Don't Let FaceTime Become Literal

Apple’s FaceTime, by default, has privacy concerns. When a call is initiated — and for the duration of the call — a peer-to-peer connection is established between both ends of the call. That’s fine, and it’s not any sort of misconfiguration.

What it is, though, is a factor that privacy-conscious and non-technical people might overlook. This design decision means that anyone sitting between you and the other side(s) of your call could theoretically collect both sides’ IP addresses.

Here’s what it looks like from a single device’s perspective during a FaceTime call. Every entry below is one observed flow on UDP port 16393 — both source and destination — talking to the same residential IP on the far end:

Does this matter?

Let’s start from some key assumptions:

• A. You know FaceTime is encrypted
• B. You care about that fact
• C. You have privacy concerns, or
• D. You’re petulant towards surveillance states

The key problem here is that the far side of communications is being exposed. If someone is simply monitoring their own network on the other end of your conversation (or sitting at the right points in between), they can do this:

So what?

As former NSA director Michael Hayden once put it: metadata kills. Encryption protects the contents of a conversation — it doesn’t protect the fact that the conversation happened, who it happened with, or where they were sitting at the time.

If any of A–D up there apply to you, the mitigation is boring but it works:

• Use a VPN on the device making the call — your peer sees the VPN’s exit IP, not your home connection
• Pick partners who do the same — your privacy is only as good as the less-careful side
• Or pick a different app — anything that relays through provider infrastructure (Signal, WhatsApp voice in some modes) doesn’t expose endpoints the same way

Stay safe out there. 🌸