2 ms·
I wonder if the author tried using an On Demand VPN rule for the default route. That's always what I've done when setting this stuff up. Correct me if I'm wrong
by dcow 4y ago
I wonder if the author tried using an On Demand VPN rule for the default route. That's always what I've done when setting this stuff up. Correct me if I'm wrong, but you don't need a device management profile to enable an on-demand VPN for all traffic. Then, reboot your phone and all application traffic, or traffic that isn't something system (APNS) or management/link-local (dhcp, mdns, etc.) will use the tunnel.
- sneak 4y agoAPNS client cert is linked to your hardware serial, so by linking all your non-VPN client IPs together by serial, Apple gets your travel history due to city-level client IP geolocation. Enough points (APNS is always connected, so whenever your phone is on) and this uniquely identifies you (even if the serial number wasn’t bought with your own credit card). Then they have to give it to DHS/ICE/FBI/CIA without a warrant on demand, thanks to FAA702. They, of course, already have all of the cell tower association records, as well as all of the Secure Flight program data from the TSA. It’s not a difficult query to figure out which serial numbers are which IMEIs are which humans.
- dcow 4y agoNo I agree on the it's not good that APNS is an exception. I suspect that it's something technical like in order to receive push data in low power states, since the kernel isn't awake, userspace VPN is not involved. In an ideal world you'd be able to choose whether you wanted to spend a little extra battery to bump into a higher power state so that this information didn't leak.