6 ms·

iCloud Private Relay uses one hop through Apple infrastructure, and one hop through third-party infrastructure. So, one node is managed by Apple and the other i

iCloud Private Relay uses one hop through Apple infrastructure, and one hop through third-party infrastructure. So, one node is managed by Apple and the other is managed by Cloudflare/Akamai/Fastly. The Apple node knows where the request comes from but not the contents, while the CF/Akamai/Fastly node knows the contents but not the source.

yupyupyups 2y ago
This works as long as there is no one combining the information together, like Apple together with Cloudflare, or the US government. This is a concern, since both are under the same jurestiction and are bussiness partners. Contrast this model with Tor where you have 3 hops that are selected in such a way that there is a lower probability that logs from the node operators will be combined. If two nodes, let's say node 1 and 3 are coorporating, then the best that they can do is a correlation attack or other probabalistic methods. If two nodes (all of them) in WebKit are adverserial, then the content is linked back to your IP address with 100% probability.
- Arnavion 2y ago
  To be clear, the only advantage of Tor wrt correlation is that it uses more hops, not anything related to how those hops are selected, right?
  - fragmede 2y ago
    How paranoid are you? If I were the US government and wanted a leg up on Internet meta data of people looking to avoid surveillance, I'd run a shitton of Tor exit nodes and log IP information on the off chance something useful comes of it.
    - bangaladore 2y ago
      Afaik, all that gives you is the person running the exit node (and where the request is going) and nothing about the person who initiated the request N-hops ago.
      - radicaldreamer 2y ago
        A large set of exit and relay nodes are being run out of Germany, presumably by some state actor, so it's likely at least a subset of traffic is being unmasked by a state actor. I'm sure some of this info has been passed on and then parallel construction used to obfuscate the initial source of the data.
    - devmor 2y ago
      Isn’t that exactly what they do?
  - chatmasta 2y ago
    Tor and Private Relay are both vulnerable to traffic analysis by a global adversary, which is what OP is complaining about here (if Apple and Cloudflare collude or are compelled to share data). Basically, if you can see the traffic going in/out of all the nodes (even just the amount of it), then you can deanonymize individual streams of data. Tor explicitly does not defend against this threat.
    - Arnavion 2y ago
      Yes I know. My point was that yupyupyups said: >Contrast this model with Tor where you have 3 hops that are selected in such a way that there is a lower probability that logs from the node operators will be combined "selected in such a way" sounded like there is something in Tor that actively works against a situation where the hops are owned by the same operator, but AFAIK there isn't such a thing. Hence my request for confirmation that the only thing Tor does better than the Apple+Cloudflare situation here is that it has more than two hops so that it increases the number of colluders needed for correlation.
      - chatmasta 2y ago
        Yeah, all true. In fact Tor explicitly forgoes any mitigation against a global passive adversary - it’s designed to accept that risk. Another thing Tor does better is that it creates circuits with nodes spanning multiple jurisdictions, whereas Private Relay circuits are confined to one jurisdiction (and worse, to your current one). > actively works against a situation where the hops are owned by the same operator, but AFAIK there isn't such a thing Right, there is nothing Tor can do to guarantee this, but it does take some best-effort measures like maximizing diversity of AS providers (you won’t get a circuit of three nodes with the same AS number). Of course this is meaningless in a world where anyone can purchase servers from anywhere. There is a lot of research on this attack vector against Tor (and p2p networks in general) - the relevant search term is “Sybil resistance.” Btw - just to add some detail to the discussion, this blog post from Cloudflare is a good introduction to Private Relay: https://blog.cloudflare.com/icloud-private-relay https://blog.cloudflare.com/icloud-private-relay
- radicaldreamer 2y ago
  How is this less secure than just using your ISP with no hops though? How do you evaluate "trust" in this situation? What if your ISP is working with the local cops or US government directly?
  - kvdveer 2y ago
    You are assuming a US ISP. That's only true for a minority of internet users. Trusting local parties of US parties is not a strange thought, especially since I can influence their supervision with my vote. Also, it seems plausible that the US is headed into dictatorship or civil war in the near future. Nether scenario helps me trust the US jurisdiction.
    - radicaldreamer 2y ago
      If you’re outside the US, I’d be even more concerned about the US completely compromising your networks. It’s well known the NSA is tapping backbones, DNS, and exchanges around the world
- Asooka 2y ago
  > This works as long as there is no one combining the information together, like Apple together with Cloudflare, or the US government. If that is your threat model, you need something a lot stronger than Private Browsing, whose purpose begins and ends with "I do not want other people to know what porn sites I visit". Tor is a good start.
  - chatmasta 2y ago
    Tor is vulnerable to the same threat of a global passive observer. But at least you can mitigate against it by ensuring the nodes are in separate jurisdictions.
  - Aachen 2y ago
    > If that is your threat model, you need something a lot stronger than Private Browsing You mean like an ISP that isn't in (and doesn't unnecessarily route through) the USA?
- yupyupyups 2y ago
  @radicaldreamer, I don't live in the US, same goes with a large number of Apple's customers. A user's residential IP address is in many cases almost static, and doesn't change that often. If you use the same residential IP for other services from Apple, or sites that are protected by Cloudflare's MITM DDOS protection, the content of the HTTP site can be linked back to you with a high probability through your IP address, and possibly in combination with other metadata such as the user-agent, or other headers.
  - avianlyric 2y ago
    So how exactly is using unencrypted HTTP better? Which was your original claim.
    - yupyupyups 2y ago
      The probability that a user's identity would be linked up with browsing HTTP sites and an attempt to use that in an adverserial manner is higher when it's Apple than when using my ISP. Of course, you may think differently regarding your ISP, but that's for each one of us to decide about our own service providers.
      - radicaldreamer 2y ago
        I don't understand, why is using 10 sites with a cloudflare layer linking directly to your static home IP less likely to identify you across those sites than a double hop via apple's servers where the sites (and cloudflare) don't know which sites are being visited by which end user static ip?
        yupyupyups 2y ago
        Browsing an HTTP site that would otherwise have nothing to do with Cloudflare could end up becoming associated with you. That can happen if the data that CF has is matched with the data at Apple, either by Apple and CF themselves or the US government. The sites that already are MITM'd by Cloudflare are a different story. Cloudflare is going to know what IP address visited them at what time, and if you login with your personal email address, or if your personal phone number is shown in your account settings, then your identity is linked with some probability to that IP address+time. If you then browse a non-CF HTTP site, using Apple's proposed proxy, there would be the risk that your identity+IP address that CF knows become associated with using the HTTP site as well. If you don't use Apple's proxy at all, you connecting to a non-CF HTTP site would only be known by your ISP.
- deleted 2y ago
  [deleted]

yupyupyups 2y ago

This works as long as there is no one combining the information together, like Apple together with Cloudflare, or the US government. This is a concern, since both are under the same jurestiction and are bussiness partners. Contrast this model with Tor where you have 3 hops that are selected in such a way that there is a lower probability that logs from the node operators will be combined. If two nodes, let's say node 1 and 3 are coorporating, then the best that they can do is a correlation attack or other probabalistic methods. If two nodes (all of them) in WebKit are adverserial, then the content is linked back to your IP address with 100% probability.

Arnavion 2y ago
To be clear, the only advantage of Tor wrt correlation is that it uses more hops, not anything related to how those hops are selected, right?
- fragmede 2y ago
  How paranoid are you? If I were the US government and wanted a leg up on Internet meta data of people looking to avoid surveillance, I'd run a shitton of Tor exit nodes and log IP information on the off chance something useful comes of it.
  - bangaladore 2y ago
    Afaik, all that gives you is the person running the exit node (and where the request is going) and nothing about the person who initiated the request N-hops ago.
    - radicaldreamer 2y ago
      A large set of exit and relay nodes are being run out of Germany, presumably by some state actor, so it's likely at least a subset of traffic is being unmasked by a state actor. I'm sure some of this info has been passed on and then parallel construction used to obfuscate the initial source of the data.
  - devmor 2y ago
    Isn’t that exactly what they do?
- chatmasta 2y ago
  Tor and Private Relay are both vulnerable to traffic analysis by a global adversary, which is what OP is complaining about here (if Apple and Cloudflare collude or are compelled to share data). Basically, if you can see the traffic going in/out of all the nodes (even just the amount of it), then you can deanonymize individual streams of data. Tor explicitly does not defend against this threat.
  - Arnavion 2y ago
    Yes I know. My point was that yupyupyups said: >Contrast this model with Tor where you have 3 hops that are selected in such a way that there is a lower probability that logs from the node operators will be combined "selected in such a way" sounded like there is something in Tor that actively works against a situation where the hops are owned by the same operator, but AFAIK there isn't such a thing. Hence my request for confirmation that the only thing Tor does better than the Apple+Cloudflare situation here is that it has more than two hops so that it increases the number of colluders needed for correlation.
    - chatmasta 2y ago
      Yeah, all true. In fact Tor explicitly forgoes any mitigation against a global passive adversary - it’s designed to accept that risk. Another thing Tor does better is that it creates circuits with nodes spanning multiple jurisdictions, whereas Private Relay circuits are confined to one jurisdiction (and worse, to your current one). > actively works against a situation where the hops are owned by the same operator, but AFAIK there isn't such a thing Right, there is nothing Tor can do to guarantee this, but it does take some best-effort measures like maximizing diversity of AS providers (you won’t get a circuit of three nodes with the same AS number). Of course this is meaningless in a world where anyone can purchase servers from anywhere. There is a lot of research on this attack vector against Tor (and p2p networks in general) - the relevant search term is “Sybil resistance.” Btw - just to add some detail to the discussion, this blog post from Cloudflare is a good introduction to Private Relay: https://blog.cloudflare.com/icloud-private-relay https://blog.cloudflare.com/icloud-private-relay
radicaldreamer 2y ago
How is this less secure than just using your ISP with no hops though? How do you evaluate "trust" in this situation? What if your ISP is working with the local cops or US government directly?
- kvdveer 2y ago
  You are assuming a US ISP. That's only true for a minority of internet users. Trusting local parties of US parties is not a strange thought, especially since I can influence their supervision with my vote. Also, it seems plausible that the US is headed into dictatorship or civil war in the near future. Nether scenario helps me trust the US jurisdiction.
  - radicaldreamer 2y ago
    If you’re outside the US, I’d be even more concerned about the US completely compromising your networks. It’s well known the NSA is tapping backbones, DNS, and exchanges around the world
Asooka 2y ago
> This works as long as there is no one combining the information together, like Apple together with Cloudflare, or the US government. If that is your threat model, you need something a lot stronger than Private Browsing, whose purpose begins and ends with "I do not want other people to know what porn sites I visit". Tor is a good start.
- chatmasta 2y ago
  Tor is vulnerable to the same threat of a global passive observer. But at least you can mitigate against it by ensuring the nodes are in separate jurisdictions.
- Aachen 2y ago
  > If that is your threat model, you need something a lot stronger than Private Browsing You mean like an ISP that isn't in (and doesn't unnecessarily route through) the USA?
yupyupyups 2y ago
@radicaldreamer, I don't live in the US, same goes with a large number of Apple's customers. A user's residential IP address is in many cases almost static, and doesn't change that often. If you use the same residential IP for other services from Apple, or sites that are protected by Cloudflare's MITM DDOS protection, the content of the HTTP site can be linked back to you with a high probability through your IP address, and possibly in combination with other metadata such as the user-agent, or other headers.
- avianlyric 2y ago
  So how exactly is using unencrypted HTTP better? Which was your original claim.
  - yupyupyups 2y ago
    The probability that a user's identity would be linked up with browsing HTTP sites and an attempt to use that in an adverserial manner is higher when it's Apple than when using my ISP. Of course, you may think differently regarding your ISP, but that's for each one of us to decide about our own service providers.
    - radicaldreamer 2y ago
      I don't understand, why is using 10 sites with a cloudflare layer linking directly to your static home IP less likely to identify you across those sites than a double hop via apple's servers where the sites (and cloudflare) don't know which sites are being visited by which end user static ip?
      - yupyupyups 2y ago
        Browsing an HTTP site that would otherwise have nothing to do with Cloudflare could end up becoming associated with you. That can happen if the data that CF has is matched with the data at Apple, either by Apple and CF themselves or the US government. The sites that already are MITM'd by Cloudflare are a different story. Cloudflare is going to know what IP address visited them at what time, and if you login with your personal email address, or if your personal phone number is shown in your account settings, then your identity is linked with some probability to that IP address+time. If you then browse a non-CF HTTP site, using Apple's proposed proxy, there would be the risk that your identity+IP address that CF knows become associated with using the HTTP site as well. If you don't use Apple's proxy at all, you connecting to a non-CF HTTP site would only be known by your ISP.
deleted 2y ago
[deleted]