Some European carriers are already blocking Apple’s Private Relay | Hacker News Reader

Some European carriers are already blocking Apple’s Private Relay

9to5mac.com

40 pointsrcarmo18 comments

> Your cellular plan doesn't support iCloud Private Relay.

If I understand correctly, there's no special "support" required from an ISP for Private Relay - they just have to be a dumb pipe. So wouldn't it be more accurate to say "you cellular plan is actively blocking Private Relay"?

I'd expect that kind of deceptive phrasing from the phone carriers, not, in this case, Apple, who has no interest in covering for the carriers.

Apple cooperated with AT&T's bullshit "5Ge" rebrand where they change the LTE status icon to "5Ge". Despite the appearances, Apple is absolutely in bed with the carriers.

As did nearly every other vendor

Pretty much "every other vendor" has a legitimate reason; they have little to no distribution network and rely on carriers to sell their devices. That's not the case for Apple who has both a decent network of Apple Stores around the country and sufficient brand loyalty to survive (and potentially even thrive) even if their devices become more difficult to buy.

If everyone else does that rebrand except them, they look like they're a generation behind on networking tech. They don't want to take that hit, or pay for the consumer education campaign to avoid it.

I don't have an opinion about whether that's more or less legitimate than anyone else's reason but the incentives seem clear to me.

But not on this private relay feature, apparently.

That is precisely the problem here. Phone carriers do not want to be a dumb pipe - and having Private Relay go through their networks breaks:

- HTTP header enrichment (which they use for self-care/customer sites/services),

- zero rating (which they set up deals for with social networks, music streaming services, etc., often applying specific QoS tags) and

- all sorts of value added services (many using deep packet inspection and DNS analytics) that they offer instead of raw, unfettered connectivity.

I don't think many people are aware of exactly how much data telcos are sitting on, anonymized or not.

And, of course, it also plays havoc with legal interception because there is no easy way to do MITM.

(edit: readability)

My understanding is that private relay only (for now) relays plain HTTP content from apps, and HTTP+HTTPS content from Safari.

This means it likely shouldn't (currently) affect zero rating for apps, though it would affect header enrichment for first-party web based services. A native app shouldn't be affected, and given most services run on HTTPS, they won't be able to add headers to those requests anyway.

The impact of losing visibility of plain HTTP is likely minimal given how much is HTTPS now. The impact of losing visibility of sites visited and DNS queries may impact on carrier 'value add' services like internet filter, malware protection, etc.

Also it would be harder to link location based services in for web-based content, as they can't correlate the browsing session with the phone user.

If Apple was to expand this to cover HTTPS traffic via apps, that would break a lot more. Carriers are desperately clinging to ways not to become dumb pipes, so it doesn't surprise me to see them resist these moves.

Private relay is still in beta, Apple can fight with carriers after they properly launch the product.

There's two angles here which might make a difference in the legality of it:

a) Apple turns it off on behalf of the carrier -> Apple is free not to offer this feature to you

b) The carrier is blocking it without help from Apple -> The carrier is limiting what you can connect to

The latter might be a breach of contract / telco laws (e.g. net neutrality) - depending on your jurisdiction / local laws.

The carrier just needs to block a few domains and the relay will disable (and the phone or Mac will notify the user)

I wonder: is this using an entitlement check like for mobile hotspot/WiFi Calling enablement, or is this using the DNS blocking method[1]?

[1] - https://www.apple.com/privacy/docs/iCloud_Private_Relay_Over... - page 10, if you block mask.icloud.com and mask-h2.icloud.com, Private Relay will disable on a network.

I'm a bit more concerned at the idea that Apple wants to enable it by default, and route the entire internet through their servers!

They published a paper on how it works: unlike regular VPNs apple does not see what you are requesting , so even if they were logging everything that they see they would not have anything other than you using the relay.

Their exit nodes can still see the IP though, they can't connect it to an individual, but they can measure [mobile] popularity of any site on the internet.

re: [mobile] The relay is available on Mac and iOS (and for good measure landline ISPs in the US also have a history of selling and modifying user data)

Apple sees your IP address when you make the request, but not the content of the request, the egress point knows your approximate location (if you've asked it to maintain general location). As I interpret the white paper everything that is downloaded goes [destination site]->egress CDN->apple->you so the CDN can at best determine the most popular sites in a region, and apple can know you're using the internet.

In terms of knowing the popularity of various websites, apple says they're using large CDN companies, given that there are only a few CDNs large enough to handle potentially a large portion of apple's user base (who knows what the numbers will actually end up being) those CDNs likely already know the popularity.

The end result is that private relay is superior for privacy of web traffic, but of course only applies to insecure http requests, or requests from safari. Presumably this is the best mix of "don't leak arbitrary plaintext from user systems" and "don't interfere with other company's apps".

So if you want general privacy from your ISP a traditional VPN seems to be what you want, but that VPN sees everyone/thing you connect to, so you're trading your ISP knowing what you're doing for the VPN company knowing what you're doing.

How are you stepping from ‘Apple can see your IP address’ to you should use a VPN company that can see what you’re doing?

I think you misunderstood me.

It’s not a matter of apple seeing your IP address. It’s that private relay only applies to plain http traffic, or traffic from safari.

So if you want to prevent your ISP from watching ssh/irc/discord what have you, you would need a VPN.

If you’re just browsing the web in safari then iCloud proxy is strictly superior to a regular VPN company.

Reply on news.ycombinator.com