It depends, whether they do no logs. There are many VPN providers in the US which don’t have logs, so that if they are subpoenaed, they have nothing to give.

The beauty of Apple’s double hop is that if one partner was hacked, secretly wiretapped, or had lied about not keeping logs, your connection would still be private.

But, that assumes that nobody on this network is keeping logs. If they are, then it could be theoretically possible to piece them together. However considering Apple’s marketing with privacy, it would be interesting to see whether they keep logs on each endpoint or not.

> There are many VPN providers in the US which don’t have logs

Many claim they don't have logs, and my understanding is that it has been sometimes revealed that they do have logs. Also, how do you run a server without logs? Many think those claims are BS.

What would the logs contain?

I believe everything is encrypted on device before being sent to Apple.

Timestamp, source and destination ip addresses, username. In the case of the exit node, url.

We don’t know that Apple keeps logs. These are things they could theoretically keep, but we don’t know if they store them or not.

If they don’t clearly state ‘no logs’ then its unlikely they are not logging. My bet is they’re logging everything, because they have no advantage in not logging.

Only the timestamp and username would be available from Apple.

Source IP address and next-hop IP address would be as well.

Source on the next hop address?

Apple doesn’t know where you’re going.

They shouldn't know about the end destination, but they'll know your traffic was sent to eg. Cloudflare or whatever.

I would think they batch together all the IPs and pass it off.

It's in Apple's best interest to keep the bare minimum information they need from their end-user.

> It depends, whether they do no logs

Courts can compel them to keep logs.

That’s the beauty of this. Party 2 only knows Apple’s IP. Apple doesn’t know what site you’re visiting.

So how do you assemble “all traffic to this site” even by subpoenaing both parties?

To party 1: "Give us a netflow log of all of this user's traffic." To party 2: "Give us a list of all outbound connections matching this netflow list of inbound proxying requests."

It would work the other way around as well (going from visited sites to a given Apple id). If you can monitor all nodes in an onion routing network, you can deanonymize everybody.

Well, here’s the catch. Even if logs were kept, the 2nd party as far as we know does not have a unique identifier passed onto it.

This means that Apple’s logs would say this user authenticated and passed some encrypted stuff to Fastly, and Fastly would say that it received requests from Apple, without an identifier to match it up against the first request.

Once this scales and Apple has millions of requests incoming, there will be no way to conclusively prove that two requests are the same.

In which case a double subpoena is again useless. And this assuming they keep logs - if they don’t keep logs, which is more likely, it’s even more useless.

This also aligns with something we currently know. Apple says they can’t see your requests. This implies that they just pass data along in an encrypted format to their partners. So all Apple does is make it so their partners don’t know your device, and the partners ensure Apple doesn’t know your request.

Ultimately, even if logs were kept, there would have to be a unique identifier of some sort that was passed on to the second server from the first server to break the system. You decide the odds that they did that. Sounds a lot like an IP Address, in which case why not just build a classic VPN?

Surely some "unique" identifier is required for each TCP session between Apple and the exit node so that Apple knows where to send the data it gets back, even if it's just the port on which Apple connect to the exit node as with standard TCP session management.

How would that help you identify all of a particular users interactions (rather than one)? Why would you expect them to log it?

If Apple logged (incoming IP from user, outgoing port to exit node) pairs for each session, and the exit node logged all requests, this should be sufficient to associate all requests with a given user IP, right? Or am I misunderstanding you?

I wouldn’t expect them to log it, personally, I think that can only lead to headaches down the line. My reason for responding is just that I disagree that there is no way for another party to associate all requests even if Apple & exit node both fully cooperate and keep logs.

We are thinking about this the same way. Individual sessions don't do you much good, but there is traceability iff both parties keep complete logs. Which seems unlikely unless coerced.

If your threat model includes state level actors, there is no commercially available solution that will make you 100% safe. This is about privacy from private corporations and making it more difficult and more costly for governments to get your data. But the latter is always possible when you use the web.

>If your threat model includes state level actors

My personal threat model doesn't include state level actors, but if it did I would certainly differentiate between a solution that the NSA can break with some expense and one that my local police department can break with a warrant.

My actual threat model is advertisers, so I think the Apple solution is quite elegant and will serve me well. It shouldn't be conflated with TOR though.