5 ms·

> traffic is legitimate with a high degree of certainty (it's tied to an iCloud account that can be blocked Wait… what? The traffic on this private relay can b

> traffic is legitimate with a high degree of certainty (it's tied to an iCloud account that can be blocked Wait… what? The traffic on this private relay can be traced back to your iCloud account? By Apple? By any website you visit? What are you talking about?

donavanm 4y ago
AFAIK only existing iCloud users on apple OS devices can use private relay. Apple doesn't need/care about the content of your session (it's routed through 3Ps). But what they can do is drop support for your icloud account, which prevents you from using private relay. Transitively tying it to active apple hardware IDs, via iCloud, also means theres a significant real cost to setting up to use this service. There's basically no way bulks scammers/scraping/manipulation/etc can afford that cost for their disposable use cases. This compares VERY unfavorably to the costs of farming gmail/microsoft/ISP accounts, from the scammers perspective.
- braingenious 4y ago
  > But what they can do is drop support for your icloud account, which prevents you from using private relay. How does Apple tie your traffic to your iCloud account? They have repeatedly stated that they cannot see what any account is doing.
  - justsomeadvice0 4y ago
    I believe all OP is trying to say is that Apple controls ingress nodes, which the customer connects (authenticating with iCloud) to as the first hop; the destination and content of the packets is encrypted to the second hop and cannot be decrypted by them. But if Apple wants to stop your iCloud account from sending traffic through the relay it can do so at any moment. This should not be surprising, it's not an "open" relay but a premium service.
    - braingenious 4y ago
      I am aware of the part of the reasoning you’ve described. What I’m trying to figure out is how “Apple can ban users” translates to “website owners will trust that traffic more.” Apple literally cannot ban you for malicious or fraudulent traffic (assuming you believe them), so what is the difference between this and any other paid VPN service? Those also cost money.
      - justsomeadvice0 4y ago
        Oh I see. Yea TBH I'm not sure what happens sure if hop 2 (e.g. Cloudflare) reports fraud/abuse "up" to Apple; whether Apple takes action or not. It would certainly be technically possible but would require cooperation between the two companies, that's the only guarantee I can find. Private access tokens are a real solution here, so maybe Apple does nothing in such a scenario and expects end sites to verify those.
        justsomeadvice0 4y ago
        I read a bit more, here is how it works, from the white paper: https://www.apple.com/icloud/docs/iCloud_Private_Relay_Overview_Dec2021.pdf https://www.apple.com/icloud/docs/iCloud_Private_Relay_Overv... > Authorization is performed by presenting a valid, anonymous token based on RSA blind signatures. These signatures are sent as one-time-use tokens to each proxy when establishing a connection, separating legitimate from illegitimate devices. The proxies can validate the tokens with a public key to validate that the user is legitimate, without actually identifying the user. > The following fields related to anonymous token issuance are logged as a part of Private Relay’s fraud prevention and anti-abuse measures, but cannot be correlated with connection information: > • iCloud account, software version, and request timestamp Sounds like both Apple and Cloudflare hops get the token. But Apple stashes a mapping of the token->iCloud account on its end, presumably to deal with fraud requests from Cloudflare. So my understanding then is if Apple gets a fraud/abuse request for someone's token from Cloudflare, it can and will banish your iCloud account from the service. Edit: on closer reading I think I was wrong... The stated logged data could just be to rate limit the tokens you can request. It doesn't say they log the token itself, and they do say "cannot be correlated with connection information". So it seems you are right!
  - gbN025tt2Z1E2E4 4y ago
    > They have repeatedly stated that they cannot see what any account is doing. Do you honestly believe that? One of the most powerful telecommunication hardware companies in America, hilariously somehow NOT being in bed with government agencies? Perhaps Apple can't see your traffic, so by the letter of their statement, what they said is true... but the mystery boxes in locked rooms at Akamai, Fastly, and Cloudflare I'm sure can connect your traffic across the relay hops juuuuuuust fine. Not to mention the other poster's important point of having the traffic effectively tagged to your iCloud account is stunningly probably very accurate. I knew this thing was bad news the moment I first read about it, now I feel even more strongly it is indeed America's version of the great firewall and social credit score impacted by your net traffic and the websites you visited pumped up on American steroids. Cloudflare sitting as a proxy in front of tons of other websites otherwise in the wild closes the significant gap left by non-Apple device users.
    - braingenious 4y ago
      > Do you honestly believe that? I believe that that is what they have repeatedly said. Is your position that Apple is doing some sort of scam on their paying users in order to compromise their privacy to random websites? I did not bring up any law enforcement organizations, I was responding to the idea that since Apple can ban users, random website operators will trust their relay traffic more. This is a completely unrelated thing.
pnpnp 4y ago
Ah - after re-reading the article, I think you’re correct. That being said, there’s still a barrier to entry by having an i-device/i-account. I wonder if there would be a way for them to ban abuse since they have so much control over the ecosystem?

donavanm 4y ago

AFAIK only existing iCloud users on apple OS devices can use private relay. Apple doesn't need/care about the content of your session (it's routed through 3Ps). But what they can do is drop support for your icloud account, which prevents you from using private relay. Transitively tying it to active apple hardware IDs, via iCloud, also means theres a significant real cost to setting up to use this service. There's basically no way bulks scammers/scraping/manipulation/etc can afford that cost for their disposable use cases. This compares VERY unfavorably to the costs of farming gmail/microsoft/ISP accounts, from the scammers perspective.

braingenious 4y ago
> But what they can do is drop support for your icloud account, which prevents you from using private relay. How does Apple tie your traffic to your iCloud account? They have repeatedly stated that they cannot see what any account is doing.
- justsomeadvice0 4y ago
  I believe all OP is trying to say is that Apple controls ingress nodes, which the customer connects (authenticating with iCloud) to as the first hop; the destination and content of the packets is encrypted to the second hop and cannot be decrypted by them. But if Apple wants to stop your iCloud account from sending traffic through the relay it can do so at any moment. This should not be surprising, it's not an "open" relay but a premium service.
  - braingenious 4y ago
    I am aware of the part of the reasoning you’ve described. What I’m trying to figure out is how “Apple can ban users” translates to “website owners will trust that traffic more.” Apple literally cannot ban you for malicious or fraudulent traffic (assuming you believe them), so what is the difference between this and any other paid VPN service? Those also cost money.
    - justsomeadvice0 4y ago
      Oh I see. Yea TBH I'm not sure what happens sure if hop 2 (e.g. Cloudflare) reports fraud/abuse "up" to Apple; whether Apple takes action or not. It would certainly be technically possible but would require cooperation between the two companies, that's the only guarantee I can find. Private access tokens are a real solution here, so maybe Apple does nothing in such a scenario and expects end sites to verify those.
      - justsomeadvice0 4y ago
        I read a bit more, here is how it works, from the white paper: https://www.apple.com/icloud/docs/iCloud_Private_Relay_Overview_Dec2021.pdf https://www.apple.com/icloud/docs/iCloud_Private_Relay_Overv... > Authorization is performed by presenting a valid, anonymous token based on RSA blind signatures. These signatures are sent as one-time-use tokens to each proxy when establishing a connection, separating legitimate from illegitimate devices. The proxies can validate the tokens with a public key to validate that the user is legitimate, without actually identifying the user. > The following fields related to anonymous token issuance are logged as a part of Private Relay’s fraud prevention and anti-abuse measures, but cannot be correlated with connection information: > • iCloud account, software version, and request timestamp Sounds like both Apple and Cloudflare hops get the token. But Apple stashes a mapping of the token->iCloud account on its end, presumably to deal with fraud requests from Cloudflare. So my understanding then is if Apple gets a fraud/abuse request for someone's token from Cloudflare, it can and will banish your iCloud account from the service. Edit: on closer reading I think I was wrong... The stated logged data could just be to rate limit the tokens you can request. It doesn't say they log the token itself, and they do say "cannot be correlated with connection information". So it seems you are right!
- gbN025tt2Z1E2E4 4y ago
  > They have repeatedly stated that they cannot see what any account is doing. Do you honestly believe that? One of the most powerful telecommunication hardware companies in America, hilariously somehow NOT being in bed with government agencies? Perhaps Apple can't see your traffic, so by the letter of their statement, what they said is true... but the mystery boxes in locked rooms at Akamai, Fastly, and Cloudflare I'm sure can connect your traffic across the relay hops juuuuuuust fine. Not to mention the other poster's important point of having the traffic effectively tagged to your iCloud account is stunningly probably very accurate. I knew this thing was bad news the moment I first read about it, now I feel even more strongly it is indeed America's version of the great firewall and social credit score impacted by your net traffic and the websites you visited pumped up on American steroids. Cloudflare sitting as a proxy in front of tons of other websites otherwise in the wild closes the significant gap left by non-Apple device users.
  - braingenious 4y ago
    > Do you honestly believe that? I believe that that is what they have repeatedly said. Is your position that Apple is doing some sort of scam on their paying users in order to compromise their privacy to random websites? I did not bring up any law enforcement organizations, I was responding to the idea that since Apple can ban users, random website operators will trust their relay traffic more. This is a completely unrelated thing.

pnpnp 4y ago

Ah - after re-reading the article, I think you’re correct. That being said, there’s still a barrier to entry by having an i-device/i-account. I wonder if there would be a way for them to ban abuse since they have so much control over the ecosystem?