About iCloud Private Relay

https://support.apple.com/en-au/HT212614

by andrewstuart • 4 years ago

129 138 4 years ago

support.apple.com

lelandfe5• 4 years ago

Only works with Safari on macOS, which means I’ll never use it there. And I wound up turning it off on iOS because it made my life more annoying - go into the subway and try to connect to the free MTA WiFi? Alert! Your browsing is unprotected.

…plus I found I would sporadically get connection issues that I resolved by turning it off.

It’s a bummer because I would like to use it, and it being bundled with iCloud is nice.

currysausage• 4 years ago

No Google suggestions for me in iOS Safari when using Private Relay.

dijit• 4 years ago

go into the subway and try to connect to the free MTA WiFi? Alert! Your browsing is unprotected.

I haven't used it myself, but it seems reasonable to inform laymen that browsing to a captive portal system will be unprotected. I'm not sure how eggregious the error actually is.

…plus I found I would sporadically get connection issues that I resolved by turning it off.

Not defending Apple in particular, but connectivity will decrease with every extra hop you make in your connection; you'll notice this when browsing the internet with tor (or, heaven forbid trying to use IRC over tor).

it makes sense that you would have more connectivity issues when using any kind of proxy; and it would get worse with every extra layer of proxy.

lelandfe5• 4 years ago

Not sure what “connectivity will decrease” means in practice, but I’d see problems like pages refusing to load over multiple refreshes, texts not sending, or iCloud data (messages, photos, etc) simply not updating until I switched the service off.

I’m not as convinced as you that these problems are inherent to the service, and I’m holding out hope for what Private Relay looks like when it emerges from beta.

I'm not sure how eggregious the error actually is

Not egregious - annoying. Unusual for Apple. I don’t want to use a service that spits alerts at me as I walk around the city.

ec1096852• 4 years ago

The connection issues don’t happen anymore. It was annoying before where things would just hang and then turning off and on would fix it. I haven’t seen that in months, so they must have fixed the issue.

lelandfe5• 4 years ago

Nice! I'll give it another shot.

maxpert• 4 years ago

I love it! Using this I’ve seen FB/Google having less and less information about my exact location. Seeing less relevant ads is assuring and relieving! The only wish I have is a more fluent way to enable/disable this and having an app for other platforms.

kyrra• 4 years ago

Google Fi also has a VPN solution if you use them. Some ads are definitely as if I'm in another state. The weird one is shopping sites (like Home Depot) try to guess my closest store and they are always wildly off. It's sorta funny.

lotsofpulp• 4 years ago

The weirder thing is that even after I login, Home Depot (and Best Buy and Staples) show me the wrong preferred store. I already saved what store I want, plus I have my home address saved (and it is the only address), yet they cannot remember or figure out my preferred store. And they have my purchase history for where I have already purchased things a million times, in recent history.

What is all this data good for?

jvolkman• 4 years ago

Also Google One, which doesn't require using Fi.

https://one.google.com/about/vpn

can16358p• 4 years ago

It used to work great last year, then all of a sudden it stopped working due to "regional laws", killing the whole purpose of it.

I don't get it as VPNs or proxies aren't illegal where I live, how is Apple's private relay not available?

wonderbore• 4 years ago

Probably whoever is responsible for it doesn’t really want to put up a fight. VPNs are always kind of in a gray area which many small companies could deal with (or say f it) but Apple can’t or doesn’t find it to be worth the fight.

VPS are a digital product while Apple has physical stores or resellers of physical products in these countries. It’s not as easy.

88840-88552• 4 years ago

I am blocking ads via my router DNS. When using Private Relay I see the ads again, which is makes using apps very annoying.

Plus, I dont see any benefit of hiding my network traffic here in Germany, tbh.

jeroenhd• 4 years ago

The DNS issue is intentional. Trackers have collected information about people using VPNs before by generating unique domain lookups for a visit and watching where the DNS query originates from.

Theoretically, editing your hosts file might provide the same filters even with Apple's pseudo-TOR enabled if the system respects user preferences. That might be a challenge on iOS, though.

bowsamic7• 4 years ago

One reason that might not affect you is that piracy is heavily prosecuted in Germany

Nextgrid2• 4 years ago

This is limited to Safari though, so completely useless for piracy.

jedisct1• 4 years ago

dnscrypt-proxy works fine with Private Relay.

atVelocet• 4 years ago

I recommend using something like NextDNS, DNSCloak or Blockada: - Local VPN Apps like Lockdown can block DoT but not DoH - Manual DNS settings don't block DoH or DoT. AFAIK you need an app with specific entitlements? Maybe someone can clarify this? - Private Relay works as expected

I am using NextDNS on all iOS devices and it works great. Get yourself an account and configure it to your needs. Don't forget to enable the block site instead of 0.0.0.0., then download their CA and trust it.

plg• 4 years ago

It may not work perfectly for all people in all use cases, yet ... but I have to say I appreciate and admire Apple's initiative and the values that this approach reflects. They didn't have to do this. It's not obvious that it immediately helps their bottom line. It does seem like the right thing to do for individual privacy. I appreciate that and it contributes to my overall respect for the company and its approach.

ricw• 4 years ago

It does have an immediate positive effect. People will likely switch to apple and trust it more. This means more service revenue, long term lock in and ultimately more profits.

Im moving my to-be-paid-for personal google apps accounts over to iCloud for one.

It’s not just a principled approach. Though it just makes sense. Thank god apple has minimal ad income only. Otherwise this wouldn’t happen.

bowsamic7• 4 years ago

The ad thing is why I stick with apple. I just feel much more comfortable paying for software and hardware that isn’t ad supported. I feel like I’m buying a product rather than being the product

petesergeant• 4 years ago

It's not obvious that it immediately helps their bottom line

In the UK phone operators have complained about it on the basis that:

[it allows Apple] to leverage its considerable market power into many areas of the market and thus being able to further entrench its position ... Network providers would no longer be able to use web traffic data over Safari to develop their own digital products and services that complete directly with Apple. For example, a network provider may no longer have access to information about a user's content viewing habits to develop their own content that competes with Apple TV. Similarly, a network provider may no longer be able to share consumer insight with third parties that provide digital advertizing services in competition with Apple Search Ads...

How true that is, who knows, but it's an interesting angle on how it benefits Apple

dlivingston• 4 years ago

All that verbiage to effectively say: “we cannot track the user and monetize their data.”

jen202• 4 years ago

a network provider may no longer have access to information about a user's content viewing

That’s… kinda the point, no? To prevent scummy people doing scummy things.

Spooky233• 4 years ago

Boo hoo.

So people who sell a service and engage in surveillance to extract money through some other means are upset because another company is selling a service that provides a documented feature that prevents said surveillance.

Why wouldn’t that argument apply to normal VPN? Wouldn’t the mobile carrier be able to provide a spectrum of value-added services if they understood how my employees work? For example, if they were able to see that my accounts payable folks were recording information in SharePoint forms, they could offer a forms solution that was more efficient!

AlexandrB• 4 years ago

The entitlement of companies that make money on surveillance is staggering.

There is no world where I want my ISP to have access to information about my content viewing habits. Why is this not an opt-in?

MarkMarine• 4 years ago

Good. Anything that gets complaints worded that way from companies that I am paying for a service that has nothing to do with watching my traffic and injecting ads into it without my permission sounds good to me.

CircleSpokes• 4 years ago

It's not clear to me what data they are talking about? They talk about things like Apple TV and users content viewing habits but what info does an ISP even have about that other that things like time, data usage, what IP they connect to, etc? The really valuable things like what kind of content the users are watching is encrypted by TLS.

Seems like a really silly statement to me.

mindslight2• 4 years ago

I'm not a huge Apple fan, but I totally agree. Private Relay has its faults, but it seems poised to push back against commercial mass surveillance, in a way that niche usage of VPNs simply cannot dent. Now website operators have to ask themselves "Do I really want to hassle normies using iPhones with CAPTCHAs?". Traditionally, VPN/TOR users just bear that bullshit and pray websites do not alter the deal any further. But the mass market won't stand for that.

Long term we've yet to see what the evolution will end up being (Apple could publish a list of their exit nodes for websites to whitelist, causing Mullvad et al to be left out in the cold), but for now I'm cautiously optimistic.

donmcronald• 4 years ago

It really sucks when someone thinks they may have been phished an you need to review login logs to assess things. VPNs suck too, but it’s easy to tell people not to use them for business connections. Something from Apple will be marketed as being amazing even if it’s a net negative for some users.

dwaite3• 4 years ago

The exit nodes are published, mostly to get incorporated into geo-ip tables.

dixie_land• 4 years ago

poised to push back against commercial mass surveillance

By consolidating all surveillance to Apple?

latexr• 4 years ago

It's not obvious that it immediately helps their bottom line.

Your comment ends with:

I appreciate that and it contributes to my overall respect for the company and its approach.

Seems like a straightforward connection: Apple provides the feature → your trust in them increases[1] → you continue to buy from them and recommend them to other people.

[1]: Especially relevant at a time where distrust of big tech companies is rising.

s3p3• 4 years ago

This. I don't think people understand that some Apple initiatives are driven by their values and a desire to do something good for the user. Also, this is part of a paid iCloud plan anyway, so it encourages people to pay for iCloud.

lapcat8• 4 years ago

It's not obvious that it immediately helps their bottom line.

Besides requiring a paid iCloud+ subscription?

KennyBlanken• 4 years ago

...which did not have this feature beforehand (nor the email anonymization) and did not increase in price from a dollar a month.

That's what iCloud 50GB cost in 2015, and they introduced these new features in 2021.

Likely possible due to falling capex/opex costs for the storage, but still...they added multiple new features and didn't increase the price, even after a fairly substantial amount of inflation over those five to six years.

bradgessler• 4 years ago

I too laud Apple for their efforts, but I view them as a benevolent dictator.

To me it’s obvious how this helps their bottom line: people are very interested in privacy and willing to pay top dollar for it. Every time I turn on an additional privacy service from Apple, I feel their grip tightening on my digital identity as they push themselves even more between me and the direct relationships I have with other websites.

iCloud private relay, email aliases, and “Sign in with Apple” is their final act to completely dominate the relationship between their users and other web applications.

I’m not bitter about it, but I do think it’s helpful and healthier to view Apple in this way and not mistake their efforts as altruistic. They’re simply a company trying to develop a profitable, high retention service… and they’re doing a damn good job at it.

sunshinerag• 4 years ago

Glad that it is not altruistic. Much more better served with other incentives

_abox• 4 years ago

The lock-in makes it impossible for me to use most of their services though. I need to access all my stuff on Mac but also on Windows and Linux.

I wish there was a good privacy-embracing cloud platform that I could just pay for directly instead of via buying hardware as Apple does.

iCloud private relay is a great idea but I need it on all my computers and phones. I use Firefox now but their VPN option doesn't hold a candle to what Apple offers with icloud relay. It's really a different thing altogether.

godelski2• 4 years ago

What's even worse is that a lot of their privacy and security features are designed to interact within the walled garden instead of purely security and privacy by default. Talk to another Apple user? Everything fine. Talk to an Android user, no more privacy and security. And good luck sending a video that doesn't look like it was filmed with a literal potato.

ignoramous• 4 years ago

Despite their take on privacy, I'd not be surprised if Apple also purchased a tonne of user data from brokers, however.

At the end of the day, they are a very successful business that serves its own bottom line. The privacy angle for the mobile and browser ecosystem, in my eyes, is nothing but market positioning (as more or less anti-Android and anti-Chrome) even if they are engineering novel solutions such as the Private Relay.

If they really cared, they wouldn't be in bed with Google for their search deal, for example: https://www.nytimes.com/2020/10/25/technology/apple-google-s...

kaba02• 4 years ago

The average people associates search with Google — they would lose more by not providing it

overtonwhy• 4 years ago

If you’re reliant on their email services you’re less likely to cancel iCloud or switch mobile platforms.

qwertyuiop_• 4 years ago

Turn it off and use Mulvad

sysadm1n• 4 years ago

Came here to say that. Using a VPN combined with Private Relay is overkill and adds latency too.

ec1096852• 4 years ago

It doesn’t work as well. Apple disables private relay when it detects a vpn enabled.

hestefisk• 4 years ago

The thing is… if you already pay for iCloud storage, this is thrown in for free. Plus it doesn’t feel like it’s via a VPN when using my 1Gbps fibre in Singapore. On Mulvad it does, unfortunately.

SalimoS• 4 years ago

I don’t have a Facebook account but sometimes I got an fb link for a public meme or a video and for the past month it’s been 50/50 (seeing the resource or getting blocked by Ip)

HomeGear• 4 years ago

It’s fully blocked from commenting on 4chan too.

nceqs3• 4 years ago

Private Relay is a fantastic feature, definitely one of the better ones Apple has rolled out over the past couple years.

Bluecobra• 4 years ago

One thing that is pretty cool is that it will proxy a IPv4 connection to IPv6. I was surprised to see a IPv6 address when I searched for “what is my ip” in Google.

marricks• 4 years ago

It’s important to note you actually have a choice to use Apple products or not, or even use this relay or another. In many places in the US you have barely any choices for your ISP which could be tracking you and selling your data.

This is great in that it gives everyday folks a stupid-simple protection from ISP and mobile service providers.

And yes, of course Apple did it as another reason to sell next tier iCloud service and gain good will of folks, which I think is a much better trade off then ISPs and Sprint/Verizon/etc knowing your full browser history.

tempfs2• 4 years ago

Just remember that now instead of your ISP knowing every site you visit, Apple now will.

So where as in the olden days, in order to figure out who you were, some actor had to buy logs from the destination sites and from the ISPs, then correlate.

Now they can just buy the information from Apple. How convenient for Apple.

I know Apple says they will only share your information with trusted partners and only with your consent which is implicit when you use private relay. No one ever asks who these partners are though. Probably the same people that used to buy your data from the destination sites and ISPs...

jtsiskin• 4 years ago

…did you read the article?

tempfs2• 4 years ago

Have you read Apple's privacy policy?

dagmx• 4 years ago

The article specifically mentions that the Apple relay wouldn't see the DNS, whereas the second relay doesn't see your IP.

Secondly, Apple makes the OS. If they wanted to spy on you, they could have done so in much easier ways already.

gr2020• 4 years ago

This is the point - Apple doesn't have that information either. From the article, in the "How Private Relay works" section:

when you browse the web in Safari, no single party — not even Apple — can see both who you are and what sites you're visiting.

baby-yoda2• 4 years ago

agree - apple says they're doing this for "privacy" but there is no way to verify they are not tracking/storing this data themselves. in todays world its simply too valuable and apples tentacles are far too reaching for the data to be thrown out. in fact, there are reports of an increased advertising push already [0].

id wager there is an internal team analyzing this data for predictive trends across all their product lines, akin to facebook using onavo data to target and value whatsapp relative to messenger.

it could be used to guide which new streaming series candidate gets more funding/marketing, popular colors for new iPhones, price elasticity across the range, etc.

and of course the surveillance aspect always looms in the background.

[0] https://www.macrumors.com/2022/05/09/apple-services-push-str...

zwily• 4 years ago

There was no way to verify before that Apple wasn’t tracking you either. Whether or not you trust Apple should have nothing to do with Private Relay.

clarity• 4 years ago

you're missing the whole point of private relay

baby-yoda2• 4 years ago

is it possible to DIY something like this, and is it worth the hassle?

my thought was 2 VPS and use Wireguard multihop. VPS 0 connected from my home router, VPS 1 connected to VPS 0 via private networking (ideally in a different geo location). recycle VPS 1 IP/location periodically.

VPN from mobile to home router and get the benefits on the go, with dnsmasq blocking ad hosts in VPS 1 so tracking crap ideally doesn't make it over the wire. thoughts?

DerekBickerton• 4 years ago

I have a VPN travel router with a Mullvad .OVPN profile added. This 'VPN-ifies' all my traffic. Then I have a VPN app I use on my device from another VPN provider (ProtonVPN). This is chaining two distinct VPN providers on top of each other, a form of onion routing. Does it make me 'more' private? Hardly, but it's a good first step.

gruez• 4 years ago

But with your setup, the 2 VPS are still traceable to you (ie. via payment information). You can go through some extra effort to avoid this (eg. buying the VPS over tor and paying using crypto), but I'm guessing you're not currently doing this. Moreover, the 2 VPS are still carrying only your traffic, which makes logging/correlation attacks easier. With apple's solution, your traffic is mixed with others, and the second hop has no idea who you are.

rollcat• 4 years ago

Beware of using private relay with Apple Mail (at least on macOS). You currently can't both use private relay AND disable automatic remote content loading, so looking at a spam message will immediately load all pictures, and you will be spammed to oblivion. The spammer won't know your IP but that's little comfort, you're now a top spot on their list.

iancarroll• 4 years ago

At least on iOS, Mail Privacy Protection is designed to load all resources immediately upon receiving the email, not when viewing it.

Maybe this still indicates the email is valid to a spammer, but it wouldn’t show that you opened it (unlike i.e. Gmail’s image proxy, which only loads upon viewing.)

https://www.litmus.com/blog/apple-mail-privacy-protection-fo...

g_p• 4 years ago

You should be able to do this (although not immediately obvious) by:

- Opening Mail, Preferences, and going to the Privacy tab. - Unchecking "protect mail activity" - Checking "hide IP address" - Checking "block all remote content"

Now you have automatic remote content loading disabled, and have private relay enabled. You would need to test this with a "friendly" bit of remote content to be certain, but it seems to work.

When doing this, also ensure you have limit IP tracking enabled on your ethernet or wifi network, as that appears to override this setting (based on the help content which is available in this tab).

Yeri• 4 years ago

iCloud private relay currently has at least 2 providers (Cloudflare and Akamai); there may be more in other regions.

Cloudflare has a good blog post about this: https://blog.cloudflare.com/icloud-private-relay/

barathr• 4 years ago

Fastly as well -- Fastly, Cloudflare, and Akamai are the three egress providers.

aborsy• 4 years ago

Good feature, although a bit slow for me in a major metro.

FunnyBadger• 4 years ago

It doesn't work with VPN apparently (that's what it told me when I tried). That's not going to cut it for me. There are other ways that don't have that restriction.

midislack• 4 years ago

Various sites are punishing me for using this. Amazon and eBay both seem to massively dislike it and demand I click an email link.

SheinhardtWigCo• 4 years ago

Two interesting side effects, if I understand correctly:

1. Dramatically reduces the number of entities the government needs to "partner" with (via NSLs and/or TAO) for the firehose of domains visited by Apple users.

2. Apple gets a time series of Safari network traffic for each user

I wonder how many popular domains could be unmasked by an ISP that is supposedly blind to the destination of each packet but can of course still see fine-grained traffic patterns for each user.

olliej3• 4 years ago

(1) Private Relay encrypts the request, so the host that can identify the client cannot read the request. The host that can decrypt the request cannot identify the client. So without making a total change to how it works it's not it by design cannot be used for surveillance.

(2) Again, by design Apple cannot see what is being requested, so no it doesn't get a time series of safari traffic. If that were a real concern that you had, then recall the Apple could just have Safari report those directly, without having to have any VPN-type insanity.

The text that is important is, it would seem very hard for Apple to say this is if was not true: "This information could be used to determine your identity and build a profile of your location and browsing history over time. iCloud Private Relay is designed to protect your privacy by ensuring that when you browse the web in Safari, no single party—not even Apple—can see both who you are and what sites you're visiting."

stereoradonc• 4 years ago

This is about centralisation of user data through Apple's servers under the garb of "privacy". When will the HN community wake up and start calling Apple for what it is?

kaba02• 4 years ago

When will HN users learn to not write overly confident “facts” when they are not, in fact, knowledgeable enough on the topic?

About iCloud Private Relay

Related Stories