5 ms·

Is iCloud Private Relay theatre? 3rd party cookie blocking? What specific features do you allege exist just to mislead the general public?

deleted 3y ago
[deleted]
lapcat 3y ago
> Is iCloud Private Relay theatre? https://fingerprint.com/blog/ios15-icloud-private-relay-vulnerability/ https://fingerprint.com/blog/ios15-icloud-private-relay-vuln... > 3rd party cookie blocking? It's very funny that you should ask this question in response to an article about fingerprinting without cookies. But yes, there are various workaround to use 1st party cookies or other storage to take the place of 3rd party cookies. Perhaps the worst is the Safari "Privacy Report", which has always been misleading: https://www.simoahava.com/privacy/intelligent-tracking-prevention-ios-14-ipados-14-safari-14/ https://www.simoahava.com/privacy/intelligent-tracking-preve...
- fh9302 3y ago
  Do you have something more recent than a leak from over 2 years ago that has long been fixed? I'm curious why iCloud Private Relay is theatre at the moment.
  - lapcat 3y ago
    [flagged]
    - JumpCrisscross 3y ago
      > It was advertised as being private, but it wasn't Signal had a bug once. Herego, it’s a scam?
      - lapcat 3y ago
        > Signal had a bug once. Are you referring to this? https://www.forbes.com/sites/daveywinder/2019/10/05/signal-messenger-eavesdropping-exploit-confirmedwhat-you-need-to-know/?sh=d3fe2487dc11 https://www.forbes.com/sites/daveywinder/2019/10/05/signal-m... It was a bad bug in the Android client, to be sure, but it didn't bypass Signal encryption.
    - shuckles 3y ago
      And a VPN leaks a lot of information about your network activity to the operator, so by your standard it is privacy theater. Do you see why you’re coming across as having inconsistent standards and thereby perhaps an axe to grind? iCloud Private Relay is used for all network activity from Safari which does not seem like a “limited amount of activity.”
      - lapcat 3y ago
        > And a VPN leaks a lot of information about your network activity to the operator, so by your standard it is privacy theater. A VPN isn't designed to keep your IP address hidden from the operator. iCloud Private Relay doesn't hide your IP address from Apple either. That's not the point, and everyone knows this in advance. The point is to keep your IP address hidden from the request destination servers.
        shuckles 3y ago
        Your logic is that any flaw in an implementation renders it useless. In the case of VPNs, operators can and do share information about clients to destination servers, law enforcement, and more out of band. Just because it involves a spreadsheet and not a WebRTC request does not mean it can be forgiven if you're going around making absolutist claims regarding efficacy.
        lapcat 3y ago
        > Your logic is that any flaw in an implementation renders it useless. I didn't say that. It's a straw man.
        shuckles 3y ago
        You said that iCPR is privacy theatre because of a resolved security bug from 2 years ago. Please spell out the implication of that claim for me then.
        3y ago
- shuckles 3y ago
  Built in tracker blocking and the various ways Safari makes it hard to share user sessions with 3rd parties absolutely has real effect. It also has real costs: part of Safari’s poor compatibility reputation comes from websites that are broken by its tracking prevention features. This is why Google claims they haven’t rolled out the same. If Apple only cared about the problem at a superficial level, why wouldn’t they do the same as Chrome and talk a big game about the problem but continuously delay changes? I’d say the privacy report is the only real false security feature, but Apple was a laggard in that market. For all we know, they could have been trying to match features with Ghostery or Brave that teach consumers this is a feature you should expect from your browser. Users may also have been needed education about that behavior in order to justify the compatibility regressions cookie blocking incurs. It’s impossible to know from the outside, but your body of evidence to support a really strong accusation is quite weak.
  - lapcat 3y ago
    > If Apple only cared about the problem at a superficial level, why wouldn’t they do the same as Chrome and talk a big game about the problem but continuously delay changes? If Safari behaved the same as Chrome, then Apple couldn't market Safari as more private than Chrome.
    - shuckles 3y ago
      This is obviously untrue. People accuse Apple of marketing differences where none exist all the time. Thus the trope "X did it first" or "Y on Z is basically the same."
      - lapcat 3y ago
        > People accuse Apple of marketing differences where none exist all the time. Thus the trope "X did it first" or "Y on Z is basically the same." I don't know what you're talking about. What are X, Y, and Z specifically?
- st3fan 3y ago
  "Please note that this leak only occurs with iCloud Private Relay on iOS 15" All software has bugs. I think it is more interesting to see how companies respond to reported issues. And how they improve things. Is OpenSSL "theatre" because it had (bad!) bugs in the past?
  - lapcat 3y ago
    [flagged]
    - st3fan 3y ago
      Well I’ll add to my response that I think it is delusional to think that (security) features ship bug free. It is a bar that _nobody_ can or has met. It is not how the software world works at large.
      - lapcat 3y ago
        > Well I’ll add to my response that I think it is delusional to think that (security) features ship bug free. Have you considered that I'm not delusional, and my point may be more subtle than your straw man? > It is not how the software world works at large. Have you considered that I'm a software developer myself?
- acdha 3y ago
  The term “security theater” has a specific meaning which is not a bug or less than perfect protection: per its creator, “Security theater refers to security measures that make people feel more secure without doing anything to actually improve their security.” https://www.schneier.com/blog/archives/2009/11/beyond_security.html https://www.schneier.com/blog/archives/2009/11/beyond_securi... Public Relay is obviously not accurately described by that term and any rule which classifies it as such would be useless because it would classify all browser security as theater because everyone has had bugs, and everyone has had to adopt more sophisticated defenses to counter more sophisticated attackers.
  - lapcat 3y ago
    [flagged]
    - acdha 3y ago
      Yes, and privacy theater is clearly an attempt to apply the same concept to a closely related topic. I edited my comment to focus on the problem here: you started with this absurdly sweeping claim which you’ve been unable to meaningfully substantiate throughout the thread. Trying to dismiss something as theater based on a bug fixed in the beta period is not only self-contradictory (you’re tacitly admitting that it’s not theater now) but also almost useless as a heuristic because very few products never have bugs. Now if we want to talk about guidelines, consider that the broad claim you originally made would have to be widely accepted in the industry not to need supporting evidence, at which point it wouldn’t be contributing anything; since the opposite is true, the guidelines about flame bait cover it. It could have gone in a potentially useful direction if you’d been willing to define your terms and support them with evidence, and that would have helped suggest less hyperbolic terms. For example, if you said that Apple could do better at vetting and implementing their features I doubt many people would disagree with you.
fsflover 3y ago
https://sneak.berlin/20231005/apple-operating-system-surveillance/ https://sneak.berlin/20231005/apple-operating-system-surveil...

deleted 3y ago

[deleted]

lapcat 3y ago

> Is iCloud Private Relay theatre? https://fingerprint.com/blog/ios15-icloud-private-relay-vulnerability/ https://fingerprint.com/blog/ios15-icloud-private-relay-vuln... > 3rd party cookie blocking? It's very funny that you should ask this question in response to an article about fingerprinting without cookies. But yes, there are various workaround to use 1st party cookies or other storage to take the place of 3rd party cookies. Perhaps the worst is the Safari "Privacy Report", which has always been misleading: https://www.simoahava.com/privacy/intelligent-tracking-prevention-ios-14-ipados-14-safari-14/ https://www.simoahava.com/privacy/intelligent-tracking-preve...

fh9302 3y ago
Do you have something more recent than a leak from over 2 years ago that has long been fixed? I'm curious why iCloud Private Relay is theatre at the moment.
- lapcat 3y ago
  [flagged]
  - JumpCrisscross 3y ago
    > It was advertised as being private, but it wasn't Signal had a bug once. Herego, it’s a scam?
    - lapcat 3y ago
      > Signal had a bug once. Are you referring to this? https://www.forbes.com/sites/daveywinder/2019/10/05/signal-messenger-eavesdropping-exploit-confirmedwhat-you-need-to-know/?sh=d3fe2487dc11 https://www.forbes.com/sites/daveywinder/2019/10/05/signal-m... It was a bad bug in the Android client, to be sure, but it didn't bypass Signal encryption.
  - shuckles 3y ago
    And a VPN leaks a lot of information about your network activity to the operator, so by your standard it is privacy theater. Do you see why you’re coming across as having inconsistent standards and thereby perhaps an axe to grind? iCloud Private Relay is used for all network activity from Safari which does not seem like a “limited amount of activity.”
    - lapcat 3y ago
      > And a VPN leaks a lot of information about your network activity to the operator, so by your standard it is privacy theater. A VPN isn't designed to keep your IP address hidden from the operator. iCloud Private Relay doesn't hide your IP address from Apple either. That's not the point, and everyone knows this in advance. The point is to keep your IP address hidden from the request destination servers.
      - shuckles 3y ago
        Your logic is that any flaw in an implementation renders it useless. In the case of VPNs, operators can and do share information about clients to destination servers, law enforcement, and more out of band. Just because it involves a spreadsheet and not a WebRTC request does not mean it can be forgiven if you're going around making absolutist claims regarding efficacy.
        lapcat 3y ago
        > Your logic is that any flaw in an implementation renders it useless. I didn't say that. It's a straw man.
        shuckles 3y ago
        You said that iCPR is privacy theatre because of a resolved security bug from 2 years ago. Please spell out the implication of that claim for me then.
        3y ago
shuckles 3y ago
Built in tracker blocking and the various ways Safari makes it hard to share user sessions with 3rd parties absolutely has real effect. It also has real costs: part of Safari’s poor compatibility reputation comes from websites that are broken by its tracking prevention features. This is why Google claims they haven’t rolled out the same. If Apple only cared about the problem at a superficial level, why wouldn’t they do the same as Chrome and talk a big game about the problem but continuously delay changes? I’d say the privacy report is the only real false security feature, but Apple was a laggard in that market. For all we know, they could have been trying to match features with Ghostery or Brave that teach consumers this is a feature you should expect from your browser. Users may also have been needed education about that behavior in order to justify the compatibility regressions cookie blocking incurs. It’s impossible to know from the outside, but your body of evidence to support a really strong accusation is quite weak.
- lapcat 3y ago
  > If Apple only cared about the problem at a superficial level, why wouldn’t they do the same as Chrome and talk a big game about the problem but continuously delay changes? If Safari behaved the same as Chrome, then Apple couldn't market Safari as more private than Chrome.
  - shuckles 3y ago
    This is obviously untrue. People accuse Apple of marketing differences where none exist all the time. Thus the trope "X did it first" or "Y on Z is basically the same."
    - lapcat 3y ago
      > People accuse Apple of marketing differences where none exist all the time. Thus the trope "X did it first" or "Y on Z is basically the same." I don't know what you're talking about. What are X, Y, and Z specifically?
st3fan 3y ago
"Please note that this leak only occurs with iCloud Private Relay on iOS 15" All software has bugs. I think it is more interesting to see how companies respond to reported issues. And how they improve things. Is OpenSSL "theatre" because it had (bad!) bugs in the past?
- lapcat 3y ago
  [flagged]
  - st3fan 3y ago
    Well I’ll add to my response that I think it is delusional to think that (security) features ship bug free. It is a bar that _nobody_ can or has met. It is not how the software world works at large.
    - lapcat 3y ago
      > Well I’ll add to my response that I think it is delusional to think that (security) features ship bug free. Have you considered that I'm not delusional, and my point may be more subtle than your straw man? > It is not how the software world works at large. Have you considered that I'm a software developer myself?
acdha 3y ago
The term “security theater” has a specific meaning which is not a bug or less than perfect protection: per its creator, “Security theater refers to security measures that make people feel more secure without doing anything to actually improve their security.” https://www.schneier.com/blog/archives/2009/11/beyond_security.html https://www.schneier.com/blog/archives/2009/11/beyond_securi... Public Relay is obviously not accurately described by that term and any rule which classifies it as such would be useless because it would classify all browser security as theater because everyone has had bugs, and everyone has had to adopt more sophisticated defenses to counter more sophisticated attackers.
- lapcat 3y ago
  [flagged]
  - acdha 3y ago
    Yes, and privacy theater is clearly an attempt to apply the same concept to a closely related topic. I edited my comment to focus on the problem here: you started with this absurdly sweeping claim which you’ve been unable to meaningfully substantiate throughout the thread. Trying to dismiss something as theater based on a bug fixed in the beta period is not only self-contradictory (you’re tacitly admitting that it’s not theater now) but also almost useless as a heuristic because very few products never have bugs. Now if we want to talk about guidelines, consider that the broad claim you originally made would have to be widely accepted in the industry not to need supporting evidence, at which point it wouldn’t be contributing anything; since the opposite is true, the guidelines about flame bait cover it. It could have gone in a potentially useful direction if you’d been willing to define your terms and support them with evidence, and that would have helped suggest less hyperbolic terms. For example, if you said that Apple could do better at vetting and implementing their features I doubt many people would disagree with you.

fsflover 3y ago

https://sneak.berlin/20231005/apple-operating-system-surveillance/ https://sneak.berlin/20231005/apple-operating-system-surveil...