Hacker News Reader

Comment by snowwrestler | Hacker News Reader

You have no control where your packets get routed on the Internet, by design of the basic protocols.

Personal data should be protected by TLS (edit: and/or application-level encryption) so packet routing is irrelevant to privacy and data protection.

I am very worried that the demand for protection of personal data (which is good) is mutating into an expectation of fully regional Internets that do not peer with each other (which IMO is bad).

View on HN

Every time I bring up on HN that enforcing national (or regional) law on any extranational company that sends packets to your country will inevitably result in the internet being siloed into legal regions, I get super angry responses. HN seems to love the idea of regulating, taxing, etc. any company that communicates over the internet with people in their country (I’ve even seen packets compared to physical packages subject to customs), but hates to recognize the logical conclusions of that.

If you pay attention to the time those comments come out you'll see a specific pattern around european users coffee/lunch/evening times.

No, the solution is not to silo internet into legal regions, the solution is to people in the USA to also lobby for stronger data protection laws.

When any server in USA soil can be changed into a backdoor, accompanied with a gag order on disclosure, I certainly do not want all my egress traffic routed into any computer in USA.

I thought private relay was supposed to exempt TLS traffic, and serve to protect unencrypted HTTP and DNS?

That’s the (current) rule for app network traffic. Traffic from Safari includes all network connections for iCloud subscribers.

If personal data from EU citizens is routed through the US in the clear or in a decryptable form, that's probably forbidden under the GDPR. There are exceptions, but this doesn't look like one of these.

And while I may not have direct control over where my data is actually routed, but there absolutely are legal restrictions on where companies may route them.

GDPR covers processing and storage of personal data. Packet routing is neither.

It is easier for US to ask Apple to monitor the traffic for a specific user, if the exit node is in US soil. Although the sibling comments say that it is probably a bug, and I hope that it actually is.

Thanks to the design of Private Relay, apple can’t monitor a specific user’s traffic.

From a design perspective you are right.

But from a threat model I would dare to say, if you control the platform (OS, Cloud Service) you can easy bypass encryption or deploy your own keys as well.

In the end it is still a trust question.

Until I see a subpoena that fails to yield any user information, I'll continue to be doubtful as to their claims.

> Personal data should be protected by TLS

I guess it's sort of a good thing that Apple is getting into the business of giving away snake oil to combat people selling it. The big iOS privacy changes that would help are DNS over HTTPS (maybe it already does this and requiring permissions for non-HTTPS network access. Maybe they could limit relay routing to non-HTTPS browser traffic?

Before calling private relay ‘snake oil’ and talking about DoH, perhaps you should do a little bit of research?

Reply on news.ycombinator.com