VPNs on iOS are a scam | Hacker News Reader

VPNs on iOS are a scam

michaelhorowitz.com

525 pointsalexpc201243 comments

I was developing VPN client for one of the popular VPN provider in the past for iOS and the solution was quite simple - enable on-demand VPN for 0.0.0.0/0

In this case, iOS will always wait until connection to VPN is established before sending any packets out.

Without on-demand, VPN may leak.

If I remember correctly, leaks occurred mostly after waking from sleep but before the tunnel had chance to be set up. Or in similar situations. Anyway, on-demand option solved all of them.

This is exactly my experience (have developed multiple iOS vpn apps).

do existing sessions get terminated and restarted through the VPN when you start it? Seems like that's one of the major concerns that the author is raising

I think Apple is transparent about Always on VPN (blocking traffic except over the tunnel) requiring provisioning using MDM tools. Apple Configurator is free and allows anyone to set this up.

Any other VPN is just best effort.

https://support.apple.com/guide/deployment/vpn-overview-depa...

That Apple documents that 'normal' VPNs are broken on iOS doesn't change the fact that they're broken.

VPNs were always meant to carry internal traffic to a private network, not the public internet (hence the name Virtual Private Network).

The fact that a VPN server can send you a route for 0.0.0.0/0 always was and always will be a happy accident.

> VPNs were always meant to carry internal traffic to a private network, not the public internet

This. And the idea that these so called ‘VPN’ services somehow improve your security and privacy on the internet is laughable. All they do is let you get onto the public, untrusted, internet through a different on-ramp. There is no point to them. The internet is just as untrustworthy through a VPN service as it is through any other internet connection.

> There is no point to them.

What about this?

"Under the provisions of the Investigatory Powers (IP) Act, it is now possible for the Law Enforcement Agency (LEA) community to lawfully obtain Internet Connection Records (ICR) in support of their investigations. Following the completion of some initial trial activities, work is now underway to provision a national ICR service."

https://www.digitalmarketplace.service.gov.uk/digital-outcom...

And what makes you trust that the VPN provider wouldn’t share these records if asked?

Pick one in a suitable jurisdiction with a track record of sending such records and requests for them to the bit bucket?

In the end you have to trust someone or you might as well just stay offline forever. In the US, very few people have much choice in their ISP. If you are lucky you might have more than two options. Many ISPs are known to be untrustworthy. They outright state they will mine your internet history and sell it. If I have the choice between an ISP who I know will sell my browsing history and a VPN which might, but claims not to? Well, I know which one I'm going to pick.

They also state they can and will shut down your service for copyright infringement.

If ISPs don't shut down people's accounts they'll get sued for billions in fines. There are still open court cases against multiple ISPs for not cutting enough people off from the internet. So far, courts have agreed with the RIAA/MPA who paid good money for the laws we have.

Yes, the media industry is certainly more to blame here. Although, the current ISP oligopoly means that there are less companies to sue or otherwise bully. And it doesn't help that some major ISPs are owned by companies that also produce copyrighted content they want to protect.

use VPN provider that does not store these ICR records and is physically unable to fulfill such request

Moreover, why do you imagine that the VPN is not being operated by the NSA? THere are really a few different kinds of VPN operators: intelligence services, organized criminals, and legit businesses. You have no way of determining which is which.

I’ve heard the idea of “competing jurisdictions” advanced here: run your own Wireguard VM in China or Russia and route traffic through that box, with the goal of essentially introducing unfriendly international borders in your traffic. Ideally your Russian VM provider would be uninterested in responding to an American subpoena.

The other concept I’ve heard put out is to add layers - your traffic hits Vultr, then Hetzner, then etc etc. Conceivably if you cross enough jurisdictions you can make it very difficult for a legal adversary to attack your traffic.

Would I bet on this for activities I needed to remain exceptionally private? No - but if I needed relatively consistently low latency traffic and a decent baseline of privacy it might just work.

> All they do is let you get onto the public, untrusted, internet through a different on-ramp. There is no point to them.

Not true, at all. There are several good reasons to use VPNs to get a different on-ramp to the otherwise untrusted internet.

  - Avoid ISP tracking: Your ISP should see only traffic to and from the VPN. 

  - Access content intended for those in other regions: Many sites and services only show certain content to people who enter the internet from specific places. 

  - Limit the amount of activity linked by trackers: Visiting certain sites only from different IPs/browsers will help keep logs of that traffic isolated from the logs of your other browsing.

  - Allows you to connect to sites and services that cannot connect back to you once you've disconnected: A lot of people, even those with dynamic IPs, keep their address for months or years at a time. VPNs provide a great way to cycle through IPs.

VPNs don't solve every problem, but they're a powerful tool to keep in your tookbox.

There are many many very valuable uses for VPNs some that offer privacy/security benefits and some that are just plain useful. It's wild to hear anyone say that "There is no point to them."

Thank you for saving me the typing.

No it's not gonna make you an invisible unhackable ghost, but at least I don't have to worry about my ISP screwing me over.

Why are you worried about your ISP tracking you but not the VPN company? In effect you've simply added another ISP on top.

Most people can switch VPN companies more easily than they can switch ISPs.

This is the case for me. I _know_ that my ISP is untrustworthy, I've read the ToS.It's also bundled with my apartment and I can't switch.

What I can switch however is what VPS company I use, or what commercial VPN I connect to.

Plus, the harm from being banned by a VPN is a lot lower than an ISP, as low as the chances of either are.

You just replaced ISP tracking with VPN tracking

And your "VPN in YouTube ads" surely does that

Most people who use VPNs for privacy will readily admit that their use is based on relative trust. They know that ISPs are notorious for harvesting and granting access to browsing data, and they trust that their reputable VPN provider of choice is truthful about their logging and internal data handling policies.

There are levels to trustworthiness. I mostly trust my ISP enough to not bother with VPN at home, but when I'm traveling I'll take my VPN provider over a hotel WiFi any day.

> You just replaced ISP tracking with VPN tracking.

Yeah, that's the point. People have infinitely more choices for VPN providers than for ISPs. The VPN provider could be in another country. You can even run your own VPN on hosted infra.

> You can even run your own VPN on hosted infra

True. But we know very few people do that

So now you trust the infra hoster AND their own ISP.

You will always have to trust someone. Having more options when choosing who you trust is a good thing. Does that make sense to you?

> You can even run your own VPN on hosted infra.

This comes with its own risks and you lose some advantages of a commercial service, such as being "lost among the crowd" of other VPN users.

What if you provision a new IP address every other week/month? i.e Assuming the provider allows it and the cost is negligible

If your hosting provider makes similar privacy guarantees to a similar VPN provider, then perhaps. For bonus points, use a hosted VM and commercial VPN in serial.

Again though, if the US Government is a potential adversary, there's still risk here. Intelligence services could have a 0-day on your linux distro, or an operative within the hosting company. If they get access, they can turn your hosted VM against you.

I think you just have to assume there's a possibility that the infrastracture can be compromised at any moment. For both of these two options. Guarantees from providers are valid until the day they are not.

Though a point has to be made about using a hosted VM for VPN purposes, you have some level of control about which specific software, configuration and encryption schemes etc. you want to use for your stack. Only downside is that currently there isn't sufficient hypervisor protection from the host kernel afaik.

However I do agree with you that either way, the risk threshold is too high if you are concerned about high level state actors. Neither commercial VPNs nor hosting providers can solve the "anonymity" problem for you.

I rather have my VPN track me than ISP does. For example, connection to Signal and Kakaotalk servers is used as an evidence of being a member of a terror organisation (!) in Turkey. Evidence is gathered by Ministry of Communications from the ISPs, whom they have to provide real-time connection data to the State including CGNAT records. With a VPN, it is almost impossible (depending on setup, i.e. NAT) to obtain such an evidence - especially for political purposes, even if the VPN provider willingly give logs, no way to prove that info is legit.

I guess it depends who your adversary is. If it's the Turkish government, then you are probably safe to trust a foreign mainstream VPN. If you're trying to avoid scrutiny by a five-eyes western government, you need to be somewhat more careful.

But that’s a general trueism in security. Whether your changes are effective depends on what and whom you’re trying to protect against.

> For example, connection to Signal and Kakaotalk servers is used as an evidence of being a member of a terror organisation (!) in Turkey.

And you are sure your connection to a VPN service won't get you flagged ?

I'm not paranoid, and I have no evidence of anything at all, but it does occur to me that if I ran the US CIA/FBI, I would totally start a company like NordVPN and give them enough money to advertise widely and get sponsor spots on popular YouTube channels.

Sure, you'll probably end up facilitating a few petabytes of copyright infringing torrent traffic every day, but you'll also have a direct connection to countless people who think they're totally anonymous.

> Sure, you'll probably end up facilitating a few petabytes of copyright infringing torrent traffic every day, but you'll also have a direct connection to countless people who think they're totally anonymous.

This is the best part really. No three letter agency is going to spoil their honeypot in order to bust some kid for downloading movies and video games. They've got bigger fish to fry. The more successful they are at keeping their users safe from the copyright goons the more popular and "trustworthy" their little honeypot will seem. Your downloads will still probably earn you another black mark in your dossier, one more thing they could use against you if you ever became a problem for them, but still, free movies, music, and games! Might as well make oppression work for you.

> You just replaced ISP tracking with VPN tracking

Huge benefit in my opinion.

I see a lot more ads for VPNs that I do for ISPs.

You can choose your VPN. Your ISP, not so much. It's also possible to run your own VPN on a public cloud or VPS. You might still need to worry about your provider then, especially if a government might request who is renting the server that is sending certain traffic.

Wouldn't a VPN also prevent traffic sniffing if you're connected via a public wi-fi point?

It would, but that’s already generally impossible thanks to everything being on HTTPS (including DNS).

HTTPS typically still have the site domain in clear due to SNI.

> HTTPS typically still have the site domain in clear due to SNI.

Can you eli5 that please?

https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn...

To support multiple sites per IP the browser has to send DNS name of the site to the web server. Moreover, since certificates that the server uses for encryption depends on the site name, the name cannot be encrypted within HTTPS. So the browser sends the name in clear when initiating the connection. This is called SNI, server-name-identification.

It is possible to encrypt SNI, but most sites do not support that as the setup is non-trivial and error-prone.

Huh

So HTTPS doesn't really stop tracking, it only prevents people from snooping on what data you are sending to and receiving from the website

I use CloudFlare's 1.1.1.1 DNS to mitigate my ISP tracking the domains I visit. They have an iPhone app too. I don't know enough about the space to say whether it's 100% effective.

Again, due to SNI tracking sites that one visits is possible even if DNS traffic is encrypted. At the very least one needs for the site to support ESNI or encrypted-site-name-identification.

But then in practice for ESNI to be effective one needs for the site to use CDN or similar solutions to ensure that there are a lot of sites for the given IP.

There has been some work on encrypted server name indication: https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn...

> And the idea that these so called ‘VPN’ services somehow improve your security and privacy on the internet is laughable

I trust Mullvad more than I trust Optimum.

But the point is you shouldn't trust either of them.

Thing is, if you ping experts in the privacy field (like Mike Bazzell, the former FBI OSINT guy who billionaires and celebs hire to keep their personal info off the internet), they will all say the VPNs are a very important tool to create a layer of privacy between you and the site you are visiting and also a good tool to prevent said sites from easily profiling you. No, they are not a panacea -- much like the security universe, the privacy universe requires lots of other active and passive behavioral and technological changes to properly lock things down to whatever standard you require for your threat model. But they are very much an important tool. For a small subset of people it's literally a tool that protects their life.

So yeah, it's a kinda a big deal if it leaks. (Which is why most privacy experts, were you to tell them you were sufficiently paranoid, would have you fire up a pfSense and link it permanently to a VPN service and then run a separate brand of VPN software on whatever device, so that you have two layers going through two companies.)

> who billionaires and celebs hire to keep their personal info off the internet

I also do this type of work on the side. When it matters a device level VPN is never the correct option, because every OS leaks to some extent. They get a device where the cellular components have been disabled and it can only connect to a fixed wifi AP carried by one of their EP guys that tunnels the traffic back to a datacenter.

> This. And the idea that these so called ‘VPN’ services somehow improve your security and privacy on the internet is laughable.

Actually, they do: Neither your ISP nor the government (assuming the VPN provider is in a "hostile" jurisdiction) can intercept, analyze or modify your Internet traffic when you are using a VPN to mask your Internet access. There have been multiple instances of this in the past [1][2] and ongoing (e.g. DNS [3]), and ISP "middleboxes" have been historically the biggest impediment in rolling out new features.

Ubiquitous HTTPS has shut down a lot of that shit, but until DNS-over-HTTPS becomes actual mainstream DNS (and SSL SNI!) will still leak a lot of information to entities that have a direct financial interest in collecting, packaging and selling this data to advertisers - there is a reason why ISPs oppose any legislation that turns them into "dumb pipes" after all.

Security-wise, at least if you are using any kind of untrusted network (e.g. university campus, public hotspots) a decent VPN software that uses the OS-provided firewall to completely drop any incoming and outgoing packets except for the VPN tunnel connection is also a massive benefit.

The downside of course is that you are now forced to trust the VPN provider instead of the ISP - but at least the VPN provider market is healthy and extremely competitive, which means any sort of shady bullshit would be a virtual death sentence, unlike the ISP market where you are in many cases stuck with one or two options.

Not to forget, VPNs also provide privacy on the "other end": as many providers don't cycle through IP addresses sometimes for months, advertising providers can track your movement across the Internet simply by collecting your origin IP. A good VPN provider regularly changes the origin IP visible to sites you access.

[1] https://www.privateinternetaccess.com/blog/comcast-still-use...

[2] https://labs.ripe.net/author/babak_farrokhi/is-your-isp-hija...

[3] https://www.csoonline.com/article/2953718/t-mobile-caught-in...

> Actually, they do: Neither your ISP nor the government (assuming the VPN provider is in a "hostile" jurisdiction) can intercept, analyze or modify your Internet traffic

No, you're just delegating those capabilities to some completely unregulated random actors instead.

> which means any sort of shady bullshit would be a virtual death sentence

This assumes that their shady bullshit is discovered by someone. I would bet good money that the vast majority of it isn't. They could be sampling traffic and selling it to other companies without modifying it and users would never be any the wiser.

Honestly, I wish we could get past this broken narrative that VPNs are a panacea.

> No, you're just delegating those capabilities to some completely unregulated random actors instead.

It's a question of trust in the end. Telco providers not just in the US but across the Western world have shown time and time again that they cannot be trusted: traffic manipulation, DNS hijacking, selling data to the highest bidder [1], engaging in open corruption to prevent competition, predatory sales tactics, fee scams, peering extortion [2], misappropriating government funds [3] - name the act and you'll find a dominant ISP having done or still doing that practice.

VPN providers generally don't have that baggage attached.

> This assumes that their shady bullshit is discovered by someone. I would bet good money that the vast majority of it isn't.

I agree, but at least the incentives are aligned completely different than with ISPs. The large ISPs can do whatever they want, even breaking the law, because their consumers have no other choice - rural ISPs will get competition from Starlink soon enough, but people in condos? They're stuck with whatever the landlord offers, and the landlord won't care even if there is competition as long as the monopoly ISP pays higher kickbacks.

[1] https://www.ftc.gov/news-events/news/press-releases/2021/10/...

[2] https://www.heise.de/hintergrund/Missing-Link-Regulierer-vs-...

[3] https://eu.jsonline.com/in-depth/news/2021/07/14/weve-spent-...

> Telco providers not just in the US but across the Western world have shown time and time again that they cannot be trusted

This is true, although there's still a very large risk element here. The average person is not likely to be able to safely determine which VPN providers are trustworthy or not. They also aren't likely to understand their limitations, i.e. they don't grant you perfect anonymity, they don't grant you perfect immunity, they may or may not capture the traffic that you intended or thought.

In that case, is it really a good thing for VPN internet provider usage to be on the rise? All we're seemingly doing is handing people more guns to potentially shoot themselves in the foot with.

ISPs, for all of their transgressions, tend to be registered and regulated companies and that makes it much easier to at least find someone to target with legal action if needs be. The bar might be low but there are some standards to which they have to adhere to. Many VPN providers are nameless and faceless "organisations" with little-to-no regulation or responsibility. It's difficult to know if they take your privacy seriously, whether they are taking adequate precautions not to log, to not leak data or to adequately secure their systems.

Hell, it's entirely possible that your VPN provider is actually just an FBI honeypot on the lookout for people who are only actually using a VPN service because they have something to hide. How would you tell if they were?

I just don't really buy the argument that having different incentives means they are any less likely to be nefarious or negligent.

> Neither your ISP nor the government (assuming the VPN provider is in a "hostile" jurisdiction) can intercept, analyze or modify your Internet traffic when you are using a VPN to mask your Internet access.

This is exactly the problem with VPNs, they give you a false sense of security. When your traffic goes over the public internet, you should assume everyone and their grandmother can track it. So the traffic cannot be intercepted at your ISP, that only leaves a billion other places where it can be intercepted.

> The downside of course is that you are now forced to trust the VPN provider instead of the ISP

No. The point is neither should be trusted.

> There is no point to them.

There might be no point to their security and privacy, but they are still good for getting foreign-country Netflix.

In the UK if you download a TV show or other copyrighted material without a VPN, you can get a letter from your ISP as a warning together with a list of the content you've downloaded, and they may terminate your service if you continue.

A VPN solves this, and does protect your privacy, so your comment is just needless hyperbole.

You're paying to insert a potential man-in-the-middle attack. That's got to be worth something.

That would be true if we didn't have regional content blocking, location tracking and general surveillance by supposedly democratic states.

I recommend VPN services in regions where legislation of your home country might difficulties getting data.

i will have agree with your definition, but the issue here isn't with the nomenclature, it's with the bill of goods being sold as a service.

what people expect, and what is being sold, is an encrypted tunnel that all traffic goes through, to an endpoint. That this is called "VPN" is irrelevant.

I have a GL-iNet Mango that i have setup to provide "always on wireguard" to a computer in a datacenter i control the public IP for. I haven't tested, but i expect all data sent to and from any devices connected to that Device's SSID to be tunneled via wireguard to the computer in the DC, and therefore, to all outside observers the DC is where my device is. Obviously the ISP can see the session, but since they have no say over the DC endpoint, they have no way of knowing what the traffic is or where it's going. It could just be me doing SSH or video streaming or backups to and from the datacenter, or i could be watching netflix or youtube.

In that circumstance, an iOS device shouldn't be able to leak my local network's ostensible "public IP", since the actual transport layer is outside of the iOS device's control.

With all of this being said, i don't think there's any way to guarantee that leaks are impossible without literally air-gapping your devices and forcing all traffic through something that cannot communicate with anything but the remote endpoint - that is, if the wireguard connection fails, all pings fail, all TCP/UDP/etc traffic times out, and so on. In this manner, probably all things sold as "secure VPN" or as a service that does that are scams. This is the issue that TFA is complaining about.

in a situation where it's life and death - i would find an open wifi access point and connect a wireless bridge device (e.g. tp link TL-WR802N), with an STP ethernet cable to something similar to the gl-iNET mango, with 100% forced wireguard connectivity. I'd only consider this viable after doing tshark or tcpdump on the server i control log access to, to verify that my (local) MAC address and/or stuff like webrtc or whatever are blocked/dropped.

sorry for the length, but i didn't want to make multiple comments all over the threads.

I'm not sure what your point is here?

To be clear, is what you're saying that it is ok for VPNs to be broken (or at least less bad) because their most popular usage isn't what they were originally intended for?

If that wasn't your point, what was?

I don't like how the word "proxy" got replaced with "VPN" either, but I think it was to create a distinction between the per-connection, often single-protocol nature of proxies (HTTP/HTTPS/SOCKS) and something that acts like a whole (virtual) network interface.

Maybe that wasn't the original intent, but it's a designed and supported configuration. Many places don't want a fleet of Windows laptops to become network bridges to their intranet. The default configuration for most VPN setups is to route all traffic. If you want to selectively route traffic, you have to specifically set up a split tunnel.

While you could only route client traffic to an intranet endpoint and prevent access to any external services, that wouldn't be very practical in most deployments so a proxy is added on top. This type of deployment is common and has been used for decades.

We should start calling them vISP or something.

'VPN' is just a nickname for secure tunnels. These can be used for many different purposes.

That's the Apple Way though isn't it? Apple says "Do it exactly how we tell you" and you shouldn't expect anything to work if you deviate from the One True Path that Apple has laid out for you. "Think Different, Do As You're Told"

Oh, come on. This is an utterly lazy argument and it adds absolutely nothing useful to the discussion.

Is Apple responsible for the false advertising of other companies?

I hope Wireguard makes it into iOS/macOS at some point. Still early days relative to other protocols of course but it's so much simpler and more reliable (even beyond the security benefits). I use it extensively on both platforms for access to my own networks and services nowadays.

It already exists in the App Store. I've been using it since April 28th of this year.

ios/ipad: https://apps.apple.com/us/app/wireguard/id1441195209

macos: https://apps.apple.com/us/app/wireguard/id1451685025

WireGuard is already available on both platforms - or do you mean kernel space WireGuard without an additional app?

Fwiw the existing app integrates seamlessly into the apple ecosystem.

I think the OP means so that it can be used without an app and so it can be used with Apple's "Always On VPN" setup. Right now I believe "Always On VPN" only works with the OS supported VPNs: IKEv2, L2TP, SSL VPN, and Cisco IPSEC https://support.apple.com/guide/deployment/vpn-overview-depa...

Nope, there are a ton of 3rd party SSL/other VPN clients that use the same frameworks that can be set to always on - the app just has to be written that way.

Consumer VPNs typically aren't.

My mistake! The docs I linked weren't clear about it.

The WireGuard app works with always on.

It already is? It's been around for ages now and had a lot of eyes over it, but more importantly users. It's being used in a lot of services that are in production and turning over nicely. I think the 'early days' can be put to bed now, it's mature from a security perpective (imho).

Here's one of those occasions where Linux mobile is shining, Wireguard(kernel) works OOB in Mobian, Requires custom kernel in postmarketOS due to Alpine quirk.

Considering the added benefits of taking your other desktop Linux security configuration to mobile, A Linux mobile could be a viable choice for those who need reliable transparent security.

Seems targeted at Enterprise customers, not your average consumer.

Kind of a big deal that likely 90%+ of iOS VPN app users assume they're private when they're not. False advertising IMO, and Apple is getting their 30%.

I use perfect privacy and they provide IPSec configs for iOS. Their guide even makes note to enable on-demand to prevent leaks.

Also, just checked Mullvad, which seems to open an IPSec server on your local device and then install a vpn config on your ios device. From the local IPSec server a connection is made to mullvad via wireguard. On-demand is also enabled by default.

But yea, VPN were initially targeted at enterprises anyway. So I don’t mind that i actually have to install vpn profiles by hand.

what is the point of wrapping wireguard with ipsec? bet-hedging?

iOS has no native wireguard support

The issue in the article isn't that the VPN is sometimes inactive, it's that when the VPN is active, some traffic escapes the VPN.

As far as I can see the linked page doesn't say that your VPN will leak unless you're using Always On.

Plus, that page documents the VPN features built in to iOS itself, not VPNs provided by apps.

The ProtonMail article said it only applies to pre-existing connections, because iOS doesn't force them to close when an app enables its VPN. I'd be reluctant to call that a leak, unless it contradicts Apple's documented behaviors, which as far as I can tell make no mention of a systemwide VPN except for corporate "always on" ones. Besides, is there any reason why you can't just toggle airplane after enabling a consumer VPN to kill off the old connections? Then it should probably be fine.

That's a clever thought. Do you know whether connections could be established outside the tunnel after you disable airplane mode but before the tunnel is re-established?

If that were possible then ProtonMail would have certainly said so, since that'd garner serious attention. In any case, the functionality as a whole isn't documented, so even if it works, Apple could theoretically take it away just like that. That of course doesn't mean we shouldn't rely on it, since if the only other option is a corpnet we're left with little other choice. I have the same problem with Apple because I depend on static binaries. Under the Apple regime, they too have an uncertain future and only continue to exist at Apple's pleasure. It's discomforting but not the end of the world.

According to the author, IOS makes new connections outside of the tunnel after the VPN was enable. There is no effective workaround.

> toggle airplane after enabling a consumer VPN to kill off the old connections?

That's discussed in the article.

Lockdown mode on iOS for high security will prohibit the use of provisioning profiles.

Configuration profiles, not provisioning profiles. That just means you install them before locking it down.

Also, the supervision requirement for always on VPN is a stronger limitation than lockdown mode; you have to erase the phone to supervise it.

Ahh thanks for the clarification, I didn't know there was a difference.

Configuration profiles are however how you force DoH or disable certain privacy leaks from phoning home to Apple. There are no UI settings for some of the important ones.

That's not what transparent means.

That is pretty user hostile it seems.

Title should be: "VPNs on iOS are a scam", but a less sensationalist title might be: "VPNs on iOS leak traffic".

True. I’ve used VPN on iOS to play a second account on some online game. Worked like a charm, so it was definitely NOT a scam. If I wanted to hide my activity / identity from more serious people - I would never use iOS in the first place.

But it’s good to know that there are leaks, anyway.

PS. And I guess all VPNs use the same base VPN functionality provided by iOS, so “is” looks a bit more appropriate than “scam”.

It's not even the VPNs that leak, it's the Apple VPN implementation that does.

Serious q, do other implementations exist that I can use on an iOS device?

"Apple's VPN Implementation Leaks Traffic"

If only you could easily print out the routing table and/or modify it so you could direct the traffic exactly where you want it (i.e. stuff it all through the VPN tunnel)...

...and that's when you realise that trying to configure a device to which you do not actually have full control of is a futile endeavour.

As such, in agreement with many of the others here, I don't consider this much of a bug nor a "scam". It's merely an effect of what VPNs are (an additional network interface) and how routing works, combined with a device whose manufacturer deliberately does not want to put users in full control of the routing table.

I'd approach this from the router.

If you give the device a static DHCP lease, then you can block it from 0.0.0.0 and allow it to your VPN provider's IP blocks.

You might want to give the device its own WiFi network if you don't trust it to honour DHCP

This should trend to the top of HN. Apple bills themselves as a privacy-centric company. I hope they clean this up asap.

iOS devices create lot of weird traffic on local network. And the only meanigful-ish other packet trace seems like APNS subscription update and some kind of iCloud traffic, there is probably zero reason why would you want that to go through “VPN” tunnel.

There are times when it might be useful to separate out different types of traffic to separate interfaces. I kind of wish there was an easy way to set rules like "Anything I do over these applications should go through the VPN, some of the random traffic my OS constantly spews in the background should be sent through the unsecured connection, but anything going out to these networks should just be blackholed" but I haven't come across one.

It is clear that Apple’s privacy efforts are only aimed at privacy for you from organisations that aren’t Apple.

Apple doesn’t really care about preserving your privacy from Apple (and by extension the FBI).

They maintain backdoors in iMessage specifically to preserve the ability of Apple/FBI to read your messages:

https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

The fact that Apple OSes leak your true IP (and thus city-level location) to Apple around your VPN is not an issue to Apple; it may even be intentionally preserved this way to aid investigations.

Marketing is king. Any one's guess what Apple cares about most.

I think that the value of this article is perfectly summarized by the sentence “Not sure what SYN is.”

are you saying that a packet leaving iOS and hitting the router's logs, without going through the "VPN" does not leak either your IP to the destination or your destination to your ISP?

I think he’s saying that any sort of network analysis done by someone that doesn’t understand basics of TCP is kinda suspect and may be more prone to errors in the analysis methodology or interpretation of results.

I tend to agree. My only takeaway after seeing that was “if I ever need a 100% leak free tunnel on iOS, validate it”. I certainly won’t be taking any of this at face value without replicating it.

the local router shouldn't see any other connections inbound or outbound from the device other than the "VPN" ip you are connected to. I submit that it doesn't take an expert to come to that conclusion. Other comments in this thread explain that the iOS/MacOS kernel keep old established routing tables intact under some circumstances, and that's (one) issue. Another appears to be the unreliability or inconsistency of "airplane mode" and invalid assumptions about that.

> I submit that it doesn't take an expert to come to that conclusion.

Probably not, but if, in the middle of trying to diagnose my car, someone pointed to the muffler and said "I'm not sure what this thing's for." I probably would look for a second opinion on their diagnosis especially if it was "there is a major manufacturing defect in this model of automobile". It doesn't matter if the problem looked like it was staring us in the face.

Obviously I can't spot any major flaws with what the writer put together after a single read or I'd be pointing them out. I'm not calling it wrong. I'm just saying I'd want more verification from someone that has a better understanding of networking concepts to make it less likely that basic mistakes impacted the outcome.

If the write-up has given you enough confidence, all the power to you.

Typically, but it does not summarize this content. The author repeatedly says he doesn’t know much about most of all the things but he also knows he can test things out by just watching the activity in his router logs. And, it’s not good.

It's also worth pointing out that tethered/hotspot data shared to the iPhone with a VPN enabled at the iPhone level will not travel through the VPN, but will rather leak your phone's IP: https://apple.stackexchange.com/questions/266871/is-there-a-...

That seems like expected behavior, or at least one worth testing with an IP checker or something on the tethered device. I would be pretty surprised if I connected to a VPN on my mobile device, then tethered to it, and my traffic went over the VPN tunnel. I would just establish a VPN tunnel on the tethered device if I wanted that.

I think the average user would not expect that!

average user here

i would not expect it to work like that

i’d think my traffic is protected, why protect it twice

The problem is for tethered devices that don't support VPN software, like video game consoles.

this happens with android too. Which sucks. Although it is possible with root, which shows the benefit of having full control over your device

Just like iOS, you can do the same with managed device.

do you have more info on this? all the sources I've seen online say it's impossible

Android has an option to allow tethered devices to use the VPN, and it works fine on my phone.

what's the setting called?

That's a LineageOS customization, as far as I know.

Airplane Mode used to be a true “all wireless disabled” mode, but Apple have relaxed it a bit over time, possibly because it's so frequently used and there are so many services provided by WiFi and Bluetooth now that aren't related to the Internet (e.g. connecting to AirPods or an Apple Watch). They also relaxed what turning off WiFi and Bluetooth in the Control Center (separately from Airplane Mode) do, so that things like AirDrop still work. But I think the options in the Settings app are still meant to truly turn off wireless, rather than just mostly?

Also: if Settings says you're connected to a WiFi network, but you don't see a WiFi icon at the top of the screen, I think that means there's no working Internet connection.

I think airplane mode is intended to comply with the rules for using the device on an airplane. That used to be no radios whatsoever (and device turned off during takeoff and landing).

The rules on aircraft changed, so the feature was updated.

I suspect they wanted the feature changed because it gives them better data when tracking you and other nearby devices and that once the rules for airlines changed they figured they could get away with giving users a false sense of security, which is why the feature is still called "airplane mode" which the public understands to mean everything is disconnected even though that's no longer the case.

I'm glad I'm not this paranoid

I think of it more as cynicism. I don't assume corporations act with our best interests in mind. I assume they will do whatever makes them the most money. Companies make a lot of money using the radios in our devices to track us.

I’m pretty sure “the public” knows that the giant blue (not gray) wifi icon and bluetooth icon in control center means wifi and bluetooth are still working when you press the airplane icon.

> Also: if Settings says you're connected to a WiFi network, but you don't see a WiFi icon at the top of the screen, I think that means there's no working Internet connection.

Yup.

Technically imperfect and “a scam” are very different things

The article is really good and informative, but that title man.. I almost didn't click and read it because of it

I wonder if the author tried using an On Demand VPN rule for the default route. That's always what I've done when setting this stuff up. Correct me if I'm wrong, but you don't need a device management profile to enable an on-demand VPN for all traffic. Then, reboot your phone and all application traffic, or traffic that isn't something system (APNS) or management/link-local (dhcp, mdns, etc.) will use the tunnel.

APNS client cert is linked to your hardware serial, so by linking all your non-VPN client IPs together by serial, Apple gets your travel history due to city-level client IP geolocation.

Enough points (APNS is always connected, so whenever your phone is on) and this uniquely identifies you (even if the serial number wasn’t bought with your own credit card).

Then they have to give it to DHS/ICE/FBI/CIA without a warrant on demand, thanks to FAA702.

They, of course, already have all of the cell tower association records, as well as all of the Secure Flight program data from the TSA. It’s not a difficult query to figure out which serial numbers are which IMEIs are which humans.

No I agree on the it's not good that APNS is an exception. I suspect that it's something technical like in order to receive push data in low power states, since the kernel isn't awake, userspace VPN is not involved. In an ideal world you'd be able to choose whether you wanted to spend a little extra battery to bump into a higher power state so that this information didn't leak.

Device-level VPNs are very useful for bypassing geographic restrictions, but I wouldn’t rely on them for hiding traffic from ISPs, unless you are in control of 100% of what your device does.

how good is wireguard at controlling this?

WireGuard can be used as a VPN (L3 transport) but it cannot address the shortcomings of an OS' implementation of the VPN APIs.

mac/iOS still needs to do subnet local stuff like renew the DHCP lease and discover other link-local devices using mDNS/Bonjour. The system also periodically makes sure interfaces are “up” so it can seamlessly route traffic between cell and wifi. I would not assume that the presence of traffic where DST != VPN tunnel endpoint means that application traffic is leaking over the VPN. I only skimmed the article so someone correct me if there was a case of that observed. The “bug” where existing connections aren't terminated when you bring a VPN up sounds annoying but I can also see why the system wouldn't force terminate existing connections. The connection to the router’s public IP sounds like a hairpin. I also wouldn't be surprised if user-space VPN is outside of the scope of the APNS connection that the system maintains through sleep states.

I don’t care for VPNs but I do want an adblocker. What are my options aside from using a public pihole dns or a vpn to a private dns server?

Firefox Focus then in Settings > Safari enable it as a content blocker

Ad blocking is entirely possible. Safari supports ad blocking natively. OS-level blocking can be achieved via a DNS filter which can be run on-device. I use AdGuard Pro to do both:

https://adguard.com/en/adguard-ios-pro/overview.html

But other choices are available too.

Tailscale + Pihole works well,

https://tailscale.com/kb/1114/pi-hole/

I use this setup to get mobile adblock while on Verizon (iOS sadly has never let you override the default DNS server for cellular, just wifi). It works more or less perfectly, albeit with a noticeable hit to device battery life... so much so my wife who otherwise loves PiHole on the home network refuses to use it on her iPhone.

Using iOS's built in support for browser adblockers is largely as effective and doesn't come with the battery life hit.

You can use your custom dns over https server You can use AdGuard or select your own filterlists. Nextdns.io

I use the free tier.

Im assuming this is using a custom iOS device provisioning profile to let you set your DNS for cellular in a way the UI does not? If so, interesting solution!

Does the built in blocker block ads outside of the browser though?

No, that is one advantage of the PiHole/Tailscale setup, although PiHole wont prevent ads particularly well if at all in major apps like Twitter/FB/youtube etc.

NextDNS.io

I like AdGuard

I’ve been using nextdns for two years. Can’t live without it now.

DNSCloak, and add your own rules.

Most of what you see is probably Apple bypassing all VPNs to talk to their own servers.

There are more serious problems though, with any app being able to bypass VPN simply by prohibiting Wi-Fi interface and iOS gladly letting all traffic via LTE, unfiltered. That's been described in https://blog.disconnect.me/ios-vpn-leak-advisory/.

It's well known and pretty sad that these issues go unaddressed for years. VPN developers have little power to change that given that VPN apps run in a walled garden of Apple in a sandboxed environment. Hence the the best effort at this point with a hope that this can addressed in the coming updates.

It would be great if more of these pop up on Apple forums and Apple Feedback with people demanding improvements on transparency and privacy from the company.

So far reading your blog post looks like a recollection of what's been going on.

I really wanna throw an analogy of a bear waking up from hibernation. This is not sensational and just reiterates what's been said before you, yet the title throws a shadow at VPNs just to sound like it.

Does the property "includeAllNetworks" [1] provided by Apple's VPN API not work, or do all VPNs currently rely on the default value (false)?

[1] https://developer.apple.com/documentation/networkextension/n...

Would be nice if someone who actually knows what he’s doing looked into this. This guy might be on to something or he might be creating a whole lot of drama about nothing.

For sure. I appreciate when someone admits they don't know something, because that is honest. But OTOH, there was a fair amount of "I don't know why this does what it does" in this blog post. I'd like to see this same topic worked up by someone with more knowledge.

He's on to something. For months I carried iOS devices only without sim cards and used an external VPN router with LTE.

Agreed with most comments here, the implementation is leaky as heck. It’s a ‘best efforts’ VPN service at best and you can tell this especially when in a mall and there’s a walled garden in place. I use iVPN and regularly have to disable wireguard to pass the walled garden to then also regenerate a certificate. Enabling VPN through the iVPN app is hit and miss, likely because Apple have decided to do their own thing and implement ‘Private relay’ instead.

Yeh… Apple, Five Eyes, Privacy is all pretty much an illusion when you have this many devices in this many pockets. Whatever it is, vpn’s or end to end encryption, it’s all really only as secure as the touch screen controller telemetry logs.

VPNs in general are a scam.

To be clear, I mean the big VPNs that advertise themselves as helping with privacy are actually a scam.

There are obviously some situations and use-cases where using a VPN makes sense (e.g. geo-shifting), but as a general solution for privacy on the internet they make no sense.

Until browsers become more fingerprint resistant, there is zero privacy online. Firefox is making good strides but even with all settings turned to the max (including the about:config settings for fingerprint resisting) it is still able to be fingerprinted by the tools online used to check for this.

Not to be pedantic, but UDP is connectionless.

Also, regarding the UDP datagrams seen after the IKE exchange, maybe relayed to NAT-T?

https://en.wikipedia.org/wiki/NAT_traversal#IPsec

"Data is leaving my iPad and not traveling through the VPN tunnel."

It is is interesting how the iPad purchaser refers to "my iPad". He owns the computer. But how much control does he have over it. He runs an OS controlled by a HW manufacturer turned trillion dollar tracking and data collection company. (Apple computers are extremely chatty on any network and phone home 24/7. Apple is fervent about its need to collect and store data from purchasers.^1) As such, he cannot find the problem in the iOS source code, remove the phone home "features", re-compile and reinstall it. The best he can do is complain to the internet.

I have owned various Apple computers over the years, including an iPad. However I never used any Apple computer with an Apple OS for internet use.^1 I only connect them to the LAN. I just think there are better OS, namely ones I can edit, to use for internet-facing computers. For internet usage, I like OS where I can control the routing table. Since I started keeping these computers running "consumer OS" off the internet in the 2000s, the internet has become a vector for pervasive surveillance. I treat computers running Windows the same way. No direct internet access.

In the 1990s/2000s I can recall the "experts" advising against leaving computers connected to the internet when not in use. Today, "tech" companies try to compel people to leave their computers connected 24/7. Not to mention "experts" who believe this is justified because "automatic updates". Granting 24h remote access to unknown people to install software on computers that do not belong to them. Some people call this a "botnet". I do not care for broken software that continually needs fixing. But as the author alludes to when he quotes Steve Gibson, iOS is never broken, it just has not been fixed yet.

1. Today's Apple computers require some connection in the beginning to "sign-up", "register", download "approved" software, etc.

2. Apple computers owned by employers excluded. Also excluded are older Apple computers on which I ran NetBSD.

> In the 1990s/2000s I can recall the "experts" advising against leaving computers connected to the internet when not in use. Today, "tech" companies try to compel people to leave their computers connected 24/7.

There is a lot of wisdom we've thrown away from those days. Software phoning home was viewed as malicious and there were lists of applications that did it to shame companies and warn others to stay away. Pretty much every OS and major application today would rightly have been considered Spyware.

If we'd kept "Never use your real name/info on the internet" the world would be a better place. The rule allowed for E-commerce so we'd still have amazon, but facebook and all its problems wouldn't exist.

Pop-ups were considered evil, and we fought to stamp them out but today the same annoyance is commonplace and accepted, they just show up as modal windows and cookie banner notices.

https://knowyourmeme.com/memes/we-should-improve-society-som...

This comment is a gish-gallop RMS-y soapboxing which is largely irrelevant-to-the-article points: that iPads (possibly all iOS devices) only pass some of their traffic over a VPN connection.

You can't see how fully controlling the device is required to even be sure VPN works.

This stuff is up to whoever has root on your device, be it Apple or eg. bad guy exploiting 0day in captive portal, but certainly not you.

> Today's Apple computers require some connection in the beginning to "sign-up", "register", download "approved" software, etc.

I believe that is not the case. It is strongly suggested during the sign-up process, and some functionality depends on it, but it is not required, as far as I know.

I use VPNs to access region-restricted content (mostly to pretend I’m in the USA) and not for the privacy aspects, so VPNs aren’t really a ‘scam’.

Can someone clarify this better than the author?

Trying to read through the whole thing, I can't tell if if this is claiming:

a) When a VPN is activated, pre-existing connections will continue communicating outside the VPN, but all new connections happen via the VPN

b) Apple services like the app store and/or certain other apps leak outside the VPN because of a) more than you would expect

c) Apple services like the app store and/or certain other apps leak outside the VPN for other reasons totally unrelated to a)

The author's tl;dr just says "data leaks" but I really just can't follow what that actually means.

It seems like a) is not entirely unexpected or necessarily a problem -- you probably turn on a VPN before initiating activities/apps you want routed through the VPN, so not usually problematic? But b) means it might be more serious than that, while c) would be even scarier?

Apple iOS and macOS maintain OS-level connections to Apple (using hardware serial number linked certificates) for notifications.

This means the Apple APNS client IP logs relate directly to your tracking serials and both your VPN and non-VPN ids, linking them.

They also contain your non-VPN IP history, which is your travel history, as client IP is city level geolocation.

https://m.youtube.com/watch?v=tL8_caB35Pg

Modern oses/devices are so complex and out of specs nowdays that my only solution is to use a vpned gateway, router, access point.

The real lesson is here:

> I am not a fan of making a VPN connection on your only router, but suggest having a second router dedicated to VPN connections. When you need a VPN, connect to the second router (Wi-Fi or Ethernet), when you don't need a VPN, connect to your main router.

Aka, don't use a device with two network sockets if it is critically important to avoid using one of them.

...and then there is the Apple Watch which doesn't support VPN's as far as i know.

So, when apps can communicate from iPhone->Watch, even with a perfectly functioning VPN on the iPhone your public IP can leak via the Watch (if the app is also installed on the Watch.)

Is Android better in this regard?

Not really, no. Ref: https://github.com/celzero/rethink-app/issues/224

Yeah, though apps can whitelist themselves to exclude from VPN routing.

I'm on a VPN... and can't read that article.

I'm on a VPN and can read this article, but there are more and more websites lately that appear to be blocking VPNs.

There's lots of reasons to use a VPN besides 'privacy'.

The vast majority of people use them for IP spoofing.

IP spoofing is privacy of their real IP.

By "IP spoofing" I mean getting around range IP bans. It's not for privacy reasons.

The author put together "A Defensive Computing Checklist"

Site: https://defensivecomputingchecklist.com/

Discussion: https://news.ycombinator.com/item?id=32490866

Need to give the article author a lot of slack! If you are here, please read some more about networking :-).

Networking is dynamic it takes many sequential steps to configure. There is no ZAP, it is done. I don't know of an OS that locks out "user programs" until configuration is complete. Yeah, since networking is dynamic that could never work -- "user programs" would be locked out forever!

At the start of the First Test there are packets going to non-tunnel locations at the same time the VPN is being set up, not a surprise. Packet ordering / routing at this time granularity is also not surprising.

Need to take a moment to review the "drop everything" when a VPN is up standpoint. OS Networking stacks don't really understand what a VPN is, it is just an endpoint to route packets. A TCP connection has internal state that is bound to the addresses that were used when it was set up - which is tied to the state of the routing table. A new point-to-point endpoint, like a VPN would invalidate that state. Most (many?) TCP/IP stacks keep a cache of the initial route on the socket. As long as that is still valid (or updated), that is where the packets go. Killing TCP connections for every (temporary) network flap would make a lot more people MAD.

The "DNS" to NextDNS with DoH connection is interesting. This 100% isn't coming from iOS itself. It doesn't support it. So it must be coming from an App. But what app and how? There is a NextDNS app which up front claims "Encrypt all DNS queries on all networks with the official NextDNS app for iOS". The author does appear to have configured the router to use NextDNS, perhaps they also have that App installed as well and it is also hijacking networking to do DNS? A dunno.

The "flood stuff" is interesting, but I think it might just be an attempt to perform STUN to make sure UPD traffic can be transported - to Apple endpoints. I think "second test" is the same thing happening again.

So what is left is the traffic being sent to apple endpoints. Now I wonder how the VPNs the author is using are implemented. The Big Sur VPN brouhaha was because apps were trying to implement a VPN using NEFilterDataProvider instead of a "tun" interface and routing. I wonder if this is just the same issue but on iOS.

Not related, but I do wonder what these VPN services offer in terms of "Firewall" protection or if when you use them ALL ports are forwarded to your device. This would make all of their endpoints a "great target" for continuous scanning for getting inside a network if the VPN user had something misconfigured, like say an experimental Apache, Nginx, PHP, Rails, Django, MySQL project. Doh. Methinks I should spend some currency and experiment. Sadly black-hats are probably already doing this.

I think the analysis has some good points, but the author is lacking a bit of networking skills, so I’m not sure how trustworthy this can be. Two yellow flags:

* vpn gateway address can be different from public vpn exit address. What is the surprising part?

* I don’t know what pings your “uncloaked” public ip address, but still, when using a vpn, you’re using your own ip address to connect to the gateway. So, there’s no real leak - it would be a leak if some packets went _through the vpn_ to 99.99.99.99, because an observer could spot the strange ip and determine it’s the uncloaked source address.

Anyway: who can tell what an iphone or ipad can do? You probably have an associated apple account, et cetera. If you trust such a device for total anonymity, you’re doing it wrong from the start. Pick a Linux laptop for that.

> If you trust such a device for total anonymity, you’re doing it wrong from the start.

I think it greatly depends on your threat level and who you're hiding from.

Which is what they said with ‚total anonymity‘

This how routing behavior has been on Mac OS for about 15 years now.

Mac OS route selection always takes into account the source address of the IP packet in addition to the routes in the routing table.

If a socket binds to a particular address, the Mac OS kernel will choose routes associated with the interface that address is on and ignore the others.

thankfully Windows does not do this. if i set interface metrics manually, and a lower metric interface becomes connected, all external traffic will immediately go through the new interface. Likewise, if i switch between wifi and cellular on an android device, all existing connections stop and must be refreshed. to wit, on both windows and android, youtube videos will continue to play, but things like HN or reddit will stop loading until whichever connection takes precedence comes fully up.

I would argue that's the only "sane" way to do it, but then again i'm no network engineer. I just rely on my devices to work this way so i don't saturate the wrong links or get poor upload speeds when i need them.

> Likewise, if i switch between wifi and cellular on an android device...

On an Android (like on iOS), both WiFi and Cellular interfaces can be active at once. Apps (with appropriate permission) are free to bind to either.

> ...all existing connections stop and must be refreshed.

On network changes (in particular address changes), TCP connectivity may break. SCTP / QUIC / UDP (and UDP-based protocols like WireGuard and MoSH) should continue to work just fine.

I remember recently using Cloudflare Warp and using one of those webpages that tell you your IP address and it showed my real IP address. It was a bit weird.

Warp is not designed to hide your address. If website is behind cloudflare, it'll know your IP address. If website is not behind cloudflare, your address will not be available.

There was some communication (forum,discord) that this would change in the future. Apparently the plan was or is to hide the IP from pages on Cloudflare as well. But no idea if that’s implemented yet.

That doesn’t sound right.

https://blog.cloudflare.com/warp-for-desktop/

> WARP was built on the philosophy that even people who don’t know what “VPN” stands for should be able to still easily get the protection a VPN offers.

Crazy that cloudflare's marketing wouldn't be entirely forthcoming.

> From a technical perspective, WARP is a VPN. But it is designed for a very different audience than a traditional VPN. WARP is not designed to allow you to access geo-restricted content when you’re traveling. It will not hide your IP address from the websites you visit. If you’re looking for that kind of high-security protection then a traditional VPN or a service like Tor are likely better choices for you.

See: https://blog.cloudflare.com/announcing-warp-plus/

"get the protection a VPN offers" seems like poor wording, then.

So it's a VPN but it doesn't do anything that you expect from a VPN? It doesn't let me access devices in a LAN, it doesn't hide my IP, it doesn't change my country... then what is Warp good for?

It protects you from your local network and ISP, and makes some websites faster.

Is the page not clear about that?

Wow, that is really shady.

If you have the paid version you get anonymous IP, otherwise it uses you own IP. I use their own speed test page to check my IP and location of the cloudflare server I'm using. https://speed.cloudflare.com/

I downloaded that recently to check it out and it crippled my 5G speeds too.

The iPhone was never made to be truly secure, so this is to be expected I suppose.

Reply on news.ycombinator.com