Hacker News Reader

Comment by petesergeant | Hacker News Reader

> It's not obvious that it immediately helps their bottom line

In the UK phone operators have complained about it on the basis that:

> [it allows Apple] to leverage its considerable market power into many areas of the market and thus being able to further entrench its position ... Network providers would no longer be able to use web traffic data over Safari to develop their own digital products and services that complete directly with Apple. For example, a network provider may no longer have access to information about a user's content viewing habits to develop their own content that competes with Apple TV. Similarly, a network provider may no longer be able to share consumer insight with third parties that provide digital advertizing services in competition with Apple Search Ads...

How true that is, who knows, but it's an interesting angle on how it benefits Apple

View on HN

The entitlement of companies that make money on surveillance is staggering.

There is no world where I want my ISP to have access to information about my content viewing habits. Why is this not an opt-in?

Boo hoo.

So people who sell a service and engage in surveillance to extract money through some other means are upset because another company is selling a service that provides a documented feature that prevents said surveillance.

Why wouldn’t that argument apply to normal VPN? Wouldn’t the mobile carrier be able to provide a spectrum of value-added services if they understood how my employees work? For example, if they were able to see that my accounts payable folks were recording information in SharePoint forms, they could offer a forms solution that was more efficient!

The National Association of Foxes is really upset that a company dares selling (slightly more) secure henhouses.

Except it's my belief that Apple is doing this so that THEY are the ones collecting and using this data, under the guises of privacy.

See also getting into Ads after kneecapping the competition.

> a network provider may no longer have access to information about a user's content viewing

That’s… kinda the point, no? To prevent scummy people doing scummy things.

At the same time are basically putting your trust in one company (apple) in this case to not do scummy things. But as pointed out this can be a way of helping themselves hold and expand various market positions.. which may or may not be scummy too. And who knows where they’ll be what they’ll change in a few years when the need to increase profits.

Im not supper trusting of any of these big companies. I don’t love regulations but we seem to be headed to some weird monopolistic place.

Not buying this. There is now a default option for end-users to protect their privacy in ways they previously could not. Users who don't know the ins and outs of VPNs, people who aren't as well versed with technology as us. THAT is who this benefits the most. They went from having nothing to now potentially something.

I also don't buy the whole "well your data might not be shared with X anymore but you're trusting Apple with it". What's the point? Anyone who uses literally any other major operating system is going to deal with the same thing. And the alternative? Android? Unless you want to switch to an indie fork of Android then the telemetry is much worse.

They build the operating system and the firmware, and design the CPUs. Maybe possibly protecting against some hypothetical future problem vs a real problem that exists today is not a good trade off.

If you're using an iPhone, you already are trusting Apple to not do scummy things. If they wanted to, they could snoop all your traffic with or without Private Relay.

What Private Relay does appear to do is guarantee that no one besides Apple can do scummy things. That's a definite improvement.

Private Relay prevents everyone, including Apple, from snooping your traffic - assuming it behaves as they document it. Given the protocol appears to be designed expressly to shield traffic from spying by Apple and their partners, it seems reasonable to assume that they're being honest.

Agreed, I was just saying that even if you mistrust Apple completely it's still a net gain.

Apple at least documents and gets a third party to audit and attest to the effectiveness of their controls. It’s not perfect - I’m not convinced zero trust exists - but it’s a lot better than the alternative which is nakedly disclosing unlimited use of private information for commercial purposes.

As long as you allow a vendor to deliver software updates, zero trust is impossible to achieve.

Good. Anything that gets complaints worded that way from companies that I am paying for a service that has nothing to do with watching my traffic and injecting ads into it without my permission sounds good to me.

It's not clear to me what data they are talking about? They talk about things like Apple TV and users content viewing habits but what info does an ISP even have about that other that things like time, data usage, what IP they connect to, etc? The really valuable things like what kind of content the users are watching is encrypted by TLS.

Seems like a really silly statement to me.

All that verbiage to effectively say: “we cannot track the user and monetize their data.”

It implies that Apple can and will use this data to inform its own products, which does seem anticompetitive. Whether that's true or not, I don't know.

My understanding of the design of private relay is that Apple cannot see this data as it works with a third party relay (Cloudflare I think?) to blind themselves to it

That complaint by the telcos is what convinced me to turn it on, the entire thing was a big whinge by them about not being able to spy on users anymore (and the hilarious claim that Apple was doing it to move users off Safari)

They cannot see the data because they have chosen not to see it. That is different than being unable to see it. As the creator of the software, Apple could disable to circumvent its own system to bypass these protections, perhaps in response to a legal obligation. A proper implementation, something like Tor, would be a designed to blind all network participants, including the evil ones.

That may be the case, but it misses the point. If Apple is not presently doing this, then they are not abusing their market position in gain an unfair advantage.

Then the tor exit node people could read the traffic.

Do what I do, i encode all emails into giant QR codes on paper that will fade in 72 hours. I then have a staffer chain a briefcase with the email to his or her wrist and fly to the recipient in a private jet. The one time pads are delivered by a separate courier.

If you think the tor exit node looking at the traffic is equivalent, you missed the point of tor.

We’re talking about a company like Apple building a global infrastructure.

Any such scenario would result in the company or their providers controlling a lot of the infrastructure.

That’s why private relay isn’t a bad thing. You’re replacing thousands of individual risks with one. IMO, the protection of Apple’s PR is stronger than any tech.

> As the creator of the software, Apple could disable to circumvent its own system to bypass these protections

How is that new though? As the creator of Safari they could store tracking information locally and batch upload it for processing.

Apple makes the device and OS. They will always have the ability to see the data.

>They cannot see the data because they have chosen not to see it. That is different than being unable to see it

It's different in terms of security, but in terms of competition, which is what network providers complained about, there is no difference at all.

This is a pointless argument though, since Apple can deliver arbitrary over the air updates to iPhones anyway. There is nothing that iPhone hardware is physically capable of doing that Apple could not release a software update to do. Thus any evil you can conceive of is trivially within the slippery slope.

> That complaint by the telcos is what convinced me to turn it on

To be fair to telcos, (who totally don't deserve it), the original argument they made is that if all phone traffic gets routed to a relay endpoint, and not its real destination, it reduces their ability to network plan and add capacity to the routes that are actually in use.

Hearing this argument means they didn't get what they want and wanted to pull in the antitrust argument, and tipped more of their hands.

Not exactly the same, but it wouldn’t be the first time Apple did something like this. For example, Apple shows a scary “Do you consent to TRACKING” dialog for third party apps, but for their own tracking, presents a “is it okay if we use just a bit of your data to personalize your experience”?

But Apple, as the device owner/operator, can do all sorts of tracking that cannot be accomplished by anyone else. They know when your phone is on or off. They know how often your battery runs flat. They know how bright your screen is. Apple surely uses this basic data in creating products. Telemetry isn't content tracking, but it is still tracking.

My understanding from talking is that internally they set a high bar for telemetry data, which includes non correlatable data through techniques like data slicing and differential privacy.

In the case of private relay, I believe they are using privacy pass such that a token indicating authorization is anonymous on use. So say, Apple knows who someone is, but Cloudflare and the like who do the actual producing can only tell that Apple authorized proxy access and (for HTTPS) what domains are being accessed.

So Cloudflare in this example may be able to get some statistics of use and share them with Apple, but it will be more about the relative popularities of pornhub.com and cnn.com, and not what percentage or who frequent both.

Some people here need to read Apple's privacy policy. They go to extreme lengths to make sure no identifiable information leaves the device. Often times where Google sends information to the cloud to be processed (e.g. Photos data), Apple does the computation on-device. This is true for many things: analysis of photos, voice recognition, ML tasks, etc.

Take a look at their approach to differential privacy if you are still convinced their data collection is egregious: https://www.apple.com/privacy/docs/Differential_Privacy_Over...

When I set up macOS recently, telemetry was off by default; it was opt-in. Not sure about iOS, but I presume it is the same. So you are correct that device makers collecting telemetry have a certain advantage, but most app/content tracking systems I have interacted with are opt-out and therefor, in my view, are more invasive.

The app tracking dialog on iOS is technically opt-in, but the way it is written reflects that the system and the user have limited control, the "Ask App Not to Track" button implies that Apple acknowledges that their attempts to block tracking are best effort and are not guaranteed to work, because new and clever ways to implement tracking are being created on a regular basis.

Even when turning telemetry off there's still a huge amount of data going to apple.

For example the gatekeeper revocation check leaks a lot of data about what kind of apps you run. I'm sure some departments of apple really care about privacy but it's a big company and clearly not all of them do.

Another reason I wish Apple just stuck to hardware and software rather than expanding into stuff like Apple TV. Can’t be anticompetitive if they’re not in the market!

Apple explicitly documents that they ensure that private relay data is opaque to them, the also document the audits to show that they cannot spy on the data. As a result iCloud Private Relay is strictly more private than any other VPN service.

I guess the question is whether an end-to-end walled garden is a good solution to tracking or not?

And whether Apple can only track their own services/apps or other user data/activity. Providing Safari makes it interesting

> “we cannot track the user and monetize their data.”

unless the user consents. So evil.

Reply on news.ycombinator.com