Apple's 'Private Relay' Is Exposing Users' Real IP Addresses
Security researchers found that Apple's iCloud Private Relay can expose users' real IP addresses because some passkey-related requests bypass Safari and its proxy protections at the operating-system level. "In short: any website that supports, or pretends to support, passkeys can see the user's real IP address despite having iCloud Private Relay on," security researcher Tommy Mysk, who discovered…
A security research duo, Tommy Mysk and Talal Haj Bakry, uncovered an issue with Apple's iCloud Private Relay service. According to their findings, published by 404 Media, passkey-related requests can bypass Safari's proxy protections and reveal users' real IP addresses. The researchers developed a test website, which successfully revealed the real IP address of a user protected by Private Relay.
This occurs because, in the case of passkeys—a secure alternative to usernames and passwords—user devices issue web requests outside of the browser, bypassing Private Relay's protections. The destination server sees the user's real IP address, regardless of the user's interaction with the website. Apple has been informed about the issue and has responded with a dire warning, but no timeline has been provided for a resolution.
Written by urgent.news from Slashdot's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- Apple's iCloud Private Relay is Leaking Users' Real IP Addresses macrumors.com
- Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses thehackernews.com
- Apple's iCloud Private Relay feature is leaking users' real IP addresses techspot.com
- Apple's ‘Private Relay’ Is Exposing Users’ Real IP Addresses 404media.co
- Apple's Private Relay tool can leak users' IP addresses — with OnionBrowser also affected techradar.com
