[olliej]

From other comments it _sounds_ like Google's system is done as a single proxy, which is bizarre to me because it means google can see every site that is loaded which even for google seems on the nose.

Apple's service is explicitly designed to prevent this exact problem. There's a write up for it on apple's security site (possibly part of the system security doc?). There are intentionally two layers, the connection from the device -> apple's servers, and then the connection from apple's servers to Akamai or cloud flare (or some other CDN). The connection to apple's servers is encrypted to a key from the 2nd layer CDN so apple can't read it, that request is forwarded to the CDN which decrypts it makes the request, then encrypts the response to the client's key and sends that to apple, apple forwards that encrypted blob on to the originating device which can then decrypt it.

The end result is apple cannot ever see the destination or response, and the backend CDN can't see the device that made the request. That should be the design of _any_ privacy conscious proxy service (including all the questionable "privacy!" VPNs). That's kind of why I'm surprised that the claim is that Google's service is a single layer - it's so blatantly invasive.

[ripply]

It’s not a single layer, it is designed the same way apples service runs. This is addressed in the article.

[JimDabell]

As justinclift points out elsewhere in this discussion, the article may have misreported that:

> We are considering using 2 hops for improved privacy. A second proxy would be run by an external CDN, while Google runs the first hop. This ensures that neither proxy can see both the client IP address and the destination.

— https://github.com/GoogleChrome/ip-protection#core-requireme...

If they choose to go ahead with the second hop it would be the same as Apple’s approach. But it sounds like this has not been committed to yet.

[olliej]

This is what I was unclear on - I couldn't tell if this was one-hop (and so tremendously invasive "privacy"), or two hops through an independent 3rd party (and so actually a privacy feature).

[olliej]

In that case the complaints other comments people are making are simply wrong. There isn't a privacy concern here, I think google has just burned so much trust that the _assumption_ is now that the goal is tracking.