Hacker News Reader

Comment by supriyo-biswas | Hacker News Reader

A VPN that only works with Safari and apps using the native HTTP libraries to make unencrypted HTTP requests.

It's a whitelist of apps that are tunnelled through the relay, but apps don't have to use any sort of special networking library, pure Berkley sockets work just fine through the relay. Also, anything that attempts to use port 80 goes through the relay, it doesn't have to be HTTP, as I said, plain BSD sockets work.

This whitelist is implemented using the regular macOS/iOS per-app firewall. Not only this is accessible to users, but the whitelist matches based on the Mach-O UUID, which is an arbitrary number put in by the linker...

The restriction on which apps can use iCloud Private Relay is trivially defeatable.

Do you have a citation for this? That is not my experience. With iCloud Relay enabled, all outgoing traffic seems to go through the relay.

From iOS Settings App:

Private Relay hides your IP address and browsing activity in Safari and protects your unencrypted internet traffic so that no one-including Apple-can see both who you are and what sites you're visiting

Encrypted safari traffic goes through the relay.

Encrypted safari traffic is an exception. But encrypted app traffic does not.

They made it a few years ago they all apps had to use encryption. Long before private relay came out. I have wondered if this was why.

Agreed, we can only speculate; personally I would be surprised if that was the "long-term" plan instead of just a push at the time to enforce industry best practices on its apps. My hunch would be such a move might be disruptive to certain apps (banking?) and they are allowing more time before tunneling everything, but this is just a guess.

See my other comment about how iCloud Private Relay works. There are basically almost no security measures that prevent you from using it with other apps. This leads me to speculate that Apple intends to eventually enable this globally, so they don't really bother now with trying to lock it down too much.

Reply on news.ycombinator.com