"Advanced Tracking and Fingerprinting Protection" Leaks DNS Queries to Apple | Hacker News Reader

"Advanced Tracking and Fingerprinting Protection" Leaks DNS Queries to Apple

community.cloudflare.com

47 pointskryptoncalm12 comments

Being a network and security guy, I've watched firewalls start blocking Apple devices "privacy" proxy as "Proxy Avoidance" category on common firewalls such as Palo Alto and Fortinet, and have often debated whether to allow or filter this. It's mostly noise to me, but I just facepalm with silly apple users falling for these consumer traps.

To me, this is just another way Big Tech is trying to siphon everything you do via them for inspection, ie. their marketing or selling of trending what you do regularly, including Apple. People don't know any better, it sounds real good to the normal layperson user as "protection", but really, it's not. When Apple switches this on globally under the guise of user benefit, I just laugh knowing better. Now that Apple sees _everything_ you do, they can go ahead and build that search engine they always wanted too.

Think differently said the wolf to the sheep.

Funny just a week or so ago Google of all people announced a "Privacy VPN" product. Hah, yeah right Google, you're just mad Apple thought of the racket first and want in on the action since Microsoft already has their Telemetry spyware well established for everything a user does sent to them, and Apple now too with their privacy proxy spyware.

As opposed too cloudflare, or google, or my shady provider. Cloudflare does exactly the same but call it filtering.

Use a VPN and unbounded orso if you want to keep you queries private..

I noticed I couldn't reach my home servers which use split dns resolution, and it turns out that's because iOS 17 routes DNS queries via Apple DNS servers when using 'Advanced Tracking and Fingerprinting Protection'.

Good to know

* when setting up home networks or

* you want to use DNS for content filtering or

* you prefer your DNS queries to stay private

I just have Avahi and mDNS active on my machines, and access everything through .local names.

I also pretty much gave up on running split DNS for internal stuff at home. avahi & .local just works enough of the time (though definitely not all of the time).

Dont leak DNS queries to Apple, leak them to Cloudflare 1.1.1.1 instead plox! K thx bye.

I would be interest for Kagi (with their browser Orion) to comment and get their take on this

While Orion also has anti-tracking technology, they do not have this specific feature where a custom DNS server is used to block tracking.

They say they literally use Advance Tracking Protection, even at the most basic level of Ads and Tracking Protection (which is a mandatory minimum setting)...

It Advance Tracking Protection™ an Apple thing or is it a broader more extensible standard?

Orion uses https://webkit.org/tracking-prevention/ and they have their own custom ad and tracking blocker.

They do not set a custom DNS server like the linked issue says.

Gotcha. Excellent work, thank you

Imagine being technically competent enough to know how to configure alternative DNS servers and also stupid enough to bother trying to filter your teenage kids internet.

Reply on news.ycombinator.com