Comments

This profile is from a federated server and may be incomplete. Browse more on the original instance.

LWD, (edited ) to privacy in How private is Apple's Private Relay, really?

Update: Apple’s role in adding extra location data to your request has been added to this post

Apple and a couple other providers have been experimenting with a multi-hop system of making your connections private.

Here’s what Cloudflare says.

https://blog.cloudflare.com/content/images/2022/03/image1.png

Here’s what a competitor, Invisiv, says.

https://invisv.com/img/relay.png

Both pages are pretty hard to parse (IMO Cloudflare uses more jargony language: “ingress”/“egress server” - really?) but they get to the same point.

https://i.imgur.com/n1BcDtt.jpegf

Your data takes a path like this

  1. Your computer, your IP address, your message to a destination gets encrypted in a couple layers and passed on.
  2. Your ISP knows exactly who you are and that you’re reaching out to server 1. They can’t see your data but to them, you’re using a VPN probably.
  3. The first server also necessarily knows who you are, unpacks one layer of your request and sends it on to a second server (in Invisiv’s case, Fastly; in Apple’s, Cloudflare).
  4. The second server now knows that data was requested from the first server, and it can see the name of the domain you’re requesting (YouTube, for example) but because the request came from the first server, it theoretically won’t know it’s you making that request
  5. The data moves on from the second server to the destination, with the destination only knowing it’s receiving data from the second server, and not knowing about the first server.

The obvious issues here:

  • Do you trust the people providing the multi-hop VPN-like service?
  • Do you trust the two servers, which have necessarily entered into an agreement of some sort, to not collaborate regarding transmitting data?
  • How easy is it to audit the code we can see?
  • What else is going on with your data?

In the case of Apple/Cloudflare, reputation is rather poor. From PRISM to false advertising to notification telemetry, Apple hasn’t exactly delivered on their promise. In terms of Invisiv, the company has some big names on board but Fastly and Cloudflare both have a rather significant grip on the internet (with Cloudflare’s being bigger) but any CDN gets a good view into personal data most of the time.

Update: in the case of Cloudflare/Apple, Apple adds additional location data to your request, making its “private” relay leak approximate location data the same way your IP address could leak it. To wit:

Apple relays geolocate user IP addresses and translate them into a “geohash”. Geohashes are compact representations of latitude and longitude.

But on the bright side: a VPN has far more issues than either of these, as it’s basically #4 above except the same service also has your identity by necessity. An untrustworthy VPN is as harmful as an untrustworthy ISP, with very little separating them.

LWD, (edited ) to privacy in A question about secure chats

deleted_by_author

    •
    LWD, (edited ) to privacy in Proton Mail CEO Calls New Address Verification Feature 'Blockchain in a Very Pure Form'

    deleted_by_author

    •
    LWD, to privacy in "Cars are the worst product for privacy" | Hope this will reach the normie consumer!

    From metadata alone, you could identify somebody at a strip club on Friday, a church on Sunday, and an STD clinic on Tuesday

    LWD, (edited ) to privacy in noyb files GDPR complaint against Meta over “Pay or Okay”

    deleted_by_author

    •
    LWD, to privacy in Privacy Concerns on Lemmy: A Call for More User Control

    There’s a grim tragedy in how many people in this comment section have either succumbed to defeat or actively seek to advocate against privacy.

    The comments can mostly be boiled down to:

    • My data is online already, and I give up
    • Your data is online already, and you don’t deserve control over it
    • I have nothing to hide and nothing to fear (and you should too)

    You will find Fediverse types are far more cynical and antagonistic to privacy than people on other platforms.

    LWD, (edited ) to privacy in Telegram Android Notifications

    deleted_by_author

    •
    LWD, (edited ) to privacy in Time to ditch #duckduckgo

    deleted_by_author

    •
    LWD, (edited ) to privacy in How safe are grammar editing tools?

    deleted_by_author

    •
    LWD, to privacy in What is the community's opinion on Session and Session Automated Software?

    Simplifiedprivacy dot com needs to be blacklisted from Lemmy communities, it’s a blog trying to sell some really silly services.

    As for Session, they’ve never made an original product that I’ve ever seen - they took Signal and Monero, peeled off the labels, and made them (especially Signal, IMO) worse in both aesthetics and privacy protection.

    And the company behind this is in Australia, a country where you need to weaken products (by adding backdoors) upon government request.

    LWD, to privacy in Brave to end 'Strict' fingerprinting protection as it breaks websites

    Do you hate the Brave CEO for doing the same thing as the Mozilla CEO, but with even less restraint?

    Or are you just whining in hopes that nobody will question whether you’re being a hypocrite

    LWD, (edited ) to privacy in Privacy Concerns on Lemmy: A Call for More User Control

    deleted_by_author

    •
    LWD, to privacy in Wickr alternatives

    deleted_by_author

    •
    LWD, (edited ) to privacy in Proton Mail CEO Calls New Address Verification Feature 'Blockchain in a Very Pure Form'

    deleted_by_author

    •
    LWD, (edited ) to privacyguides in SimpleX Self-Host Script, Tutorial, on Monero Provider

    deleted_by_author

    •
  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • localhost
  • All magazines
    •
    Loading…
    Loading the web debug toolbar…
    Attempt #