3 ms·

A VPN that only works with Safari and apps using the native HTTP libraries to make unencrypted HTTP requests.

LeoPanthera 4y ago
Do you have a citation for this? That is not my experience. With iCloud Relay enabled, all outgoing traffic seems to go through the relay.
- 58028641 4y ago
  From iOS Settings App: Private Relay hides your IP address and browsing activity in Safari and protects your unencrypted internet traffic so that no one-including Apple-can see both who you are and what sites you're visiting
  - ec109685 4y ago
    Encrypted safari traffic goes through the relay.
    - lathiat 4y ago
      Encrypted safari traffic is an exception. But encrypted app traffic does not. They made it a few years ago they all apps had to use encryption. Long before private relay came out. I have wondered if this was why.
      - justsomeadvice0 4y ago
        Agreed, we can only speculate; personally I would be surprised if that was the "long-term" plan instead of just a push at the time to enforce industry best practices on its apps. My hunch would be such a move might be disruptive to certain apps (banking?) and they are allowing more time before tunneling everything, but this is just a guess.
        4ad 4y ago
        See my other comment about how iCloud Private Relay works. There are basically almost no security measures that prevent you from using it with other apps. This leads me to speculate that Apple intends to eventually enable this globally, so they don't really bother now with trying to lock it down too much.
        deleted 4y ago
        [deleted]
4ad 4y ago
It's a whitelist of apps that are tunnelled through the relay, but apps don't have to use any sort of special networking library, pure Berkley sockets work just fine through the relay. Also, anything that attempts to use port 80 goes through the relay, it doesn't have to be HTTP, as I said, plain BSD sockets work. This whitelist is implemented using the regular macOS/iOS per-app firewall. Not only this is accessible to users, but the whitelist matches based on the Mach-O UUID, which is an arbitrary number put in by the linker... The restriction on which apps can use iCloud Private Relay is trivially defeatable.

Do you have a citation for this? That is not my experience. With iCloud Relay enabled, all outgoing traffic seems to go through the relay.

58028641 4y ago
From iOS Settings App: Private Relay hides your IP address and browsing activity in Safari and protects your unencrypted internet traffic so that no one-including Apple-can see both who you are and what sites you're visiting
- ec109685 4y ago
  Encrypted safari traffic goes through the relay.
  - lathiat 4y ago
    Encrypted safari traffic is an exception. But encrypted app traffic does not. They made it a few years ago they all apps had to use encryption. Long before private relay came out. I have wondered if this was why.
    - justsomeadvice0 4y ago
      Agreed, we can only speculate; personally I would be surprised if that was the "long-term" plan instead of just a push at the time to enforce industry best practices on its apps. My hunch would be such a move might be disruptive to certain apps (banking?) and they are allowing more time before tunneling everything, but this is just a guess.
      - 4ad 4y ago
        See my other comment about how iCloud Private Relay works. There are basically almost no security measures that prevent you from using it with other apps. This leads me to speculate that Apple intends to eventually enable this globally, so they don't really bother now with trying to lock it down too much.
      - deleted 4y ago
        [deleted]

4ad 4y ago

It's a whitelist of apps that are tunnelled through the relay, but apps don't have to use any sort of special networking library, pure Berkley sockets work just fine through the relay. Also, anything that attempts to use port 80 goes through the relay, it doesn't have to be HTTP, as I said, plain BSD sockets work. This whitelist is implemented using the regular macOS/iOS per-app firewall. Not only this is accessible to users, but the whitelist matches based on the Mach-O UUID, which is an arbitrary number put in by the linker... The restriction on which apps can use iCloud Private Relay is trivially defeatable.