I’m sure there are places that would try to charge Mac users more (or make them more likely to be mugged or something) as they are more well-off statistically.
Verizon used to add http headers identifying their users to advertisers.
Everyone is out to tag you, and it’s because on average it makes them ever-so-slightly more profitable - at your expense, on average.
> Capital One used to offer different mortgage rates to IE users and Firefox users;
This was driven by looking at the User-Agent header your browser sends on every request, not sniffing your local network connection.
Similarly, the Verizon super-cookie header wouldn't affect HTTPS traffic (this was one of the motivations behind HTTPS-everywhere campaigns since even many people who think the NSA can track them no matter what mind marketers doing it) and the point was tracking individual people across multiple devices, not simply gross device fingerprinting. Even if your VPN connection has 100% uptime they can do the traffic analysis I mentioned but since it's almost certain that there will be some non-VPN requests they would already know that you have at least one Apple device.
The underlying issue here is that the kinds of things you're worried about happen in the browser. Using a VPN adds reliability and performance issues but it doesn't prevent this kind of basic identification and very, very few people aren't going to leave some kind of far more identifying cross-site activity which would uniquely identify them rather than just narrowing it down to one of the most popular consumer brands.
The older user-agent / supercookie tags don't work for intermediaries on https, indeed. Which is all the reason why your other metadata (such as contacting apple servers) helps tag you.
> The underlying issue here is that the kinds of things you're worried about happen in the browser.
The things I'm worried about are those I'm yet unaware of. Those things I am aware of (in the browser, for example), I mitigate with browser addons and other tools. But I"m not aware of everything.
I'm not paranoid, everyone IS trying to tag me (and you, and everyone else) for their profit. I am not familiar with ALL the ways they do it, therefore I worry about all information leaks.
That's not a threat model:
https://en.wikipedia.org/wiki/Threat_model
My point is that you need to think about what you're trying to protect against so you can avoid spending time on things which don't matter. For example, if you're concerned that your ISP is going to tell people your IP address and say you own a Mac, you might want to think about whether having a VPN installed would prevent them from doing so, which will not be the case unless you set it up at the router level, configure it to drop traffic if the VPN connection fails, spread your traffic across multiple providers to make things like download profiling harder, etc.
Trying to conceal such general signals from a network-level attacker is a very hard game but once you stop to think about why you care, it becomes clear that it's a waste of time. The two stories from a decade ago were about businesses presenting different rates based on the user-agent. If you're not masking that, you're giving away more detailed information to every site you visit. If you are masking that, you might say that the problem is your ISP selling your IP association to third-parties as part of a “can pay more” list and that clarifies that the real concern isn't what your ISP can see — they do, after, all have your address, billing information, logs from your access to their services, and probably a credit score — but whether they resell it.
Putting it all together, your threat is “third-parties can obtain information which they would not otherwise have about me from my ISP”. That tells you that you need to think about breaking ways they'd make that link: using a VPN for web browsing can make a difference there since it means that Shady Bank™ can't use an IP lookup (assuming your VPN provider wasn't the threat you really needed to worry about) but trying to force Apple system services through it is just wasting time to make things slower and less reliable, and you're much better off spending your time making sure that you use unique contact info, browser containers, etc. to limit the ability of third parties to link your data. In a world where most people use cell phones, Google, Facebook, etc. it's just not that valuable to have a signal which says “IP x uses products from one of the most popular consumer electronics companies”.
[2] https://www.cnet.com/news/mac-users-pay-more-than-pc-users-s...
That's amusing, I didn't know about it before. Looks like the story broke 10 years ago:
https://hothardware.com/news/at-capital-one-different-browse...
https://consumerist.com/2010/11/01/capital-one-made-me-diffe...