Michael Horowitz
michaelhorowitz.com · Personal blog · on HN since 2020
Michael Horowitz writes about computer security and privacy, covering passwords, VPNs on iOS, router setup, and Windows telemetry.
What HN saysHN commenters cite his VPNs-on-iOS post as evidence that iOS VPNs do not cover all traffic, and his password advice for being clear.
18HN people shared it
8linked it in comments
10stories submitted
805story points
1 year agolast shared
2020people per year2026
Most-shared posts
- 1VPNs on iOS are a scam8 people · 531 points · first shared 2022 · 243 comments on HN
- 2Hover a mouse over a link – just don't trust the results3 people · 15 points · first shared 2020 · 9 comments on HN
- 3The world's BEST password advice3 people · 3 points · first shared 2022 · 1 comments on HN
- 4Windows 10 spies on your use of System Settings (2021)1 people · 155 points · first shared 2025 · 159 comments on HN
- 5Windows Update vs. My Router1 people · 67 points · first shared 2022 · 68 comments on HN
- 6A new aspect of Google's spying1 people · 34 points · first shared 2024 · 6 comments on HN
- 7Second.router.for.wfh1 people · first shared 2021
What HN people wrote when they linked it
DefensiveComput · 2022-08-17
The detailed blog on passwords is quite clear that very often people need more than one approach to dealing with passwords because all passwords are not the same.
https://michaelhorowitz.com/BestPasswordAdvice.php
A formula is one approach that people should consider and it is often overlooked. The blog also makes a clear distinction between hard and soft formulas (my terms) A soft formula can not be cracked, even if many of the passwords leak.
Michael Horowitz
aspenmayer · 2024-10-24
PhilippGille · 2022-12-19
You say that the VPN is always on, but wasn't there a post on HN some time ago that showed that on iOS VPN is not 100% used for all data? Might have been this one: https://www.michaelhorowitz.com/VPNs.on.iOS.are.scam.php
So potentially your real IP was leaked otherwise, Google became aware of that IP and geolocated you, without Maps data?
jacooper · 2022-10-12
Android only leaks connection checks.
While on IOS any system app doesn't use the VPN or DNS requests.
VPNs are useless on iOS, and its made to be this way, again the "privacy OS" isn't privacy focused at all.
https://www.michaelhorowitz.com/VPNs.on.iOS.are.scam.php
butterNaN · 2022-08-22
iOS fails in providing basic security feature viz. VPN. https://www.michaelhorowitz.com/VPNs.on.iOS.are.scam.php
brasic · 2022-08-21
Read the primary source:
https://www.michaelhorowitz.com/VPNs.on.iOS.are.scam.php
This includes WiFi as well.
egberts1 · 2022-08-21
Apple App Store mandates that their Apple network infrastructure shall not be impacted by an app (VPN, TailScale, WireGuard, et. al.)
In addition to unimpeded Apple network pathway, DNS resolver is being resolved by Apple DNS recursive DNS server during your tunneling setup, arguably resolving even just the IP address(es) as well as DNS names of VPN server.
More on this sad saga of Apple iOS and VPN, et. al.:
https://www.michaelhorowitz.com/VPNs.on.iOS.are.scam.php#wherestands
Edit: of course, an external router would only leverage the WiFi part of iOS. We could use just the WiFi part of iOS and totally ignore the mysterious cellular traffic.
tyingq · 2021-03-17
The author of the article has some suggestions here:
https://www.michaelhorowitz.com/second.router.for.wfh.php
and here:
https://routersecurity.org/checklist.php