[HN Gopher] About iCloud Private Relay
___________________________________________________________________
About iCloud Private Relay
Author : andrewstuart
Score : 109 points
Date : 2022-05-15 11:56 UTC (11 hours ago)
(HTM) web link (support.apple.com)
(TXT) w3m dump (support.apple.com)
| FunnyBadger wrote:
| It doesn't work with VPN apparently (that's what it told me when
| I tried). That's not going to cut it for me. There are other ways
| that don't have that restriction.
| Bluecobra wrote:
| One thing that is pretty cool is that it will proxy a IPv4
| connection to IPv6. I was surprised to see a IPv6 address when I
| searched for "what is my ip" in Google.
| aborsy wrote:
| Good feature, although a bit slow for me in a major metro.
| rollcat wrote:
| Beware of using private relay with Apple Mail (at least on
| macOS). You currently can't both use private relay AND disable
| automatic remote content loading, so looking at a spam message
| will immediately load all pictures, and you will be spammed to
| oblivion. The spammer won't know your IP but that's little
| comfort, you're now a top spot on their list.
| iancarroll wrote:
| At least on iOS, Mail Privacy Protection is designed to load
| all resources immediately upon receiving the email, not when
| viewing it.
|
| Maybe this still indicates the email is valid to a spammer, but
| it wouldn't show that you opened it (unlike i.e. Gmail's image
| proxy, which only loads upon viewing.)
|
| https://www.litmus.com/blog/apple-mail-privacy-protection-fo...
| g_p wrote:
| You should be able to do this (although not immediately
| obvious) by:
|
| - Opening Mail, Preferences, and going to the Privacy tab. -
| Unchecking "protect mail activity" - Checking "hide IP address"
| - Checking "block all remote content"
|
| Now you have automatic remote content loading disabled, and
| have private relay enabled. You would need to test this with a
| "friendly" bit of remote content to be certain, but it seems to
| work.
|
| When doing this, also ensure you have limit IP tracking enabled
| on your ethernet or wifi network, as that appears to override
| this setting (based on the help content which is available in
| this tab).
| SheinhardtWigCo wrote:
| Two interesting side effects, if I understand correctly:
|
| 1. Dramatically reduces the number of entities the government
| needs to "partner" with (via NSLs and/or TAO) for the firehose of
| domains visited by Apple users.
|
| 2. Apple gets a time series of Safari network traffic for each
| user
|
| I wonder how many popular domains could be unmasked by an ISP
| that is supposedly blind to the destination of each packet but
| can of course still see fine-grained traffic patterns for each
| user.
| marricks wrote:
| It's important to note you actually have a choice to use Apple
| products or not, or even use this relay or another. In many
| places in the US you have barely any choices for your ISP which
| could be tracking you and selling your data.
|
| This is great in that it gives everyday folks a stupid-simple
| protection from ISP and mobile service providers.
|
| And yes, of course Apple did it as another reason to sell next
| tier iCloud service and gain good will of folks, which I think is
| a much better trade off then ISPs and Sprint/Verizon/etc knowing
| your full browser history.
| lelandfe wrote:
| Only works with Safari on macOS, which means I'll never use it
| there. And I wound up turning it off on iOS because it made my
| life more annoying - go into the subway and try to connect to the
| free MTA WiFi? Alert! Your browsing is unprotected.
|
| ...plus I found I would sporadically get connection issues that I
| resolved by turning it off.
|
| It's a bummer because I would like to use it, and it being
| bundled with iCloud is nice.
| dijit wrote:
| > go into the subway and try to connect to the free MTA WiFi?
| Alert! Your browsing is unprotected.
|
| I haven't used it myself, but it seems reasonable to inform
| laymen that browsing to a captive portal system will be
| unprotected. I'm not sure how eggregious the error actually is.
|
| > ...plus I found I would sporadically get connection issues
| that I resolved by turning it off.
|
| Not defending Apple in particular, but connectivity will
| decrease with every extra hop you make in your connection;
| you'll notice this when browsing the internet with tor (or,
| heaven forbid trying to use IRC over tor).
|
| it makes sense that you would have more connectivity issues
| when using _any_ kind of proxy; and it would get worse with
| every extra layer of proxy.
| lelandfe wrote:
| Not sure what "connectivity will decrease" means in practice,
| but I'd see problems like pages refusing to load over
| multiple refreshes, texts not sending, or iCloud data
| (messages, photos, etc) simply not updating until I switched
| the service off.
|
| I'm not as convinced as you that these problems are inherent
| to the service, and I'm holding out hope for what Private
| Relay looks like when it emerges from beta.
|
| > I'm not sure how eggregious the error actually is
|
| Not egregious - annoying. Unusual for Apple. I don't want to
| use a service that spits alerts at me as I walk around the
| city.
| ec109685 wrote:
| The connection issues don't happen anymore. It was annoying
| before where things would just hang and then turning off and on
| would fix it. I haven't seen that in months, so they must have
| fixed the issue.
| lelandfe wrote:
| Nice! I'll give it another shot.
| currysausage wrote:
| No Google suggestions for me in iOS Safari when using Private
| Relay.
| SalimoS wrote:
| I don't have a Facebook account but sometimes I got an fb link
| for a public meme or a video and for the past month it's been
| 50/50 (seeing the resource or getting blocked by Ip)
| HomeGear wrote:
| It's fully blocked from commenting on 4chan too.
| [deleted]
| maxpert wrote:
| I love it! Using this I've seen FB/Google having less and less
| information about my exact location. Seeing less relevant ads is
| assuring and relieving! The only wish I have is a more fluent way
| to enable/disable this and having an app for other platforms.
| kyrra wrote:
| Google Fi also has a VPN solution if you use them. Some ads are
| definitely as if I'm in another state. The weird one is
| shopping sites (like Home Depot) try to guess my closest store
| and they are always wildly off. It's sorta funny.
| jvolkman wrote:
| Also Google One, which doesn't require using Fi.
|
| https://one.google.com/about/vpn
| lotsofpulp wrote:
| The weirder thing is that even after I login, Home Depot (and
| Best Buy and Staples) show me the wrong preferred store. I
| already saved what store I want, plus I have my home address
| saved (and it is the only address), yet they cannot remember
| or figure out my preferred store. And they have my purchase
| history for where I have already purchased things a million
| times, in recent history.
|
| What is all this data good for?
| Nextgrid wrote:
| One explanation is that the ads/marketing is managed by a
| completely different "silo" in the business than the
| website itself. It may even be outsourced to a separate
| company.
|
| When it comes to ads/marketing, it is good enough to make
| others _believe_ they are driving sales /conversions -
| whether it actually does is irrelevant as long as everyone
| believes it does and keeps pouring money into it.
| dcow wrote:
| God this is so annoying. I had chalked it up to bad big-box
| software engineering software but now I realize it's
| private relay. Hmm...
| can16358p wrote:
| It used to work great last year, then all of a sudden it stopped
| working due to "regional laws", killing the whole purpose of it.
|
| I don't get it as VPNs or proxies aren't illegal where I live,
| how is Apple's private relay not available?
| wonderbore wrote:
| Probably whoever is responsible for it doesn't really want to
| put up a fight. VPNs are always kind of in a gray area which
| many small companies could deal with (or say f it) but Apple
| can't or doesn't find it to be worth the fight.
|
| VPS are a digital product while Apple has physical stores or
| resellers of physical products in these countries. It's not as
| easy.
| tempfs wrote:
| Just remember that now instead of your ISP knowing every site you
| visit, Apple now will.
|
| So where as in the olden days, in order to figure out who you
| were, some actor had to buy logs from the destination sites and
| from the ISPs, then correlate.
|
| Now they can just buy the information from Apple. How convenient
| for Apple.
|
| I know Apple says they will only share your information with
| trusted partners and only with your consent which is implicit
| when you use private relay. No one ever asks who these partners
| are though. Probably the same people that used to buy your data
| from the destination sites and ISPs...
| jtsiskin wrote:
| ...did you read the article?
| tempfs wrote:
| Have you read Apple's privacy policy?
| dagmx wrote:
| The article specifically mentions that the Apple relay wouldn't
| see the DNS, whereas the second relay doesn't see your IP.
|
| Secondly, Apple makes the OS. If they wanted to spy on you,
| they could have done so in much easier ways already.
| gr2020 wrote:
| This is the point - Apple doesn't have that information either.
| From the article, in the "How Private Relay works" section:
|
| > when you browse the web in Safari, no single party -- not
| even Apple -- can see both who you are and what sites you're
| visiting.
| baby-yoda wrote:
| agree - apple says they're doing this for "privacy" but there
| is no way to verify they are not tracking/storing this data
| themselves. in todays world its simply too valuable and apples
| tentacles are far too reaching for the data to be thrown out.
| in fact, there are reports of an increased advertising push
| already [0].
|
| id wager there is an internal team analyzing this data for
| predictive trends across all their product lines, akin to
| facebook using onavo data to target and value whatsapp relative
| to messenger.
|
| it could be used to guide which new streaming series candidate
| gets more funding/marketing, popular colors for new iPhones,
| price elasticity across the range, etc.
|
| and of course the surveillance aspect always looms in the
| background.
|
| [0] - https://www.macrumors.com/2022/05/09/apple-services-push-
| str...
| zwily wrote:
| There was no way to verify before that Apple wasn't tracking
| you either. Whether or not you trust Apple should have
| nothing to do with Private Relay.
| clarity wrote:
| you're missing the whole point of private relay
| 88840-8855 wrote:
| I am blocking ads via my router DNS. When using Private Relay I
| see the ads again, which is makes using apps very annoying.
|
| Plus, I dont see any benefit of hiding my network traffic here in
| Germany, tbh.
| jedisct1 wrote:
| dnscrypt-proxy works fine with Private Relay.
| bowsamic wrote:
| One reason that might not affect you is that piracy is heavily
| prosecuted in Germany
| Nextgrid wrote:
| This is limited to Safari though, so completely useless for
| piracy.
| bowsamic wrote:
| No, a lot of online streaming sites started using
| BitTorrent in the background to stream the video, and a lot
| of people got fined in Germany because of this
| 88840-8855 wrote:
| can you kindly share the source?
| bowsamic wrote:
| No? A lot of anime sites. Google it
| jeroenhd wrote:
| The DNS issue is intentional. Trackers have collected
| information about people using VPNs before by generating unique
| domain lookups for a visit and watching where the DNS query
| originates from.
|
| Theoretically, editing your hosts file might provide the same
| filters even with Apple's pseudo-TOR enabled if the system
| respects user preferences. That might be a challenge on iOS,
| though.
| atVelocet wrote:
| I recommend using something like _NextDNS_ , _DNSCloak_ or
| _Blockada_ : - Local VPN Apps like _Lockdown_ can block DoT but
| not DoH - Manual DNS settings don 't block DoH or DoT. AFAIK
| you need an app with specific entitlements? Maybe someone can
| clarify this? - Private Relay works as expected
|
| I am using _NextDNS_ on all iOS devices and it works great. Get
| yourself an account and configure it to your needs. Don 't
| forget to enable the block site instead of 0.0.0.0., then
| download their CA and trust it.
| midislack wrote:
| Various sites are punishing me for using this. Amazon and eBay
| both seem to massively dislike it and demand I click an email
| link.
| nceqs3 wrote:
| Private Relay is a fantastic feature, definitely one of the
| better ones Apple has rolled out over the past couple years.
| baby-yoda wrote:
| is it possible to DIY something like this, and is it worth the
| hassle?
|
| my thought was 2 VPS and use Wireguard multihop. VPS 0 connected
| from my home router, VPS 1 connected to VPS 0 via private
| networking (ideally in a different geo location). recycle VPS 1
| IP/location periodically.
|
| VPN from mobile to home router and get the benefits on the go,
| with dnsmasq blocking ad hosts in VPS 1 so tracking crap ideally
| doesn't make it over the wire. thoughts?
| gruez wrote:
| But with your setup, the 2 VPS are still traceable to you (ie.
| via payment information). You can go through some extra effort
| to avoid this (eg. buying the VPS over tor and paying using
| crypto), but I'm guessing you're not currently doing this.
| Moreover, the 2 VPS are still carrying only your traffic, which
| makes logging/correlation attacks easier. With apple's
| solution, your traffic is mixed with others, and the second hop
| has no idea who you are.
| DerekBickerton wrote:
| I have a VPN travel router with a Mullvad .OVPN profile added.
| This 'VPN-ifies' all my traffic. Then I have a VPN app I use on
| my device from another VPN provider (ProtonVPN). This is
| chaining two distinct VPN providers on top of each other, a
| form of onion routing. Does it make me 'more' private? Hardly,
| but it's a good first step.
| Yeri wrote:
| iCloud private relay currently has at least 2 providers
| (Cloudflare and Akamai); there may be more in other regions.
|
| Cloudflare has a good blog post about this:
| https://blog.cloudflare.com/icloud-private-relay/
| barathr wrote:
| Fastly as well -- Fastly, Cloudflare, and Akamai are the three
| egress providers.
| plg wrote:
| It may not work perfectly for all people in all use cases, yet
| ... but I have to say I appreciate and admire Apple's initiative
| and the values that this approach reflects. They didn't have to
| do this. It's not obvious that it immediately helps their bottom
| line. It does seem like the right thing to do for individual
| privacy. I appreciate that and it contributes to my overall
| respect for the company and its approach.
| mindslight wrote:
| I'm not a huge Apple fan, but I totally agree. Private Relay
| has its faults, but it seems poised to push back against
| commercial mass surveillance, in a way that niche usage of VPNs
| simply cannot dent. Now website operators have to ask
| themselves "Do I really want to hassle normies using iPhones
| with CAPTCHAs?". Traditionally, VPN/TOR users just bear that
| bullshit and pray websites do not alter the deal any further.
| But the mass market won't stand for that.
|
| Long term we've yet to see what the evolution will end up being
| (Apple could publish a list of their exit nodes for websites to
| whitelist, causing Mullvad et al to be left out in the cold),
| but for now I'm cautiously optimistic.
| dixie_land wrote:
| > poised to push back against commercial mass surveillance
|
| By consolidating all surveillance to Apple?
| mindslight wrote:
| For one, consolidation into just Apple is better than both
| websites and ISPs getting the surveillance data. People can
| also voluntarily choose to use Private Relay, whereas they
| can't generally make that choice for their last mile ISP
| (oligopoly) nor for the common surveillance systems that
| are used across websites (eg CAPTCHAs).
|
| For two, by hopefully making usage of VPNs more palatable
| to sites that are currently harassing what they perceive as
| the small segment of VPN users with blocks and CAPTCHAs.
|
| I admit that #2 is hopeful, and that we might just end up
| with those sites whitelisting Apple while continuing to
| hassle everyone else that wants to hide their IP. But I'd
| prefer to hope for now.
|
| Obviously the real long term answer is the development and
| adoption of secure protocols instead of centrally-named and
| centrally-served HTTPS/DNS, but that's orthogonal.
| donmcronald wrote:
| It really sucks when someone thinks they may have been
| phished an you need to review login logs to assess things.
| VPNs suck too, but it's easy to tell people not to use them
| for business connections. Something from Apple will be
| marketed as being amazing even if it's a net negative for
| some users.
| dwaite wrote:
| The exit nodes are published, mostly to get incorporated into
| geo-ip tables.
| latexr wrote:
| > It's not obvious that it immediately helps their bottom line.
|
| Your comment ends with:
|
| > I appreciate that and it contributes to my overall respect
| for the company and its approach.
|
| Seems like a straightforward connection: Apple provides the
| feature - your trust in them increases[1] - you continue to buy
| from them and recommend them to other people.
|
| [1]: Especially relevant at a time where distrust of big tech
| companies is rising.
| s3p wrote:
| This. I don't think people understand that some Apple
| initiatives are driven by their values and a desire to do
| something good for the user. Also, this is part of a paid
| iCloud plan anyway, so it encourages people to pay for
| iCloud.
| ricw wrote:
| It does have an immediate positive effect. People will likely
| switch to apple and trust it more. This means more service
| revenue, long term lock in and ultimately more profits.
|
| Im moving my to-be-paid-for personal google apps accounts over
| to iCloud for one.
|
| It's not just a principled approach. Though it just makes
| sense. Thank god apple has minimal ad income only. Otherwise
| this wouldn't happen.
| bowsamic wrote:
| The ad thing is why I stick with apple. I just feel much more
| comfortable paying for software and hardware that isn't ad
| supported. I feel like I'm buying a product rather than being
| the product
| lapcat wrote:
| But Apple is ad supported:
| https://www.businessinsider.com/apple-shaking-up-services-
| bu...
| lelandfe wrote:
| Yeah, this direction worries me. I'm pretty fine with the
| search ads, but the moment they start trying to break
| into broader scopes it's going to be really hard for me
| to square it with a supposed reputation for privacy.
| lapcat wrote:
| > I'm pretty fine with the search ads
|
| Why? The cover story for App Store is that it's supposed
| to protect consumers, but then the consumer searches for
| an app literally by name, and the first hit is a
| completely different app that paid for an ad. How is that
| protecting consumers?
|
| Moreover, Apple added App Tracking Transparency, where
| the cover story is privacy, but coincidentally ATT has at
| the same time caused people to switch more to Search Ads,
| because third party ads have become less effective as a
| result. There's a conflict of interest here.
| lelandfe wrote:
| > How is that protecting consumers?
|
| Meh. I think the paid results are pretty well demarcated,
| and are, visually, nearly identical to what they looked
| like at launch in 2016.
|
| Competitors bidding on keywords is definitely lame.
| bowsamic wrote:
| Nowhere near to the degree of almost any other tech
| company I can think of
| lapcat wrote:
| True, but it's depressing that Apple has decided to go
| down that path. They've gone from $0 ad revenue to
| $billions and are obviously intent on increasing that
| revenue even more.
| bowsamic wrote:
| As long as there aren't ads in my standard OS features,
| unlike Windows, I'm very grateful
| lapcat wrote:
| There are ads for Apple subscriptions in the Settings
| app. I've seen them myself.
| bowsamic wrote:
| It's not interfering with my experience yet
| ignoramous wrote:
| Despite their take on privacy, I'd not be surprised if Apple
| also purchased a tonne of user data from brokers, however.
|
| At the end of the day, they are a very successful business that
| serves its own bottom line. The privacy angle for the mobile
| and browser ecosystem, in my eyes, is nothing but market
| positioning (as more or less anti-Android and anti-Chrome) even
| if they are engineering novel solutions such as the Private
| Relay.
|
| If they really cared, they wouldn't be in bed with Google for
| their search deal, for example:
| https://www.nytimes.com/2020/10/25/technology/apple-google-s...
| bradgessler wrote:
| I too laud Apple for their efforts, but I view them as a
| benevolent dictator.
|
| To me it's obvious how this helps their bottom line: people are
| very interested in privacy and willing to pay top dollar for
| it. Every time I turn on an additional privacy service from
| Apple, I feel their grip tightening on my digital identity as
| they push themselves even more between me and the direct
| relationships I have with other websites.
|
| iCloud private relay, email aliases, and "Sign in with Apple"
| is their final act to completely dominate the relationship
| between their users and other web applications.
|
| I'm not bitter about it, but I do think it's helpful and
| healthier to view Apple in this way and not mistake their
| efforts as altruistic. They're simply a company trying to
| develop a profitable, high retention service... and they're
| doing a damn good job at it.
| sunshinerag wrote:
| Glad that it is not altruistic. Much more better served with
| other incentives
| GekkePrutser wrote:
| The lock-in makes it impossible for me to use most of their
| services though. I need to access all my stuff on Mac but
| also on Windows and Linux.
|
| I wish there was a good privacy-embracing cloud platform that
| I could just pay for directly instead of via buying hardware
| as Apple does.
|
| iCloud private relay is a great idea but I need it on all my
| computers and phones. I use Firefox now but their VPN option
| doesn't hold a candle to what Apple offers with icloud relay.
| It's really a different thing altogether.
| godelski wrote:
| What's even worse is that a lot of their privacy and security
| features are designed to interact within the walled garden
| instead of purely security and privacy by default. Talk to
| another Apple user? Everything fine. Talk to an Android user,
| no more privacy and security. And good luck sending a video
| that doesn't look like it was filmed with a literal potato.
| nojito wrote:
| Why is it apple's responsibility to worry about Android?
| cmroanirgo wrote:
| Because a lot of their mac users have android phones.
|
| Same argument for windows...a lot of iOS users run
| windows.
| lapcat wrote:
| > It's not obvious that it immediately helps their bottom line.
|
| Besides requiring a paid iCloud+ subscription?
| KennyBlanken wrote:
| ...which did not have this feature beforehand (nor the email
| anonymization) and did not increase in price from a dollar a
| month.
|
| That's what iCloud 50GB cost in 2015, and they introduced
| these new features in 2021.
|
| Likely possible due to falling capex/opex costs for the
| storage, but still...they added multiple new features and
| didn't increase the price, even after a fairly substantial
| amount of inflation over those five to six years.
| lapcat wrote:
| I'm not sure what the argument is supposed to be here.
| Apple adds features to its hardware without raising the
| price. As a software developer, I add features to my
| software without raising the price. The point is to make
| the product more enticing so that more potential customers
| will buy it.
|
| If Apple wasn't trying to sell iCloud+ then it would have
| made iCloud Private Relay available to all Apple users
| without iCloud+.
|
| Apple is not a charity. This is sales 101.
| fartcannon wrote:
| They're the _least_ charitable, I'd say. Apples marketing
| is trying to push generous, kind, etc because it shifts
| the overton window about the companies main objective
| which from the outside appears to be make computers into
| appliances that you replace every year.
|
| Which would be fine if there marketing wasn't so
| effective. As it stands, they're an existential risk to
| the freedom we all currently enjoy in computing. And the
| environmental impact of pure disposable consumption
| devices is the kind of thing journalists will be talking
| about in 30 years - like oil and gas.
|
| And like oil and gas, they're very powerful and have
| great marketing.
| otterley wrote:
| Hundreds of thousands of developers use Macs every day to
| produce both content and software. And the Internet is
| still open to you (in most countries, at least) to add
| your own service or website.
|
| Also, technology has advanced so much in the past 15
| years that people are replacing their Apple devices
| significantly less frequently than they used to.
| lapcat wrote:
| > Also, technology has advanced so much in the past 15
| years that people are replacing their Apple devices
| significantly less frequently than they used to.
|
| Not sure about that. We have annual OS updates with force
| obsolescence via termination of device support and
| security updates. (Even the "supported" N-2 versions of
| macOS don't get all the security updates of the latest
| version.)
|
| And the devices now all have batteries that aren't user-
| replaceable.
|
| With the 2 year phone carrier contracts, the financial
| incentive was actually to upgrade your phone every 2
| years. Those are mostly gone now, but it's rumored that
| Apple is working on a new hardware subscription.
| otterley wrote:
| The termination of device support tends to be for devices
| that are 7+ years old. That's quite a reasonable support
| lifetime. A lot of commercial software support has a
| similar or shorter term.
|
| Also, as of today, battery replacements for all supported
| iPhone devices costs less than $70. That's a very good
| price and basically includes the labor for free. Nobody
| is getting ripped off here.
|
| > Even the "supported" N-2 versions of macOS don't get
| all the security updates of the latest version.
|
| If it's supported, it's getting security updates, period.
| Here is an example of a recent security update for
| Catalina:
| https://support.apple.com/kb/DL2089?locale=en_US
| lapcat wrote:
| > The termination of device support tends to be for
| devices that are 7+ years old. That's quite a reasonable
| support lifetime.
|
| I disagree. My 2014 MacBook Pro still works perfectly
| fine, but it doesn't run Monterey, which I need for work
| purposes, so I had to buy a new MacBook Pro. I certainly
| didn't want to drop all that money right now.
|
| > Also, as of today, battery replacements for all
| supported iPhone devices costs less than $70. That's a
| very good price and basically includes the labor for
| free. Nobody is getting ripped off here.
|
| I've had to replace the battery twice out of warranty on
| my 2014 MacBook Pro, and it cost more than $70. Moreover,
| the pandemic has made getting repairs significantly more
| difficult. Who wants to ship their device off and be
| without it?
|
| > If it's supported, it's getting security updates,
| period. If you have contrary evidence, I'd like to see
| it.
|
| I said they don't get all the security updates; I didn't
| say they get no security updates.
|
| This differential in vulnerability patching is very well
| known among Mac security researchers. For example:
| https://www.intego.com/mac-security-blog/apples-poor-
| patchin... users-security-and-privacy-precarious/
| otterley wrote:
| > which I need for work purposes, so I had to buy a new
| MacBook Pro. I certainly didn't want to drop all that
| money right now.
|
| I can sympathize with being frugal. That said, if you're
| buying a laptop for work, I recommend both financing it
| and depreciating it on your taxes, if that's an option
| for you. It's a cost of doing business, and many tax
| codes treat computers as depreciable assets. In fact, in
| the U.S., the tax code has a 5-year depreciation schedule
| for computers - less than the support lifetime.
|
| As for the security updates question, if you have
| information that Catalina is lacking a critical security
| update, I'm sure Apple would like to know about it and
| fix it. They care a lot about this stuff. The article you
| posted complains about a lack of transparency as to the
| "why" certain patches aren't backported, but it doesn't
| declare that there are active security vulnerabilities in
| those versions, either.
| fartcannon wrote:
| Yep! Can even do some stuff with iOS too. But its not
| open so you can't do anything. Which is the promise of
| computers. Not to do what Apple deems OK, but whatever a
| childs mind (or any mind) can dream of. Its not OK to
| teach kids that they can't use the things they own how
| they see fit. It's teaching them to think inside a box of
| Apple, or Googles choosing. It is sort of disgusting.
| otterley wrote:
| What "anything" are you speaking of? If people couldn't
| do anything with their devices, they probably wouldn't
| buy them!
| fartcannon wrote:
| How about write software themselves on their devices and
| share it with their friends for starters? You know
| without paying a tithe to Apple. That'd go a long way.
| overtonwhy wrote:
| If you're reliant on their email services you're less likely to
| cancel iCloud or switch mobile platforms.
| petesergeant wrote:
| > It's not obvious that it immediately helps their bottom line
|
| In the UK phone operators have complained about it on the basis
| that:
|
| > [it allows Apple] to leverage its considerable market power
| into many areas of the market and thus being able to further
| entrench its position ... Network providers would no longer be
| able to use web traffic data over Safari to develop their own
| digital products and services that complete directly with
| Apple. For example, a network provider may no longer have
| access to information about a user's content viewing habits to
| develop their own content that competes with Apple TV.
| Similarly, a network provider may no longer be able to share
| consumer insight with third parties that provide digital
| advertizing services in competition with Apple Search Ads...
|
| How true that is, who knows, but it's an interesting angle on
| how it benefits Apple
| Spooky23 wrote:
| Boo hoo.
|
| So people who sell a service and engage in surveillance to
| extract money through some other means are upset because
| another company is selling a service that provides a
| documented feature that prevents said surveillance.
|
| Why wouldn't that argument apply to normal VPN? Wouldn't the
| mobile carrier be able to provide a spectrum of value-added
| services if they understood how my employees work? For
| example, if they were able to see that my accounts payable
| folks were recording information in SharePoint forms, they
| could offer a forms solution that was more efficient!
| kergonath wrote:
| The National Association of Foxes is really upset that a
| company dares selling (slightly more) secure henhouses.
| MarkMarine wrote:
| Good. Anything that gets complaints worded that way from
| companies that I am paying for a service that has nothing to
| do with watching my traffic and injecting ads into it without
| my permission sounds good to me.
| AlexandrB wrote:
| The entitlement of companies that make money on surveillance
| is staggering.
|
| There is no world where I want my ISP to have access to
| information about my content viewing habits. Why is this not
| an opt-in?
| CircleSpokes wrote:
| It's not clear to me what data they are talking about? They
| talk about things like Apple TV and users content viewing
| habits but what info does an ISP even have about that other
| that things like time, data usage, what IP they connect to,
| etc? The really valuable things like what kind of content the
| users are watching is encrypted by TLS.
|
| Seems like a really silly statement to me.
| jen20 wrote:
| > a network provider may no longer have access to information
| about a user's content viewing
|
| That's... kinda the point, no? To prevent scummy people doing
| scummy things.
| acomjean wrote:
| At the same time are basically putting your trust in one
| company (apple) in this case to not do scummy things. But
| as pointed out this can be a way of helping themselves hold
| and expand various market positions.. which may or may not
| be scummy too. And who knows where they'll be what they'll
| change in a few years when the need to increase profits.
|
| Im not supper trusting of any of these big companies. I
| don't love regulations but we seem to be headed to some
| weird monopolistic place.
| jen20 wrote:
| They build the operating system and the firmware, and
| design the CPUs. Maybe possibly protecting against some
| hypothetical future problem vs a real problem that exists
| today is not a good trade off.
| fnordpiglet wrote:
| Apple at least documents and gets a third party to audit
| and attest to the effectiveness of their controls. It's
| not perfect - I'm not convinced zero trust exists - but
| it's a lot better than the alternative which is nakedly
| disclosing unlimited use of private information for
| commercial purposes.
| lolinder wrote:
| If you're using an iPhone, you _already_ are trusting
| Apple to not do scummy things. If they wanted to, they
| could snoop all your traffic with or without Private
| Relay.
|
| What Private Relay _does_ appear to do is guarantee that
| no one _besides_ Apple can do scummy things. That 's a
| definite improvement.
| s3p wrote:
| Not buying this. There is now a default option for end-
| users to protect their privacy in ways they previously
| could not. Users who don't know the ins and outs of VPNs,
| people who aren't as well versed with technology as us.
| THAT is who this benefits the most. They went from having
| nothing to now potentially something.
|
| I also don't buy the whole "well your data might not be
| shared with X anymore but you're trusting Apple with it".
| What's the point? Anyone who uses literally any other
| major operating system is going to deal with the same
| thing. And the alternative? Android? Unless you want to
| switch to an indie fork of Android then the telemetry is
| much worse.
| dlivingston wrote:
| All that verbiage to effectively say: "we cannot track the
| user and monetize their data."
| darkerside wrote:
| It implies that Apple can and will use this data to inform
| its own products, which does seem anticompetitive. Whether
| that's true or not, I don't know.
| mojzu wrote:
| My understanding of the design of private relay is that
| Apple cannot see this data as it works with a third party
| relay (Cloudflare I think?) to blind themselves to it
|
| That complaint by the telcos is what convinced me to turn
| it on, the entire thing was a big whinge by them about
| not being able to spy on users anymore (and the hilarious
| claim that Apple was doing it to move users off Safari)
| sandworm101 wrote:
| They cannot see the data because they have chosen not to
| see it. That is different than being _unable_ to see it.
| As the creator of the software, Apple could disable to
| circumvent its own system to bypass these protections,
| perhaps in response to a legal obligation. A proper
| implementation, something like Tor, would be a designed
| to blind all network participants, including the evil
| ones.
| scoopertrooper wrote:
| That may be the case, but it misses the point. If Apple
| is not presently doing this, then they are not abusing
| their market position in gain an unfair advantage.
| Spooky23 wrote:
| Then the tor exit node people could read the traffic.
|
| Do what I do, i encode all emails into giant QR codes on
| paper that will fade in 72 hours. I then have a staffer
| chain a briefcase with the email to his or her wrist and
| fly to the recipient in a private jet. The one time pads
| are delivered by a separate courier.
| kortilla wrote:
| If you think the tor exit node looking at the traffic is
| equivalent, you missed the point of tor.
| Spooky23 wrote:
| We're talking about a company like Apple building a
| global infrastructure.
|
| Any such scenario would result in the company or their
| providers controlling a lot of the infrastructure.
|
| That's why private relay isn't a bad thing. You're
| replacing thousands of individual risks with one. IMO,
| the protection of Apple's PR is stronger than any tech.
| dwaite wrote:
| > As the creator of the software, Apple could disable to
| circumvent its own system to bypass these protections
|
| How is that new though? As the creator of Safari they
| could store tracking information locally and batch upload
| it for processing.
| monocularvision wrote:
| Apple makes the device and OS. They will always have the
| ability to see the data.
| fauigerzigerk wrote:
| _> They cannot see the data because they have chosen not
| to see it. That is different than being unable to see it_
|
| It's different in terms of security, but in terms of
| competition, which is what network providers complained
| about, there is no difference at all.
| tshaddox wrote:
| This is a pointless argument though, since Apple can
| deliver arbitrary over the air updates to iPhones anyway.
| There is nothing that iPhone hardware is physically
| capable of doing that Apple could not release a software
| update to do. Thus any evil you can conceive of is
| trivially within the slippery slope.
| afavour wrote:
| Another reason I wish Apple just stuck to hardware and
| software rather than expanding into stuff like Apple TV.
| Can't be anticompetitive if they're not in the market!
| warning26 wrote:
| Not exactly the same, but it wouldn't be the first time
| Apple did something like this. For example, Apple shows a
| scary "Do you consent to TRACKING" dialog for third party
| apps, but for their own tracking, presents a "is it okay
| if we use just a bit of your data to personalize your
| experience"?
| sandworm101 wrote:
| But Apple, as the device owner/operator, can do all sorts
| of tracking that cannot be accomplished by anyone else.
| They know when your phone is on or off. They know how
| often your battery runs flat. They know how bright your
| screen is. Apple surely uses this basic data in creating
| products. Telemetry isn't content tracking, but it is
| still tracking.
| sholladay wrote:
| When I set up macOS recently, telemetry was off by
| default; it was opt-in. Not sure about iOS, but I presume
| it is the same. So you are correct that device makers
| collecting telemetry have a certain advantage, but most
| app/content tracking systems I have interacted with are
| opt-out and therefor, in my view, are more invasive.
|
| The app tracking dialog on iOS is technically opt-in, but
| the way it is written reflects that the system and the
| user have limited control, the "Ask App Not to Track"
| button implies that Apple acknowledges that their
| attempts to block tracking are best effort and are not
| guaranteed to work, because new and clever ways to
| implement tracking are being created on a regular basis.
| GekkePrutser wrote:
| Even when turning telemetry off there's still a huge
| amount of data going to apple.
|
| For example the gatekeeper revocation check leaks a lot
| of data about what kind of apps you run. I'm sure some
| departments of apple really care about privacy but it's a
| big company and clearly not all of them do.
| dwaite wrote:
| My understanding from talking is that internally they set
| a high bar for telemetry data, which includes non
| correlatable data through techniques like data slicing
| and differential privacy.
|
| In the case of private relay, I believe they are using
| privacy pass such that a token indicating authorization
| is anonymous on use. So say, Apple knows who someone is,
| but Cloudflare and the like who do the actual producing
| can only tell that Apple authorized proxy access and (for
| HTTPS) what domains are being accessed.
|
| So Cloudflare in this example may be able to get some
| statistics of use and share them with Apple, but it will
| be more about the relative popularities of pornhub.com
| and cnn.com, and not what percentage or who frequent
| both.
| s3p wrote:
| Some people here need to read Apple's privacy policy.
| They go to extreme lengths to make sure no identifiable
| information leaves the device. Often times where Google
| sends information to the cloud to be processed (e.g.
| Photos data), Apple does the computation on-device. This
| is true for many things: analysis of photos, voice
| recognition, ML tasks, etc.
|
| Take a look at their approach to differential privacy if
| you are still convinced their data collection is
| egregious: https://www.apple.com/privacy/docs/Differentia
| l_Privacy_Over...
| headsoup wrote:
| I guess the question is whether an end-to-end walled garden
| is a good solution to tracking or not?
|
| And whether Apple can only track their own services/apps or
| other user data/activity. Providing Safari makes it
| interesting
| [deleted]
| criddell wrote:
| > "we cannot track the user and monetize their data."
|
| unless the user consents. So evil.
| qwertyuiop_ wrote:
| Turn it off and use Mulvad
| hestefisk wrote:
| The thing is... if you already pay for iCloud storage, this is
| thrown in for free. Plus it doesn't feel like it's via a VPN
| when using my 1Gbps fibre in Singapore. On Mulvad it does,
| unfortunately.
| sysadm1n wrote:
| Came here to say that. Using a VPN combined with Private Relay
| is overkill and adds latency too.
| ec109685 wrote:
| It doesn't work as well. Apple disables private relay when it
| detects a vpn enabled.
___________________________________________________________________
(page generated 2022-05-15 23:01 UTC)