. Apple isn't willing to compromise the UX complexity of adding more messaging types with different behavior, Google isn't willing to force carriers and handset manufacturers to make RCS really good, and carriers just don't care about anything other than ARPU and being "value added". Oh, and WhatsApp interop will never happen even though that would probably actually be good because Facebook.
  - deleted 5y ago
    [deleted]
- xanaxagoras 5y ago
  How about Signal pre-installed by iOS and Android with no other default messaging apps?
ballenf 5y ago
Carriers generally don't care about payloads, they can monetize you from the metadata. What kind of websites you frequent and when. They don't need to know which color of maternity clothes you're shopping for to know you're pregnant.

finite_jest 5y ago

I think you should avoid T-Mobile if you can. Not just as a matter of principle, but also pragmatism. They have an extremely crude SMS censorship/anti-spam system [1] which even blocks links to lichess.org, the popular online chess website. They have poor security practices like storing passwords in plaintext [2], and they had a large data breach (probably about 100M customers affected) last year. [3] A̶n̶d̶ ̶n̶o̶w̶,̶ ̶i̶t̶ ̶s̶e̶e̶m̶s̶ ̶t̶h̶e̶y̶ ̶a̶r̶e̶ ̶t̶h̶r̶o̶w̶i̶n̶g̶ ̶i̶n̶ ̶s̶o̶m̶e̶ ̶p̶r̶o̶t̶o̶c̶o̶l̶ ̶b̶l̶o̶c̶k̶i̶n̶g̶ ̶t̶o̶o̶.̶ PS: This isn't protocol blocking at the packet/port level, so I may have used "protocol blocking" a bit inappropriately. Apparently Apple allows the carriers to prevent people from enabling iCloud Private Relay, and T-Mobile is doing that. Apple is probably doing so due to the pressure by the carriers. In August, four carriers (Vodafone, Telefonica, Orange and T-Mobile ) signed a letter urging the European Commission to stop Apple from providing Private Relay. (According to a report by The Telegraph: https://archive.fo/BRUS4#selection-915.74-925.194 https://archive.fo/BRUS4#selection-915.74-925.194) This, of course, still quite preposterous. [1]: https://news.ycombinator.com/item?id=29744347 https://news.ycombinator.com/item?id=29744347 [2]: https://news.ycombinator.com/item?id=16776347 https://news.ycombinator.com/item?id=16776347 [3]: https://news.ycombinator.com/item?id=28192423 https://news.ycombinator.com/item?id=28192423 (The first comment by @jonathanmayer has a list of other recent T-Mobile security incidents)

dbmnt 5y ago
I'd like to switch, but after testing Verizon, AT&T, and Sprint (prior to the merger) with SIMs in my unlocked iPhone, none of them had reliable coverage at my house. T-Mobile was the only provider that gave me a good signal. I'm in city limits, so it's not what I expected, but I guess the problem is very localized.
perfectstorm 5y ago
avoid T-Mobile and join AT&T or Verizon? i'm sure they have their fair share of shady/borderline illegal things they do.
- manuelabeledo 5y ago
  > i'm sure they have their fair share of shady/borderline illegal things they do. That might be true, but at least AT&T doesn't block private VPNs, nor has plans to do so.

rcarmo 5y ago

Like I pointed out in the sister thread about EU telcos: https://news.ycombinator.com/item?id=29875805 https://news.ycombinator.com/item?id=29875805 Phone carriers do not want to be a dumb pipe - and having Private Relay go through their networks breaks: - HTTP header enrichment (which they use for self-care/customer sites/services), - zero rating (which they set up deals for with social networks, music streaming services, etc., often applying specific QoS tags) and - all sorts of value added services (many using deep packet inspection and DNS analytics) that they offer instead of raw, unfettered connectivity. I don't think many people are aware of exactly how much data telcos are sitting on, anonymized or not. And, of course, it also plays havoc with legal interception because there is no easy way to do MITM. (edit: readability)

Spooky23 5y ago
MITM is pretty moot right now with TLS everywhere. Apple is taking this stand because it’s inline with their business. Zero-rating is really bad for Apple. And by making themselves the virtual network layer, they have the ability to roll out their own last mile networks later.
- r-w 5y ago
  To be fair, you could make the same argument that TLS is moot because everything at the other layers (routing, application, and even hardware) is extremely vulnerable to attack. MITM is still a very real thing. If anything makes it moot, it's not other technology; it's social engineering attacks.
  - paxys 5y ago
    The point of TLS is that every bit of network infrastructure could be compromised but your connection would still be secure as long as your own device and the end server (and the cert authority) remained clean.
oflannabhra 5y ago
One big difference in the US is that most telcos also have ad businesses, and this will negatively impact them.

bkmrkr 5y ago

Looks like I am leaving Tmobile

ballenf 5y ago

I would guess Xfinity and other ISPs will be watching this closely. They have the same incentives and Xfinity among others strongly lobbied Congress when there were browsing privacy bills (that failed) in Congress.

amaccuish 5y ago

Ever more convinced it's been a good idea to route all my phone traffic through WireGuard. Though it interests me why mobile networks feel they are able to do this whereas landline ISPs don't tend to in such great numbers. At least, as far as I am aware, Deutsche Telekom aren't adding headers to bare HTTP requests etc. I'm wondering if it's actually worth caving and having my home traffic tunneled to some provider more reputable.

tomjakubowski 5y ago

Weird. I'm a T-Mobile customer, and I just switched to cellular data and was able to enable Private Relay without any issue. whatismyip.com says my ISP is Akamai. Possible T-Mobile are still rolling the block out?

MiddleEndian 5y ago
https://twitter.com/MikeSievert/status/1480716872848842752 https://twitter.com/MikeSievert/status/1480716872848842752 According to this it's only for people with content filters.

stephbu 5y ago

> “vital network data and metadata and could impact “operator’s ability to efficiently manage telecommunication networks.” Complete bunk - Their (TMobile et.al) “value add services” are nowt more than network content provider toll-gates that the proxies bypass. Meanwhile they are also selling every bit of user context data (position, DNS/sites, cookies where unencryptable, phone-id’s etc) that they can scrape individually and in aggregate to any and every advertiser. Context is worth serious money to advertisers.

jeroenhd 5y ago
If carriers could be trusted (and they clearly can't), I'd actually agree with some of their technical requirements. Netflix's edge boxes work well to keep them from wasting peering capacity on video streams, and dedicated Youtube and Twitch uplinks would save the general-purpose peering links from a lot of unnecessary load. Unmasked routing would help ISPs route their traffic more efficiently and cheaper. Latencies would be lower, and rush hour throughput speeds could be higher. It might even be a small win for the environment to send all of your traffic back and forth between data centers. Sadly, many (American) ISPs are abusing their position to gather and sell personal information from their subscribers. They wasted their "ability to efficiently manage telecommunication networks" the moment they started selling data. They've become adversaries rather than partners because they thought they could have their cake and eat it too. It's sad, really, because with cooperation, everyone would actually be better off with proper network management!

newshorts 5y ago

I smell an opportunity for t-mobile to add a “private relay enabled” tier to their pricing structure. Pay extra for privacy

hendersoon 5y ago

It's very easy to block private relay on your network by simply blocking resolution of two hosts, Apple has this documented. https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/ https://developer.apple.com/support/prepare-your-network-for... There's only one legitimate justification to block it; to better manage their network by caching data locally and not going over the internet. Private relay retains your rough physical location but it obviously connects outside of your ISP's network. Thing is that's a legit reason to block it, but it isn't a strong one.

josephcsible 5y ago
That's not a legit reason to block it for everyone on the network. That's a legit reason for individual iPhone owners to turn it off if they value better performance over privacy.

JohnTHaller 5y ago

I'd wager this is the prevent folks from streaming over 480p on the standard 'unlimited' plan, prevent unauthorized hotspot use, prevent hiding DNS for data harvesting, and a few other things. What would make more sense is simply to charge this at hotspot rates, since they can't determine if you're using more phone and low-res streaming bandwidth than your plan permits.

nickysielicki 5y ago

FWIW, it’s working for me on a TMobile MVNO.

Neil44 5y ago

There seems to be a lot of tacit assumption here that phone companies want to do bad things with your browsing metadata and Apple doesn't, but I don't see any firm reason to make that assumption.

ChuckMcM 5y ago

Slowly pushing the data wars into the public field of view. Kudos to Apple for pushing so hard on this front. Now to put some pressure on the FCC to have some rule making done about disallowing telecom interference in the data packets.

smoldesu 5y ago
Apple was the one who wrote this error message for T-Mobile. If there is some kind of "data war" going on, it would appear that T-Mobile and Apple are on the same side.

deleted 5y ago

[deleted]

ummonk 5y ago

Well, time for me to consider switching away from T-Mobile.

op00to 5y ago
Why? Set up your own VPN and be on your way if you are concerned.

tzs 5y ago

I just tried it. I'm on the cheapest T-Mobile prepaid plan [1]. I turned off WiFi, turned on iCloud Private Relay, and browsed to a site at work while watching the Apache logs for the hit. Site showed up, and the Apache logs showed the hit came from 172.224.242.xx, which is in the block 172.224.0.0/12 which is assigned to Akami. I turned iCloud Private Relay off, hit refresh, and the hit came from 172.58.46.xx, which is in the block 172.32.0.0/11 which is assigned to T-Mobile. I then turned WiFi on and iCloud Private Relay on, hit refresh, and it came from the same IP that it had with it on when WiFi was off. I then turned iCloud Private Relay off, hit refresh, and it came from an IP in the block 73.0.0.0/8 which belongs to Comcast, which is my wired home ISP. Looks like there is no blocking going on for my T-Mobile plan. [1] https://prepaid.t-mobile.com/plan-detail/t-mobile-connect https://prepaid.t-mobile.com/plan-detail/t-mobile-connect

schipplock 5y ago
yet! :)
sigmar 5y ago
>The change does not appear to be network-wide just yet, but rather it appears T-Mobile is in the process of rolling it out.
Volker_W 5y ago
Statement from t-Mobile: Customers who chose plans and features with content filtering (e.g. parent controls) do not have access to the iCloud Private Relay to allow these services to work as designed. All other customers have no restrictions.
- kuyan 5y ago
  Which may be true, but I'm still suspicious. An update FTA: > However, many of the users we’ve heard from, and tested ourselves, do not have any such content filtering enabled. We’ve followed up with T-Mobile for additional clarification, but have not yet heard back.

op00to 5y ago

I am on tmobile and Private Relay is working fine for me.

stjohnswarts 5y ago

If they do this then I will find a new carrier. I will also loudly announce it on their twitter feeds.

djrogers 5y ago

I’m not a T-Mobile customer, but I am a network architect and have done some work and research on blocking and enabling iCloud private relay. It appears what’s happening here is the T-Mobile is blocking it and people have content filtering enabled, because they can’t filter contact if they can’t see it. [1] https://tmo.report/2022/01/t-mobile-blocking-icloud-private-relay-for-some-but-its-not-what-you-think/ https://tmo.report/2022/01/t-mobile-blocking-icloud-private-...

DanAtC 5y ago

Terrible. The official method for blocking iCloud Relay is via DNS: https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay https://developer.apple.com/support/prepare-your-network-for... I wonder if this is what they're doing. If so, it's a hassle, but you can specify custom DNS servers (even DoH and DoT) for mobile connections using a .mobileconfig file. https://dns.notjakob.com/ https://dns.notjakob.com/ can generate them for you. Probably a good idea to do this anyway to keep your carrier from spying on your DNS requests.

kotaKat 5y ago
No, they're (very likely) using the same mobile entitlements system that does tethering/mobile hotspot and WiFi calling enablement checks (the Entitlement Layer Protocol).

eyelidlessness 5y ago

For what it’s worth this reminded me to turn it on/try it out and so far a few hours in I’ve had no problems (T-Mobile/US).

deleted 5y ago

[deleted]

aaronbrethorst 5y ago

Fwiw, the CEO of T-Mobile has been been claiming this story is inaccurate. https://twitter.com/MikeSievert/status/1480716872848842752 https://twitter.com/MikeSievert/status/1480716872848842752

bluSCALE4 5y ago

Guess it's time for regulation.

xbar 5y ago

This kind of brash carrier disregard for consumer choice is a downstream effect of a net-neutrality-free-Ajit-Pai-FCC. Transparency by Apple (and Android, as applicable) to the consumer about what features carriers disable should be mandatory You don't have to punish carriers. If the market (and consumers) cares about such features, let it decide.

oaiey 5y ago

I am careful on what side I am favouring. There is Apple, a company known for its golden cage system and then there are the telcos with their strange extra features. In the end, I want to have a clean network. And that means no private relay for 50% of mobile users and no telcos screwing my DNS, headers, zero rate my traffic whatever. Seems like I am loose-loose situation to me.

michelb 5y ago

Some more info, also in the now updated submission: https://tmo.report/2022/01/t-mobile-blocking-icloud-private-relay-for-some-but-its-not-what-you-think/ https://tmo.report/2022/01/t-mobile-blocking-icloud-private-...

dang 5y ago

This just in: Verizon, AT&T and T-Mobile say they’re not blocking Apple’s iCloud Private Relay - https://news.ycombinator.com/item?id=29901056 https://news.ycombinator.com/item?id=29901056