Comment Re:Clickbait Headline (Score 1) 46
If you set up a passkey with a site, hiding your identity with Private Relay isn't hiding your identity anyways.
That isn’t really true. Let’s say I have a service where I sell dirty filthy smut. You want that dirty filthy smut. I require you to set up an account. So I know what account name you have picked, if it is “WankerWeasel” I can guess that it is the same WankerWeasel as is on SlashDot and maybe other places, but that is a guess. If I look at the IP address you use to connect to my web server I can assume I know roughly where you are, although Private Relay makes that a pretty bad guess (I’m in VT and everyone that looks at my Private Relay IP address is going to think I’m around 400 miles away in MA. Which doesn’t make me “hidden enough” if I don’t want it known I’m in the USA, but hey, Apple didn’t promise me that, plus the farther they drag the traffic the more latency gets introduced). In the future when you use the passkey again I’ll know it is the same identity as was used before, and very likely the same person. I still don’t know if you are the same person as is on SlashDot. I definitely don’t know what state you live in, or if you are in the EU what country. If you are on a smartphone I probably can’t figure out your movements if you use Private Relay unless the passkey continuously leaks the address (i.e. in future verifications not just creation), and even then I’ll only see it on login. If Private Relay also covered that traffic I wouldn’t know any thing about your travel habits.
So sure you making an account gives me some ability to track you, but not really much to correlate you to any other existing data I might want to link yup so I can leverage my vast store of citrus treat preferences to advertise at you at a higher success rate. Folks always looking for ways to blame Apple
Yeah, they are (now) the big guy on the block, so many root for failure, and point and jeer. Plus on slashdot they are frequently seen as the enemy of open source even though they do frequently contribute patches back to various things, or entirely open up works they do internally.
That said this is an Apple screwup. I’m pretty sure it was an accident not an intentional privacy leak so they can “look good” but still gather privacy data. It is at worst a bug someone noticed prior to release and it got filed as a P1 or a P2 and got demoted to a P2 or a P3 so the product could ship, and once shipped rather then being treated as a “fix ASAP” it got treated as “that can’t be a block ship bug by definition, because we shipped with it, so P2 at best, why should we block a future product for a bug we already shipped?”, so it is sitting in someone’s radar backlog and it hasn’t gotten fixed despite being fixable (maybe the private relay folks and the passkey folks have a disagreement on how to fix it, but it doesn’t seem like it is a hard fix, either have passkey ask PR how to route traffic PR can’t recognize as “web traffic to reroute”, or PR has a mechanism to mark non port 80 port 443 traffic as something that PR needs to reroute and passkey isn’t using it, but should -- maybe it is a little deeper, maybe PR doesn’t have a way to encapsulate non http(s) traffic and passkey’s protocol isn’t “enough like” http to work, so a general VPN needs to be used, and Apple’s private relay partners are not up for general VPN, and Apple hasn’t solved the busness side of that yet, not even the minimal “only VPN a few protocols from processes that have the right entitlement so it can be used on a case by case basis for things like passkey but not magically give everyone a free VPN that Apple has to pay for if they use it for bulk data”).