Fast Company:

Whenever a technology comes along that gives us more privacy, it seems that those who want their hands on our data come up with new, creative ways to get it.

But does Apple also feel like it’s in a cat-and-mouse game? That’s the question that I put to Craig Federighi, the company’s senior vice president of software engineering, when I spoke to him about Apple’s newest privacy features in advance of today’s keynote. We also talked about the company’s new iCloud Private Relay (a “VPN killer” as some tech pundits are sure to call it), Apple’s role versus the governments in playing privacy regulator, and user uptake of the iPhone’s new App Tracking Transparency feature, which is so unpopular with a very blue social network.

And:

The obvious comparison people will make is that iCloud Private Relay is Apple’s version of a VPN (something I have called for in the past for the company to offer). But from an engineering perspective, Private Relay’s privacy protections make VPNs look weak.

With a traditional VPN, users’ internet traffic is encrypted and then sent to the VPN’s server, which masks the IP and routes the data on to the websites users want to access. This keeps your ISP from knowing what site you are visiting and the destination website from knowing your actual IP address. But it still leaves one gaping privacy hole: the VPN provider itself knows your real IP and the websites you’re visiting.

And:

This is where iCloud Private Relay comes in—and puts VPNs to shame. iCloud Private Relay uses a dual-hop architecture. When you navigate to a website through Safari, iCloud Private Relay takes your IP address, which it needs to connect you to the website you want to go to, and the URL of that site. But it encrypts the URL so not even Apple can see what website you are visiting. Your IP and encrypted destination URL then travels to an intermediary relay station run by a third-party trusted partner. Apple would not name these trusted partners, but says the company is working with some of the largest content providers out there. Before getting to this relay station, however, your IP address is anonymized and randomized, so the relay partner can’t identify you or your device. Then at the relay station, the destination URL is unencrypted, so the third-party provider can send you on to the website you want to go to.

I thought this was a terrific explanation of Private Relay. Key to this is the trust Apple places in its trusted partner relay stations. But the fact that your requests/data leave Apple anonymized and randomized mean even if a bad actor gets in the loop, any impact should be blunted.

Follow the link, read on for Craig Federighi’s comments, both on Private Relay and privacy. Good read.