Apple redirects Google Safe Browsing traffic through proxy servers in iOS 14.5

Re:Apple redirects Google Safe Browsing traffic through prox... by relevant_thing on Friday February 12, 2021 @02:50AM (#26111526)

If it's a simple proxy tunneling HTTPS traffic to Google, Apple probably doesn't know anything about the content of the queries, and Google doesn't know who sent them. If each kept records, they could get together and combine them to get the hashed URLs, but still a much better situation than directly querying a single endpoint.

Signal actually uses a similar approach to anonymize queries to GIPHY from users of its app. https://signal.org/blog/giphy-experiment/

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by sildur on Friday February 12, 2021 @04:10AM (#26111854)

I think it would have been way more private if they had used tor, defaulting to apple servers if tor wasn't available.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by schmorptron on Friday February 12, 2021 @07:49AM (#26113065)

That would probably single handedly bring down the tor network

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by sanxiyn on Friday February 12, 2021 @02:28AM (#26111426)

This is a significant improvement if you trust Apple more than Google.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by tjpnz on Friday February 12, 2021 @02:49AM (#26111523)

I don't trust either but knowing how each makes their money one might be less inclined to abuse my data over the other.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by maxhille on Friday February 12, 2021 @04:16AM (#26111888)

Sometimes I think people are not aware that Apple also has an ad business.

https://searchads.apple.com/

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by kergonath on Friday February 12, 2021 @05:29AM (#26112186)

Have you noticed that these ads appear only in the App Store and are not based on invasive tracking across apps and the Internet?

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by robin_reala on Friday February 12, 2021 @04:41AM (#26111978)

Sure, but it’s got a considerably better privacy model than Google’s ads: https://searchads.apple.com/privacy/ . For a start, you can see what information they used to target you by pressing on the “Ad” button (which is my case is nothing because I’d previously flipped a single toggle switch in settings telling Apple not to use personal data to target ads to me).

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by sofixa on Friday February 12, 2021 @05:05AM (#26112079)

Google have a whole website dedicated to that ( what it knows about you), and there are toggles if you want that to be used for ad targeting or shared with third parties.

adssettings.google.com

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by techdragon on Friday February 12, 2021 @04:38AM (#26111969)

It’s kind of disingenuous to compare Apple’s search ad feature for just promoting an app inside the App Store, with Google’s Adsense online advertising platform which is multi-platform with video, text, and image ads, even audio at one point in the past, on multiple device types being so ubiquitous it’s almost hard to get away from them.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by judge2020 on Friday February 12, 2021 @12:54PM (#26116421)

Search Ads are for the App Store and are completely contextual - eg. you search "translate" and a random translate app shows above Google Translate as an Ad. They don't have ads that target the user, only the search term.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by SquareWheel on Friday February 12, 2021 @12:48PM (#26116349)

Not to mention iAds. Though apparently they shuttered that a few years ago.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by izacus on Friday February 12, 2021 @03:04AM (#26111592)

What are you basing this information on (besides a pinky swear of a corporation which happily forgets their values when it comes to repairability and labor force) ?

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by mosselman on Friday February 12, 2021 @03:29AM (#26111719)

> "knowing how each makes their money"

Probably gave it away?

> "their values when it comes to repairability and labor force"

Apple obviously doesn't have any positive values about labour force and repairability, but both of those have about 0% to do with privacy, so they aren't relevant in this case I'd think.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by 6510 on Friday February 12, 2021 @04:20AM (#26111902)

I get that Apple seems more trust worthy in this setting but if one trusts others depends on everything they do. It would be better if they combined forces to create a separate entity. Safe browsing currently gives both companies the ability to block websites. They could do this when they feel like it but also when ordered to.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by kergonath on Friday February 12, 2021 @05:30AM (#26112202)

> so they aren't relevant in this case I'd think.

It’s just the classic “Apple’s bad, therefore they are absolutely doing anything nefarious I could come up with”.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by tchalla on Friday February 12, 2021 @03:49AM (#26111781)

You can look into SEC 10K filings for both firms.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by izacus on Friday February 12, 2021 @04:26AM (#26111926)

And those filings say that Apple is rapidly changing itself into online service firm where most services heavily rely on users data.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by tchalla on Friday February 12, 2021 @04:36AM (#26111961)

I am sure you've also made a keen observation that those services revenues heavily come from subscriptions, not from user data.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by jaegerpicker on Friday February 12, 2021 @10:32AM (#26114727)

An online services firm that is 100% different in how it works compared to Google/Facebook's models. All of it's services are subscription based and tailored for people who bought their devices.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by LeoPanthera on Friday February 12, 2021 @02:48AM (#26111514)

And even if you don't, it still reduces your surface area, because your iPhone is already talking to Apple anyway.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by politelemon on Friday February 12, 2021 @03:06AM (#26111603)

It would be better if it didn't talk to their servers, adding more on increases the surface area and impact.

In this particular case with Safe Browsing APIs, there wasn't a 'surface area' in the way that you mean, to begin with. The article, and commenters, are incorrectly making it appear that way.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by om2 on Friday February 12, 2021 @04:11AM (#26111862)

The Safe Browsing protocol does have a theoretical vulnerability whereby a malicious provider could create hash buckets on demand with the intent of guessing user URLs. This change would protect users from this theoretical risk. Also, it prevents Google from getting free info about user IP addresses and other info visible via a direct network connection.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by cromwellian on Friday February 12, 2021 @09:54AM (#26114247)

I'm guessing this information is next to useless. All they get is an IP address, and all it signals is someone is using a device. It is highly unlikely this is a useful signal for anything given the fact that they're getting much better user IP data from practically dozens of other services people use.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by mvanbaak on Friday February 12, 2021 @11:41AM (#26115482)

> It would be better if it didn't talk to their servers

As long as you have a 'smart' phone, it will talk to servers. Messages, email, contact sync, online backups, tools to give you trace possibilitiies if your phone is stolen ... everything needs some kind of server. And if you use an iPhone, a lot of those will be located at apple. If you use an android phone, those servers will be located at google (and possibly also at the hardware vendor eg samsung etc)

Aside from the whole 'company A can be trusted more then company B' thing which is in my opinion a personal matter, this specific item where apple will route the traffic to a 3rd party through apple to hide the ip etc of their customers is a good thing.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by sneak on Friday February 12, 2021 @03:28AM (#26111707)

Both are required in the US to turn over user data and logs to the US federal government without a warrant, pursuant to FISA orders.

Apple compromised over 30,000 of their customers in such a fashion in 2019, as documented in their own transparency report.

The F in FISA stands for foreign, but at least one person who worked on the program has told us that it is used to obtain the data of Americans without warrants as well.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by sschueller on Friday February 12, 2021 @02:32AM (#26111447)

For the US Government it's just a different phone number they have to call to get your data...

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by stqism on Friday February 12, 2021 @02:38AM (#26111467)

Typically, people who are trying to defend themselves from nation state threat actors aren’t using iPhones or stock Android phones, and absolutely wouldn’t use safe browsing if they did.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by jlgaddis on Friday February 12, 2021 @02:54AM (#26111545)

And the U.S. Government isn't making a phone call to get the data.

They have a "law enforcement portal" they can log in to in order to request the data.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by sneak on Friday February 12, 2021 @03:29AM (#26111717)

Are we classing the FBI as a "nation state threat actor" now?

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by sbuk on Friday February 12, 2021 @03:40AM (#26111749)

If you're outside the US, yes.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by sneak on Friday February 12, 2021 @03:50AM (#26111789)

What does that have to do with the threat posed?

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by iSnow on Friday February 12, 2021 @05:08AM (#26112091)

I don't think it's about the FBI as much as the rest of the three-letter soup. NSA, CIA et al. most certainly are a threat to anyone outside the USA holding valuable secrets.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by jaegerpicker on Friday February 12, 2021 @10:35AM (#26114769)

It always should have been. I'm not sure anyone would not class them as a nation state threat level. It's one of the most powerful government agencies in the most powerful nation in the world. If they don't fit that definition who would?

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by eriri on Friday February 12, 2021 @06:22AM (#26112476)

Ever heard of Edward Snowden? He exposed how three letter agencies were engaging in mass surveillance, even including American citizens in violation of their very own constitution they've sworn to protect.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by tempodox on Friday February 12, 2021 @05:43AM (#26112259)

Why not? Every system holding PII poses a potential threat, at the very least because every system can get hacked, and at worst because folks with “legitimate” access to that data can still abuse it.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by kergonath on Friday February 12, 2021 @05:35AM (#26112221)

Well, it is an actor and it is a government agency...

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by lupire on Friday February 12, 2021 @08:38AM (#26113483)

For the Chinese government it's a direct feed from Tencent, which Apple devices sent URL data to.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by emptyparadise on Friday February 12, 2021 @02:49AM (#26111521)

No silver bullet. This is a counter against surveillance capitalism but not against surveillance states. In the long run the only sure way to prevent data misuse is to remove the data, but moving existing data to entities without the financial incentives to misuse it is still a step in the right direction.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by madeofpalk on Friday February 12, 2021 @04:44AM (#26111995)

Which I guess would be more of a given if you've decided to buy and use an Apple device.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by beermonster on Friday February 12, 2021 @03:55AM (#26111806)

This. Would be better to not have to trust anyone!

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by politelemon on Friday February 12, 2021 @03:02AM (#26111582)

There is no significant improvement - the data was already hashed/anon to begin with and posed no risk. IP addresses on their own aren't a problem, it's when it's available with additional data that you start to worry.

This is purely a move to further lock users in while being touted as being privacy friendly through persistent PR.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by tgragnato on Friday February 12, 2021 @04:00AM (#26111826)

If you are an iOS user, then Apple is necessarily in your trust model. Google, not so much.

Google’s implementation of k-anonymity in Safe Browsing does not account for their own ability to correlate multiple queries and narrow down which specific website corresponds with the hash.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by michaelt on Friday February 12, 2021 @03:29AM (#26111714)

> IP addresses on their own aren't a problem

I'm the only person using my IP address, ergo it's personally identifiable. Seems pretty clear cut to me?

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by politelemon on Saturday February 13, 2021 @08:29AM (#26123491)

Not at all. IP addresses are not PII under any definition. Feel free to browse CCPA, GDPR, etc. Even without those regulations, it's still not PII as it takes just a few seconds to enumerable every IP address. If it actually were PII, you would have controls in place to prevent it leaving your device in the first place.

IP addresses are only when identifiable metadata is linked with it. I can only guess that you are being deliberately obtuse on this - I had momentarily forgotten that I was on HN so my comments weren't welcome sadly.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by my123 on Friday February 12, 2021 @03:16AM (#26111653)

Lock users in? What does it change from that point?

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by lupire on Friday February 12, 2021 @08:40AM (#26113501)

The hashes are hashes of a small set of public data, and so reversible via rainbow tables.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by goatinaboat on Friday February 12, 2021 @04:12AM (#26111867)

It still shares the same amount of information, it's just being shared with Apple instead of Google. If it was a privacy problem before, it remains so.

Apple’s business model is not based on exfiltration of personal data, in fact their business of selling hardware is only boosted by adding privacy features.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by Manfred on Friday February 12, 2021 @02:48AM (#26111515)

Software update and other features already expose your IP address to Apple. This solution doesn't add another company, so that's a win.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by izacus on Friday February 12, 2021 @03:04AM (#26111595)

Giving all your information to a single company where it's easily pooled and abused is a win?

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by simonh on Friday February 12, 2021 @03:13AM (#26111639)

No, it’s segmenting which information goes to which company. Apple already has your IP address so why also give it to Google? Meanwhile the https traffic is only proxied through Apple, so they don’t see the content.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by tchalla on Friday February 12, 2021 @03:50AM (#26111791)

Apple doesn’t collect and use information the same way Google does.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by vntok on Friday February 12, 2021 @05:41AM (#26112250)

It is true, Apple handles it way worse. With Google you have access to a whole dashboard where they explain in very simple terms what they know about you (per service) and how they use that information. And of course you can opt-out with a few clicks.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by rgovostes on Friday February 12, 2021 @01:23PM (#26116741)

Apple has the same thing[0].

A journalist requested their data from Apple, Google, and Facebook a few years ago[1],

> The zip file I eventually received from Apple was tiny, only 9 megabytes, compared to 243 MB from Google and 881 MB from Facebook. And there's not much there, because Apple says the information is primarily kept on your device, not its servers. The one sentence highlight: a list of my downloads, purchases and repairs, but not my search histories through the Siri personal assistant or the Safari browser.

Also curious how, if as you say Google is so transparent with this information, they abruptly stopped updating all of their iOS apps on December 8th, the day that Apple required them to publish the data that their apps collect[2,3].

0: https://privacy.apple.com/

1: https://www.usatoday.com/story/tech/talkingtech/2018/05/04/a...

2: https://twitter.com/Thomasbcn/status/1356645088697454596

3: https://www.macrumors.com/2021/01/05/google-hasnt-updated-io...

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by tchalla on Friday February 12, 2021 @07:12AM (#26112814)

It’s interesting that one using data as a selling point is worse than one that doesn’t. In any case, Apple gives you access to all information they have on you and you can opt-out with a click. I’m not sure that’s a differentiator in any case.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by ViViDboarder on Friday February 12, 2021 @10:36AM (#26114792)

Except that if you’re using Safari, you’re already putting some trust in Apple to protect your privacy. Reducing the number of parties to your data is certainly a privacy win.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by kccqzy on Friday February 12, 2021 @02:35PM (#26117629)

Apple doesn't know whatever requests you send. Apple only knows your IP address, whereas Google only knows the request content.

[ Parent | on HN ]

Re:Apple redirects Google Safe Browsing traffic through prox... by Ensorceled on Friday February 12, 2021 @10:10AM (#26114432)

> If it was a privacy problem before, it remains so.

That is a very binary view. Yes, it is still a privacy problem; but now the privacy problem is with a company that is not abusing personal data on a massive scale.

[ Parent | on HN ]