Apple's iCloud Private Relay is Leaking Users' Real IP Addresses
Apple's paid Safari protection feature that promises to keep your IP masked doesn't always work, according to security researchers Tommy Mysk and Talal Haj Bakry . It turns out iCloud Private Relay can expose your real IP to websites that use or pretend to use passkeys. ‌iCloud‌ Private Relay is a service included with paid ‌iCloud‌+ plans. It is supposed to hide your IP and…
Security researchers Tommy Mysk and Talal Haj Bakry have discovered a flaw in Apple's iCloud Private Relay, a paid feature designed to protect users' IP addresses while browsing Safari. Despite its claims to mask the IP and DNS information, the service fails to secure the request sent to websites using passkeys, which employ the WebAuthn standard.
This flaw allows the real IP address to be exposed to websites even when Private Relay is active, as the request bypasses the feature and reaches its destination server directly. The issue occurs because the request is issued by the operating system's credential service, not by Safari, and thus never enters Private Relay's proxied path.
In addition, two other WebKit features, DNS prefetching and WebTransport, can also lead to IP and DNS data leakage. Apple has acknowledged the report and is investigating the matter. However, as the flaw is inherent to WebKit, it may affect other third-party browsers as well. To mitigate the risk, users can consider using a VPN for additional protection.
Written by urgent.news from MacRumors's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- Apple's 'Private Relay' Is Exposing Users' Real IP Addresses yro.slashdot.org
- Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses thehackernews.com
- Apple's iCloud Private Relay feature is leaking users' real IP addresses techspot.com
- Apple's ‘Private Relay’ Is Exposing Users’ Real IP Addresses 404media.co
- Apple's Private Relay tool can leak users' IP addresses — with OnionBrowser also affected techradar.com
