Apple iCloud Private Relay

Translate this page; This page contains changes which are not marked for translation.
Gnome-stock person IP obscured.svg

IP addresses have been the main tool for preventing persistent vandalism and abuse on the wikis — but the availability and reliability of IP addresses is changing for many reasons. The latest change is Apple’s iCloud Private Relay. It affects Safari users with a paid iCloud account.

This new feature may obscure the IP addresses of 3–5% of our editors by the end of 2021. Tens of thousands of people will be affected. It may cause issues for communities’ ability to prevent vandalism and abuse. It's likely that other browsers will follow Apple's lead, as they've done before. This problem is likely to grow.

Communities typically block edits from IP addresses that obscure individual users. If this practice is continued with iCloud Private Relay editors, 3-5% of all our editors could experience a block in the coming months. This includes logged-in, active editors who may not understand why they've encountered a block.

As these changes happen, the communities, users with advanced MediaWiki permissions, the Wikimedia Foundation (WMF), and others need to work together. We need to learn how the security of the wikis can be maintained while the pathways to editing remain open for all good-faith participants.

OOjs UI icon help.svg
We would like to learn more, to help us make a plan.
  • Are you seeing problems related to the current iCloud Private Relay global blocks on your wiki?
  • Do you think that it's likely that good-faith editors will be affected by blocks?
  • While we do not know for sure, we think that this situation may grow over the next couple of years. It is possible that other browsers, such as Chrome and Firefox, could follow a similar pattern and also restrict access to IP addresses.[1] If this happens, it will be a major change in how the internet works. What do you think, in what ways would this change affect the wikis?

Let's discuss on the talk page!

Wikimedia and IP addressesEdit

IP addresses have been the main tool for preventing persistent vandalism and abuse on the wikis.

  • IP addresses are unique identifiers for a source of internet activity. They can belong to things like a phone, a wifi connection, or a corporate network. For most of the history of the internet, they could be used to roughly identify an internet user. They could also give information about that user’s location at the city level.
  • Our communities rely on IP addresses as their core identity and security model.
    • Users have always been able to edit without logging in. Their IP address has been their sole form of identity—the way that they receive messages, are tracked, and are blocked.
    • For users who are logged in, IP addresses are the main tool for identifying persistent abusers. They can be blocked based on their IP logs.
    • In some cases, whole ranges of IP addresses are blocked for being persistent sources of abuse.

Changes in technologyEdit

The broad changeEdit

The availability and reliability of IP addresses is changing for many reasons. Apple’s iCloud Private Relay is the latest change. Other tech providers will probably make similar changes.

  • The nature and availability of IP addresses is changing. With the advent of IPv6, IP addresses are more dynamic than before. This problem will only be worse in the future as more users come online.
  • Additionally, IP addresses and user agent information have become personal data. Hiding them has become a service more and more internet users want.
  • External market and government actions make these changes. They are not under the control of the Wikimedia movement or WMF.
  • The Anti-Harassment Tools team at WMF has been looking into the issues surrounding IP addresses. It is building tools that may reduce the effect of these changes. But the work will not prevent IP addresses from becoming less useful over time.
  • Changes like these can quickly spread. Once Apple makes this change, other browser providers like Google and Mozilla may remove browser information sent with requests as well. While this is not known for sure, it is a prediction based on market analysis. For example, after Google announced that Chrome will no longer send user agent info, Mozilla also announced that similar changes were in the works for Firefox browsers.

More details on iCloud Private RelayEdit

  • Apple is starting to provide a service called “iCloud Private Relay”. It masks the IP address of a Safari user such that they appear to be coming from a central pool of Apple IP addresses. It will apply to Safari browsing behavior on both desktop and mobile devices. Learn more.
  • iCloud Private Relay is available only for iCloud+ subscribers who opt-in. Not all Apple users are iCloud+ subscribers. As of October 2021, it is labeled as “Beta” and is a paid service that can be disabled, but cannot be selectively disabled for specific domains.
  • This is likely to become a non-beta feature, then on by default (opt-out). It may also eventually be included in the operating system for free, as a similar service for how Mail is now free.
  • The advent of iCloud Private Relay has been known about by community members for some months. The English Wikipedia administrators noticed this service coming and had a related discussion in June 2021.
  • Users of the Opera web browser have faced a similar situation for several years. Opera offers a free VPN service. This is a non-default (opt-in) service. Note that Opera has a significantly lower share of the usage.[2]

Effect on WikimediaEdit

Many communities block edits from IP addresses that obscure individual users. If they do so with iCloud Private Relay editors, 3-5% of editors will likely encounter a block in the near term. This number would likely grow as other browser providers follow Apple’s practice.

We want to learn the extent to which communities are okay with the effect this will have on editors. Also, we are curious if there is openness for reconsidering the rules on large IP blocks.

  • We want administrators to feel safe and supported. The quality and reputation of Wikimedia projects needs to be protected. Marginalized editors who need protection should also be supported. Casual good faith participants should be able to edit on the browser and device of their choice. The loss of IP-as-identity challenges all these goals.
  • When users of iCloud Private Relay attempt to edit from Safari, they will appear with one of the dedicated Relay IP addresses.
  • Decisions around whom to block and why are made at a local community or global governance level. There are rare “office actions” to ban users. But in principle, blocking is an area with a long history of community self-governance. Large communities and global sysops have decided that “open proxies”, virtual private networks (VPNs), shared IP services, iCloud Relay, and similar services will be blocked on all wikis.[3] The reason is that identity fraud is too easy to commit using them, since IPs are our identity model.
  • Certain IP addresses are blocked from editing even by logged-in users. As a result, iCloud Private Relay will affect logged-in users as well.
  • Because iCloud Relay only affects Safari browsers, editors in the Wikipedia iOS app will not be affected. Also, iCloud Private Relay subscribers will not be affected when they change their browser.
  • Apple has published the IP ranges that will be used for iCloud Relay, and blocks are currently in place on those ranges.
  • The way to request an IP block exemption (IPBE) is not designed with large numbers or global groups in mind. Even a cautious estimate is that a few thousand logged-in editors will encounter a block. This is far more than existing IPBE processes are set up for. If we don't change the way IPBE works, for those users it will be difficult to ask for and gain exemptions or explanations in their language. What's more, on small and medium wikis there may be no related policies. Also, communities of those wikis may not know how to help the affected users.

Effect statisticsEdit

  • To estimate the potential effect, we looked at the edits coming through Safari browsers. Next, we combined them with estimates around the update of iCloud Private Relay.
    • In the last 90 days, 11.6% of logged-in editors edited with Safari and 17.7% of logged-out editors edited with Safari.
    • We used these numbers and estimated when iCloud Relay will become widespread. We believe 1.6% of logged-in editors and 2.5% of logged-out editors will encounter a block in the month after iCloud Private Relay comes out for macOS. Update - iCloud Private Relay is now integrated, though still opt-in, in MacOS 12 (Monterey), released in November 2021.
    • When iCloud Relay becomes opt out, we estimate 4.6% of logged-in editors and 7.2% of logged-out editors will encounter a block each month.
    • The usage of Safari for editing varies by wiki. Please see the accompanying table for numbers on the most and least affected wikis.
  • We also attempted to estimate how many edits are being prevented because of the range blocks currently in place for iCloud Relay IP ranges.
    • As of the November 2021 release of MacOS 12 Monterey, iCloud Relay is available to all Apple devices running current public releases, including iOS 15. This addition of desktop users is not reflected in the analysis here.
    • We made this estimate by comparing the number of edits being made from iOS 15 to the number of pageviews coming from iOS 15. Next, we split it by whether they are coming through Relay ranges or not. See more details on why we did it this way, along with some assumptions this method makes.
    • For iOS 15 users not using Relay, there are about 241 edits per million page views. For iOS 15 users using Relay, there are about 9 edits per million page views. Applying some arithmetic, this seems to come out to about 120 blocked edits per day right now (as of October 2021).
    • We expect this number to increase as iOS 15 and Relay usage increases, and as Relay becomes available for desktop users.

This table shows the usage of Safari browser for editing in select wikis in recent weeks. There are some with the most usage (Japanese, Swedish, and Norwegian Bokmål Wikipedias) and the least usage (Bengali and Hindi Wikipedias). Note that only a part of Safari users will use iCloud Private Relay.

Wiki Logged-in editors[4] Logged-out editors[5] Logged-in edits[6] Logged-out edits[7]
Overall 11.6% 17.7% 7.9% 14.7%
English Wikipedia 14.4% 22.0% 11.1% 18.8%
Japanese Wikipedia 21.7% 27.3% 16.5% 19.7%
Swedish Wikipedia 18.4% 29.3% 12.8% 26.8%
Norwegian Bokmål Wikipedia 17.1% 31.3% 7.3% 31.5%
Bengali Wikipedia 0.8% 1.4% 0.3% 0.7%
Hindi Wikipedia 1.4% 1.1% 2.7% 2.1%
Wikimedia Commons 8.0% 17.3% 4.5% 10.5%
Wikidata 6.6% 11.9% 4.1% 18.6%

ReferencesEdit

  1. There is no direct evidence that this will certainly happen. This hypothesis is based on market analysis.
  2. See also: Usage share of web browsers.
  3. See also: No open proxies.
  4. Percentage of editing accounts in last 90 days making one or more edits in Safari
  5. Percentage of editing IP addresses during August 2021 making one or more edits in Safari
  6. Percentage of edits from accounts in last 90 days that were made from Safari
  7. Percentage of edits from IPs during August 2021 that were made from Safari