6 ms·

> Proxying unencrypted HTTP. Any unencrypted HTTP resources loaded in Private Browsing will use the same multi-hop proxy network used to hide IP addresses from

> Proxying unencrypted HTTP. Any unencrypted HTTP resources loaded in Private Browsing will use the same multi-hop proxy network used to hide IP addresses from trackers. This ensures that attackers in the local network cannot see or modify the content of Private Browsing traffic. No thanks, Apple! I trust my ISP more than you. Multi-hop wont matter if all nodes are managed by you.

piperswe 2y ago
iCloud Private Relay uses one hop through Apple infrastructure, and one hop through third-party infrastructure. So, one node is managed by Apple and the other is managed by Cloudflare/Akamai/Fastly. The Apple node knows where the request comes from but not the contents, while the CF/Akamai/Fastly node knows the contents but not the source.
- yupyupyups 2y ago
  This works as long as there is no one combining the information together, like Apple together with Cloudflare, or the US government. This is a concern, since both are under the same jurestiction and are bussiness partners. Contrast this model with Tor where you have 3 hops that are selected in such a way that there is a lower probability that logs from the node operators will be combined. If two nodes, let's say node 1 and 3 are coorporating, then the best that they can do is a correlation attack or other probabalistic methods. If two nodes (all of them) in WebKit are adverserial, then the content is linked back to your IP address with 100% probability.
  - Arnavion 2y ago
    To be clear, the only advantage of Tor wrt correlation is that it uses more hops, not anything related to how those hops are selected, right?
    - fragmede 2y ago
      How paranoid are you? If I were the US government and wanted a leg up on Internet meta data of people looking to avoid surveillance, I'd run a shitton of Tor exit nodes and log IP information on the off chance something useful comes of it.
      - bangaladore 2y ago
        Afaik, all that gives you is the person running the exit node (and where the request is going) and nothing about the person who initiated the request N-hops ago.
        radicaldreamer 2y ago
        A large set of exit and relay nodes are being run out of Germany, presumably by some state actor, so it's likely at least a subset of traffic is being unmasked by a state actor. I'm sure some of this info has been passed on and then parallel construction used to obfuscate the initial source of the data.
      - devmor 2y ago
        Isn’t that exactly what they do?
    - chatmasta 2y ago
      Tor and Private Relay are both vulnerable to traffic analysis by a global adversary, which is what OP is complaining about here (if Apple and Cloudflare collude or are compelled to share data). Basically, if you can see the traffic going in/out of all the nodes (even just the amount of it), then you can deanonymize individual streams of data. Tor explicitly does not defend against this threat.
      - Arnavion 2y ago
        Yes I know. My point was that yupyupyups said: >Contrast this model with Tor where you have 3 hops that are selected in such a way that there is a lower probability that logs from the node operators will be combined "selected in such a way" sounded like there is something in Tor that actively works against a situation where the hops are owned by the same operator, but AFAIK there isn't such a thing. Hence my request for confirmation that the only thing Tor does better than the Apple+Cloudflare situation here is that it has more than two hops so that it increases the number of colluders needed for correlation.
        chatmasta 2y ago
        Yeah, all true. In fact Tor explicitly forgoes any mitigation against a global passive adversary - it’s designed to accept that risk. Another thing Tor does better is that it creates circuits with nodes spanning multiple jurisdictions, whereas Private Relay circuits are confined to one jurisdiction (and worse, to your current one). > actively works against a situation where the hops are owned by the same operator, but AFAIK there isn't such a thing Right, there is nothing Tor can do to guarantee this, but it does take some best-effort measures like maximizing diversity of AS providers (you won’t get a circuit of three nodes with the same AS number). Of course this is meaningless in a world where anyone can purchase servers from anywhere. There is a lot of research on this attack vector against Tor (and p2p networks in general) - the relevant search term is “Sybil resistance.” Btw - just to add some detail to the discussion, this blog post from Cloudflare is a good introduction to Private Relay: https://blog.cloudflare.com/icloud-private-relay https://blog.cloudflare.com/icloud-private-relay
  - radicaldreamer 2y ago
    How is this less secure than just using your ISP with no hops though? How do you evaluate "trust" in this situation? What if your ISP is working with the local cops or US government directly?
    - kvdveer 2y ago
      You are assuming a US ISP. That's only true for a minority of internet users. Trusting local parties of US parties is not a strange thought, especially since I can influence their supervision with my vote. Also, it seems plausible that the US is headed into dictatorship or civil war in the near future. Nether scenario helps me trust the US jurisdiction.
      - radicaldreamer 2y ago
        If you’re outside the US, I’d be even more concerned about the US completely compromising your networks. It’s well known the NSA is tapping backbones, DNS, and exchanges around the world
  - Asooka 2y ago
    > This works as long as there is no one combining the information together, like Apple together with Cloudflare, or the US government. If that is your threat model, you need something a lot stronger than Private Browsing, whose purpose begins and ends with "I do not want other people to know what porn sites I visit". Tor is a good start.
    - chatmasta 2y ago
      Tor is vulnerable to the same threat of a global passive observer. But at least you can mitigate against it by ensuring the nodes are in separate jurisdictions.
    - Aachen 2y ago
      > If that is your threat model, you need something a lot stronger than Private Browsing You mean like an ISP that isn't in (and doesn't unnecessarily route through) the USA?
  - yupyupyups 2y ago
    @radicaldreamer, I don't live in the US, same goes with a large number of Apple's customers. A user's residential IP address is in many cases almost static, and doesn't change that often. If you use the same residential IP for other services from Apple, or sites that are protected by Cloudflare's MITM DDOS protection, the content of the HTTP site can be linked back to you with a high probability through your IP address, and possibly in combination with other metadata such as the user-agent, or other headers.
    - avianlyric 2y ago
      So how exactly is using unencrypted HTTP better? Which was your original claim.
      - yupyupyups 2y ago
        The probability that a user's identity would be linked up with browsing HTTP sites and an attempt to use that in an adverserial manner is higher when it's Apple than when using my ISP. Of course, you may think differently regarding your ISP, but that's for each one of us to decide about our own service providers.
        radicaldreamer 2y ago
        I don't understand, why is using 10 sites with a cloudflare layer linking directly to your static home IP less likely to identify you across those sites than a double hop via apple's servers where the sites (and cloudflare) don't know which sites are being visited by which end user static ip?
        yupyupyups 2y ago
        Browsing an HTTP site that would otherwise have nothing to do with Cloudflare could end up becoming associated with you. That can happen if the data that CF has is matched with the data at Apple, either by Apple and CF themselves or the US government. The sites that already are MITM'd by Cloudflare are a different story. Cloudflare is going to know what IP address visited them at what time, and if you login with your personal email address, or if your personal phone number is shown in your account settings, then your identity is linked with some probability to that IP address+time. If you then browse a non-CF HTTP site, using Apple's proposed proxy, there would be the risk that your identity+IP address that CF knows become associated with using the HTTP site as well. If you don't use Apple's proxy at all, you connecting to a non-CF HTTP site would only be known by your ISP.
  - deleted 2y ago
    [deleted]
deleted 2y ago
[deleted]
deleted 2y ago
[deleted]
avianlyric 2y ago
Apple only control half the nodes, the other half is controlled by cloudflare. Every request goes via an Apple node first, then is sent to a 3rd party node for final routing. That way neither Apple nor the 3rd party have a complete picture of where a request came from, or where it went. Not entirely sure why you would trust a random ISP, and everyone else involved in routing that connection, more than Apple. Last I checked most ISP don’t have the tightest privacy policies, or even the best data handling practices. Apple stands to loose millions if they slip up on their privacy promises. Most ISP wouldn’t even bother telling you if they accidentally misplaced your personal details. https://blog.cloudflare.com/icloud-private-relay/ https://blog.cloudflare.com/icloud-private-relay/
afavour 2y ago
Congratulations on trusting your ISP, you are in the minority.
- yupyupyups 2y ago
  I wouldn't say that I trust my ISP. I'm saying that to me, they are more trustworthy than Apple.
  - afavour 2y ago
    Pretty sure my statement still applies there too!
  - lostlogin 2y ago
    You must have a good ISP. I’ve got one too, it’s taken me 25 years to find. https://voyager.nz/ https://voyager.nz/
    - yupyupyups 2y ago
      They're pretty okay actually, they are not trigger happy when dealing with copyright infringment claims. And no NAT!
      - lostlogin 2y ago
        Static IP is cheap. They don’t go above a gigabit, but other than that it all good. And do I really need more bandwidth?
  - jbverschoor 2y ago
    Really… in Europe, all ISPs and phone companies were required to keep a log of traffic and location (for example email addresses source/dest up). This was until 2015 but I’m sure some still do
    - yupyupyups 2y ago
      My ISP is required to save logs as far as I'm aware, and I think that's bad, don't get me wrong. I still trust Apple and Cloudflare less, because I believe that data in their hands is more likely to end up being used in an adverserial manner. This is my opinion.
kylehotchkiss 2y ago
This is one of iCloud's best features. I'm almost always protected by something like a VPN but that Cloudflare has been programmed to trust so I don't see recaptchas all day. AT&T just helpfully leaked their call records database which serves as a data point against trusting ISP more than Apple & Cloudflare. If anything, I want Private Relay running for every application on my phone
lapcat 2y ago
Has anyone actually seen this feature in action? Looking at packet traces, I can't seem to get it to work. I'm still seeing DNS queries and HTTP in the clear. (I don't use iCloud Private Relay.)

piperswe 2y ago

iCloud Private Relay uses one hop through Apple infrastructure, and one hop through third-party infrastructure. So, one node is managed by Apple and the other is managed by Cloudflare/Akamai/Fastly. The Apple node knows where the request comes from but not the contents, while the CF/Akamai/Fastly node knows the contents but not the source.

yupyupyups 2y ago
This works as long as there is no one combining the information together, like Apple together with Cloudflare, or the US government. This is a concern, since both are under the same jurestiction and are bussiness partners. Contrast this model with Tor where you have 3 hops that are selected in such a way that there is a lower probability that logs from the node operators will be combined. If two nodes, let's say node 1 and 3 are coorporating, then the best that they can do is a correlation attack or other probabalistic methods. If two nodes (all of them) in WebKit are adverserial, then the content is linked back to your IP address with 100% probability.
- Arnavion 2y ago
  To be clear, the only advantage of Tor wrt correlation is that it uses more hops, not anything related to how those hops are selected, right?
  - fragmede 2y ago
    How paranoid are you? If I were the US government and wanted a leg up on Internet meta data of people looking to avoid surveillance, I'd run a shitton of Tor exit nodes and log IP information on the off chance something useful comes of it.
    - bangaladore 2y ago
      Afaik, all that gives you is the person running the exit node (and where the request is going) and nothing about the person who initiated the request N-hops ago.
      - radicaldreamer 2y ago
        A large set of exit and relay nodes are being run out of Germany, presumably by some state actor, so it's likely at least a subset of traffic is being unmasked by a state actor. I'm sure some of this info has been passed on and then parallel construction used to obfuscate the initial source of the data.
    - devmor 2y ago
      Isn’t that exactly what they do?
  - chatmasta 2y ago
    Tor and Private Relay are both vulnerable to traffic analysis by a global adversary, which is what OP is complaining about here (if Apple and Cloudflare collude or are compelled to share data). Basically, if you can see the traffic going in/out of all the nodes (even just the amount of it), then you can deanonymize individual streams of data. Tor explicitly does not defend against this threat.
    - Arnavion 2y ago
      Yes I know. My point was that yupyupyups said: >Contrast this model with Tor where you have 3 hops that are selected in such a way that there is a lower probability that logs from the node operators will be combined "selected in such a way" sounded like there is something in Tor that actively works against a situation where the hops are owned by the same operator, but AFAIK there isn't such a thing. Hence my request for confirmation that the only thing Tor does better than the Apple+Cloudflare situation here is that it has more than two hops so that it increases the number of colluders needed for correlation.
      - chatmasta 2y ago
        Yeah, all true. In fact Tor explicitly forgoes any mitigation against a global passive adversary - it’s designed to accept that risk. Another thing Tor does better is that it creates circuits with nodes spanning multiple jurisdictions, whereas Private Relay circuits are confined to one jurisdiction (and worse, to your current one). > actively works against a situation where the hops are owned by the same operator, but AFAIK there isn't such a thing Right, there is nothing Tor can do to guarantee this, but it does take some best-effort measures like maximizing diversity of AS providers (you won’t get a circuit of three nodes with the same AS number). Of course this is meaningless in a world where anyone can purchase servers from anywhere. There is a lot of research on this attack vector against Tor (and p2p networks in general) - the relevant search term is “Sybil resistance.” Btw - just to add some detail to the discussion, this blog post from Cloudflare is a good introduction to Private Relay: https://blog.cloudflare.com/icloud-private-relay https://blog.cloudflare.com/icloud-private-relay
- radicaldreamer 2y ago
  How is this less secure than just using your ISP with no hops though? How do you evaluate "trust" in this situation? What if your ISP is working with the local cops or US government directly?
  - kvdveer 2y ago
    You are assuming a US ISP. That's only true for a minority of internet users. Trusting local parties of US parties is not a strange thought, especially since I can influence their supervision with my vote. Also, it seems plausible that the US is headed into dictatorship or civil war in the near future. Nether scenario helps me trust the US jurisdiction.
    - radicaldreamer 2y ago
      If you’re outside the US, I’d be even more concerned about the US completely compromising your networks. It’s well known the NSA is tapping backbones, DNS, and exchanges around the world
- Asooka 2y ago
  > This works as long as there is no one combining the information together, like Apple together with Cloudflare, or the US government. If that is your threat model, you need something a lot stronger than Private Browsing, whose purpose begins and ends with "I do not want other people to know what porn sites I visit". Tor is a good start.
  - chatmasta 2y ago
    Tor is vulnerable to the same threat of a global passive observer. But at least you can mitigate against it by ensuring the nodes are in separate jurisdictions.
  - Aachen 2y ago
    > If that is your threat model, you need something a lot stronger than Private Browsing You mean like an ISP that isn't in (and doesn't unnecessarily route through) the USA?
- yupyupyups 2y ago
  @radicaldreamer, I don't live in the US, same goes with a large number of Apple's customers. A user's residential IP address is in many cases almost static, and doesn't change that often. If you use the same residential IP for other services from Apple, or sites that are protected by Cloudflare's MITM DDOS protection, the content of the HTTP site can be linked back to you with a high probability through your IP address, and possibly in combination with other metadata such as the user-agent, or other headers.
  - avianlyric 2y ago
    So how exactly is using unencrypted HTTP better? Which was your original claim.
    - yupyupyups 2y ago
      The probability that a user's identity would be linked up with browsing HTTP sites and an attempt to use that in an adverserial manner is higher when it's Apple than when using my ISP. Of course, you may think differently regarding your ISP, but that's for each one of us to decide about our own service providers.
      - radicaldreamer 2y ago
        I don't understand, why is using 10 sites with a cloudflare layer linking directly to your static home IP less likely to identify you across those sites than a double hop via apple's servers where the sites (and cloudflare) don't know which sites are being visited by which end user static ip?
        yupyupyups 2y ago
        Browsing an HTTP site that would otherwise have nothing to do with Cloudflare could end up becoming associated with you. That can happen if the data that CF has is matched with the data at Apple, either by Apple and CF themselves or the US government. The sites that already are MITM'd by Cloudflare are a different story. Cloudflare is going to know what IP address visited them at what time, and if you login with your personal email address, or if your personal phone number is shown in your account settings, then your identity is linked with some probability to that IP address+time. If you then browse a non-CF HTTP site, using Apple's proposed proxy, there would be the risk that your identity+IP address that CF knows become associated with using the HTTP site as well. If you don't use Apple's proxy at all, you connecting to a non-CF HTTP site would only be known by your ISP.
- deleted 2y ago
  [deleted]

deleted 2y ago

[deleted]

deleted 2y ago

[deleted]

avianlyric 2y ago

Apple only control half the nodes, the other half is controlled by cloudflare. Every request goes via an Apple node first, then is sent to a 3rd party node for final routing. That way neither Apple nor the 3rd party have a complete picture of where a request came from, or where it went. Not entirely sure why you would trust a random ISP, and everyone else involved in routing that connection, more than Apple. Last I checked most ISP don’t have the tightest privacy policies, or even the best data handling practices. Apple stands to loose millions if they slip up on their privacy promises. Most ISP wouldn’t even bother telling you if they accidentally misplaced your personal details. https://blog.cloudflare.com/icloud-private-relay/ https://blog.cloudflare.com/icloud-private-relay/

afavour 2y ago

Congratulations on trusting your ISP, you are in the minority.

yupyupyups 2y ago
I wouldn't say that I trust my ISP. I'm saying that to me, they are more trustworthy than Apple.
- afavour 2y ago
  Pretty sure my statement still applies there too!
- lostlogin 2y ago
  You must have a good ISP. I’ve got one too, it’s taken me 25 years to find. https://voyager.nz/ https://voyager.nz/
  - yupyupyups 2y ago
    They're pretty okay actually, they are not trigger happy when dealing with copyright infringment claims. And no NAT!
    - lostlogin 2y ago
      Static IP is cheap. They don’t go above a gigabit, but other than that it all good. And do I really need more bandwidth?
- jbverschoor 2y ago
  Really… in Europe, all ISPs and phone companies were required to keep a log of traffic and location (for example email addresses source/dest up). This was until 2015 but I’m sure some still do
  - yupyupyups 2y ago
    My ISP is required to save logs as far as I'm aware, and I think that's bad, don't get me wrong. I still trust Apple and Cloudflare less, because I believe that data in their hands is more likely to end up being used in an adverserial manner. This is my opinion.

kylehotchkiss 2y ago

This is one of iCloud's best features. I'm almost always protected by something like a VPN but that Cloudflare has been programmed to trust so I don't see recaptchas all day. AT&T just helpfully leaked their call records database which serves as a data point against trusting ISP more than Apple & Cloudflare. If anything, I want Private Relay running for every application on my phone

lapcat 2y ago

Has anyone actually seen this feature in action? Looking at packet traces, I can't seem to get it to work. I'm still seeing DNS queries and HTTP in the clear. (I don't use iCloud Private Relay.)