Any other VPN is just best effort.
https://support.apple.com/guide/deployment/vpn-overview-depa...
As far as I can see the linked page doesn't say that your VPN will leak unless you're using Always On.
Plus, that page documents the VPN features built in to iOS itself, not VPNs provided by apps.
Kind of a big deal that likely 90%+ of iOS VPN app users assume they're private when they're not. False advertising IMO, and Apple is getting their 30%.
Also, just checked Mullvad, which seems to open an IPSec server on your local device and then install a vpn config on your ios device. From the local IPSec server a connection is made to mullvad via wireguard. On-demand is also enabled by default.
But yea, VPN were initially targeted at enterprises anyway. So I don’t mind that i actually have to install vpn profiles by hand.
ios/ipad: https://apps.apple.com/us/app/wireguard/id1441195209
Fwiw the existing app integrates seamlessly into the apple ecosystem.
Considering the added benefits of taking your other desktop Linux security configuration to mobile, A Linux mobile could be a viable choice for those who need reliable transparent security.
Also, the supervision requirement for always on VPN is a stronger limitation than lockdown mode; you have to erase the phone to supervise it.
The fact that a VPN server can send you a route for 0.0.0.0/0 always was and always will be a happy accident.
https://adguard.com/en/adguard-ios-pro/overview.html
But other choices are available too.
Using iOS's built in support for browser adblockers is largely as effective and doesn't come with the battery life hit.
i would not expect it to work like that
i’d think my traffic is protected, why protect it twice
https://blog.cloudflare.com/warp-for-desktop/
> WARP was built on the philosophy that even people who don’t know what “VPN” stands for should be able to still easily get the protection a VPN offers.
But it’s good to know that there are leaks, anyway.
PS. And I guess all VPNs use the same base VPN functionality provided by iOS, so “is” looks a bit more appropriate than “scam”.
Apple doesn’t really care about preserving your privacy from Apple (and by extension the FBI).
They maintain backdoors in iMessage specifically to preserve the ability of Apple/FBI to read your messages:
https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
The fact that Apple OSes leak your true IP (and thus city-level location) to Apple around your VPN is not an issue to Apple; it may even be intentionally preserved this way to aid investigations.
It is is interesting how the iPad purchaser refers to "my iPad". He owns the computer. But how much control does he have over it. He runs an OS controlled by a HW manufacturer turned trillion dollar tracking and data collection company. (Apple computers are extremely chatty on any network and phone home 24/7. Apple is fervent about its need to collect and store data from purchasers.^1) As such, he cannot find the problem in the iOS source code, remove the phone home "features", re-compile and reinstall it. The best he can do is complain to the internet.
I have owned various Apple computers over the years, including an iPad. However I never used any Apple computer with an Apple OS for internet use.^1 I only connect them to the LAN. I just think there are better OS, namely ones I can edit, to use for internet-facing computers. For internet usage, I like OS where I can control the routing table. Since I started keeping these computers running "consumer OS" off the internet in the 2000s, the internet has become a vector for pervasive surveillance. I treat computers running Windows the same way. No direct internet access.
In the 1990s/2000s I can recall the "experts" advising against leaving computers connected to the internet when not in use. Today, "tech" companies try to compel people to leave their computers connected 24/7. Not to mention "experts" who believe this is justified because "automatic updates". Granting 24h remote access to unknown people to install software on computers that do not belong to them. Some people call this a "botnet". I do not care for broken software that continually needs fixing. But as the author alludes to when he quotes Steve Gibson, iOS is never broken, it just has not been fixed yet.
1. Today's Apple computers require some connection in the beginning to "sign-up", "register", download "approved" software, etc.
2. Apple computers owned by employers excluded. Also excluded are older Apple computers on which I ran NetBSD.
There is a lot of wisdom we've thrown away from those days. Software phoning home was viewed as malicious and there were lists of applications that did it to shame companies and warn others to stay away. Pretty much every OS and major application today would rightly have been considered Spyware.
If we'd kept "Never use your real name/info on the internet" the world would be a better place. The rule allowed for E-commerce so we'd still have amazon, but facebook and all its problems wouldn't exist.
Pop-ups were considered evil, and we fought to stamp them out but today the same annoyance is commonplace and accepted, they just show up as modal windows and cookie banner notices.
This comment is a gish-gallop RMS-y soapboxing which is largely irrelevant-to-the-article points: that iPads (possibly all iOS devices) only pass some of their traffic over a VPN connection.
This stuff is up to whoever has root on your device, be it Apple or eg. bad guy exploiting 0day in captive portal, but certainly not you.
I believe that is not the case. It is strongly suggested during the sign-up process, and some functionality depends on it, but it is not required, as far as I know.
Also: if Settings says you're connected to a WiFi network, but you don't see a WiFi icon at the top of the screen, I think that means there's no working Internet connection.
The rules on aircraft changed, so the feature was updated.
Yup.
In this case, iOS will always wait until connection to VPN is established before sending any packets out.
Without on-demand, VPN may leak.
If I remember correctly, leaks occurred mostly after waking from sleep but before the tunnel had chance to be set up. Or in similar situations. Anyway, on-demand option solved all of them.
I tend to agree. My only takeaway after seeing that was “if I ever need a 100% leak free tunnel on iOS, validate it”. I certainly won’t be taking any of this at face value without replicating it.
Enough points (APNS is always connected, so whenever your phone is on) and this uniquely identifies you (even if the serial number wasn’t bought with your own credit card).
Then they have to give it to DHS/ICE/FBI/CIA without a warrant on demand, thanks to FAA702.
They, of course, already have all of the cell tower association records, as well as all of the Secure Flight program data from the TSA. It’s not a difficult query to figure out which serial numbers are which IMEIs are which humans.
The vast majority of people use them for IP spoofing.
* vpn gateway address can be different from public vpn exit address. What is the surprising part?
* I don’t know what pings your “uncloaked” public ip address, but still, when using a vpn, you’re using your own ip address to connect to the gateway. So, there’s no real leak - it would be a leak if some packets went _through the vpn_ to 99.99.99.99, because an observer could spot the strange ip and determine it’s the uncloaked source address.
Anyway: who can tell what an iphone or ipad can do? You probably have an associated apple account, et cetera. If you trust such a device for total anonymity, you’re doing it wrong from the start. Pick a Linux laptop for that.
Mac OS route selection always takes into account the source address of the IP packet in addition to the routes in the routing table.
If a socket binds to a particular address, the Mac OS kernel will choose routes associated with the interface that address is on and ignore the others.
I would argue that's the only "sane" way to do it, but then again i'm no network engineer. I just rely on my devices to work this way so i don't saturate the wrong links or get poor upload speeds when i need them.
On an Android (like on iOS), both WiFi and Cellular interfaces can be active at once. Apps (with appropriate permission) are free to bind to either.
> ...all existing connections stop and must be refreshed.
On network changes (in particular address changes), TCP connectivity may break. SCTP / QUIC / UDP (and UDP-based protocols like WireGuard and MoSH) should continue to work just fine.
...and that's when you realise that trying to configure a device to which you do not actually have full control of is a futile endeavour.
As such, in agreement with many of the others here, I don't consider this much of a bug nor a "scam". It's merely an effect of what VPNs are (an additional network interface) and how routing works, combined with a device whose manufacturer deliberately does not want to put users in full control of the routing table.
If you give the device a static DHCP lease, then you can block it from 0.0.0.0 and allow it to your VPN provider's IP blocks.
You might want to give the device its own WiFi network if you don't trust it to honour DHCP
To be clear, I mean the big VPNs that advertise themselves as helping with privacy are actually a scam.
There are obviously some situations and use-cases where using a VPN makes sense (e.g. geo-shifting), but as a general solution for privacy on the internet they make no sense.
Trying to read through the whole thing, I can't tell if if this is claiming:
a) When a VPN is activated, pre-existing connections will continue communicating outside the VPN, but all new connections happen via the VPN
b) Apple services like the app store and/or certain other apps leak outside the VPN because of a) more than you would expect
c) Apple services like the app store and/or certain other apps leak outside the VPN for other reasons totally unrelated to a)
The author's tl;dr just says "data leaks" but I really just can't follow what that actually means.
It seems like a) is not entirely unexpected or necessarily a problem -- you probably turn on a VPN before initiating activities/apps you want routed through the VPN, so not usually problematic? But b) means it might be more serious than that, while c) would be even scarier?
This means the Apple APNS client IP logs relate directly to your tracking serials and both your VPN and non-VPN ids, linking them.
They also contain your non-VPN IP history, which is your travel history, as client IP is city level geolocation.
There are more serious problems though, with any app being able to bypass VPN simply by prohibiting Wi-Fi interface and iOS gladly letting all traffic via LTE, unfiltered. That's been described in https://blog.disconnect.me/ios-vpn-leak-advisory/.
It's well known and pretty sad that these issues go unaddressed for years. VPN developers have little power to change that given that VPN apps run in a walled garden of Apple in a sandboxed environment. Hence the the best effort at this point with a hope that this can addressed in the coming updates.
It would be great if more of these pop up on Apple forums and Apple Feedback with people demanding improvements on transparency and privacy from the company.
So far reading your blog post looks like a recollection of what's been going on.
I really wanna throw an analogy of a bear waking up from hibernation. This is not sensational and just reiterates what's been said before you, yet the title throws a shadow at VPNs just to sound like it.
[1] https://developer.apple.com/documentation/networkextension/n...
Yeh… Apple, Five Eyes, Privacy is all pretty much an illusion when you have this many devices in this many pockets. Whatever it is, vpn’s or end to end encryption, it’s all really only as secure as the touch screen controller telemetry logs.
Also, regarding the UDP datagrams seen after the IKE exchange, maybe relayed to NAT-T?
> I am not a fan of making a VPN connection on your only router, but suggest having a second router dedicated to VPN connections. When you need a VPN, connect to the second router (Wi-Fi or Ethernet), when you don't need a VPN, connect to your main router.
Aka, don't use a device with two network sockets if it is critically important to avoid using one of them.
So, when apps can communicate from iPhone->Watch, even with a perfectly functioning VPN on the iPhone your public IP can leak via the Watch (if the app is also installed on the Watch.)
Site: https://defensivecomputingchecklist.com/
Discussion: https://news.ycombinator.com/item?id=32490866
Networking is dynamic it takes many sequential steps to configure. There is no ZAP, it is done. I don't know of an OS that locks out "user programs" until configuration is complete. Yeah, since networking is dynamic that could never work -- "user programs" would be locked out forever!
At the start of the First Test there are packets going to non-tunnel locations at the same time the VPN is being set up, not a surprise. Packet ordering / routing at this time granularity is also not surprising.
Need to take a moment to review the "drop everything" when a VPN is up standpoint. OS Networking stacks don't really understand what a VPN is, it is just an endpoint to route packets. A TCP connection has internal state that is bound to the addresses that were used when it was set up - which is tied to the state of the routing table. A new point-to-point endpoint, like a VPN would invalidate that state. Most (many?) TCP/IP stacks keep a cache of the initial route on the socket. As long as that is still valid (or updated), that is where the packets go. Killing TCP connections for every (temporary) network flap would make a lot more people MAD.
The "DNS" to NextDNS with DoH connection is interesting. This 100% isn't coming from iOS itself. It doesn't support it. So it must be coming from an App. But what app and how? There is a NextDNS app which up front claims "Encrypt all DNS queries on all networks with the official NextDNS app for iOS". The author does appear to have configured the router to use NextDNS, perhaps they also have that App installed as well and it is also hijacking networking to do DNS? A dunno.
The "flood stuff" is interesting, but I think it might just be an attempt to perform STUN to make sure UPD traffic can be transported - to Apple endpoints. I think "second test" is the same thing happening again.
So what is left is the traffic being sent to apple endpoints. Now I wonder how the VPNs the author is using are implemented. The Big Sur VPN brouhaha was because apps were trying to implement a VPN using NEFilterDataProvider instead of a "tun" interface and routing. I wonder if this is just the same issue but on iOS.
Not related, but I do wonder what these VPN services offer in terms of "Firewall" protection or if when you use them ALL ports are forwarded to your device. This would make all of their endpoints a "great target" for continuous scanning for getting inside a network if the VPN user had something misconfigured, like say an experimental Apache, Nginx, PHP, Rails, Django, MySQL project. Doh. Methinks I should spend some currency and experiment. Sadly black-hats are probably already doing this.
