Hacker News Reader

Comment by Youden | Hacker News Reader

The issue in the article isn't that the VPN is sometimes inactive, it's that when the VPN is active, some traffic escapes the VPN.

As far as I can see the linked page doesn't say that your VPN will leak unless you're using Always On.

Plus, that page documents the VPN features built in to iOS itself, not VPNs provided by apps.

View on HN

The ProtonMail article said it only applies to pre-existing connections, because iOS doesn't force them to close when an app enables its VPN. I'd be reluctant to call that a leak, unless it contradicts Apple's documented behaviors, which as far as I can tell make no mention of a systemwide VPN except for corporate "always on" ones. Besides, is there any reason why you can't just toggle airplane after enabling a consumer VPN to kill off the old connections? Then it should probably be fine.

That's a clever thought. Do you know whether connections could be established outside the tunnel after you disable airplane mode but before the tunnel is re-established?

If that were possible then ProtonMail would have certainly said so, since that'd garner serious attention. In any case, the functionality as a whole isn't documented, so even if it works, Apple could theoretically take it away just like that. That of course doesn't mean we shouldn't rely on it, since if the only other option is a corpnet we're left with little other choice. I have the same problem with Apple because I depend on static binaries. Under the Apple regime, they too have an uncertain future and only continue to exist at Apple's pleasure. It's discomforting but not the end of the world.

According to the author, IOS makes new connections outside of the tunnel after the VPN was enable. There is no effective workaround.

> toggle airplane after enabling a consumer VPN to kill off the old connections?

That's discussed in the article.

Reply on news.ycombinator.com