About iOS' VPN leakage

General
1

I learned about it here: iOS VPNs have leaked traffic for years, researcher claims [Updated] - Ars Technica

I’ve got a couple questions (a friend of mine uses iOS and she’s trying to improve her privacy regimen). Firstly, do these IP leaks (your real IP) go to apps you use (e.g. insta, X, bluesky, reddit, tiktok, etc), or are the IP leaks exclusively to Apple services? If the latter, I imagine such leaks are less of a concern, albeit still unacceptable.

I’ve also read that Mullvad may have a solution: Mullvad VPN Fixes iOS Data Leak Issue With New Optional Setting to Strengthen Privacy

Does it work?

2

Hi :waving_hand:

So, I have tested this and provided some updates here:

It is better, and I don’t have many leaks, but it isn’t foolproof. You have the obvious issue of having to deactivate the VPN when updating the app (which, in fairness, isn’t that frequent), but the VPN on my iOS does occasionally go a little haywire. By this I mean persistently try to connect to each of the Mullvad VPN servers. I see the screen at the top right say ‘VPN’ then flickers off, ‘VPN’ comes back on then goes back off. It does this constantly with no way of turning it off! The only thing I can do is restart the phone.

I suspect it may be spending to do with the Apple services. My latest question remains unanswered and I’ve no idea if anyone else has experienced the same. BUT: it is a marked improvement whereas, prior to Mullvad ‘Force All’, the phone would leak my true IP on Apple services very frequently.

Great question - not that I know of, but this is quite tricky (at least for me) to check. The Wipr app looked promising, but it simply doesn’t work for me. I imagine due to the VPN (iOS gets rather confused and doesn’t like conflicting profiles….).

But from what I can see from my DNS settings, and aside from the issues above, I can’t see any specific leaks to any apps. CAVEAT: I do not use any ‘Insta’, ‘Reddit’ or Twitter nonsense as it’s the spawn of satan and needs to be eradicated from the planet - so I may not be able to definitively answer your perfectly reasonable question. Where possible, use a secure browser over apps if you’re concerned as part of your threat model. The data contained within apps is quite frightening.

Whilst Apple purportedly has a strong privacy and security ethos, this is somewhat contradicted by the design and seemingly unyielding stance on peculiarities with third party applications and the issue around their non-existent kill-switch. I don’t profess to know too much about the workings of this, but if Android have this built in, why can Apple not?