Apple’s iCloud Private Relay isn’t as private as you think
New research shows Apple's iCloud Private Relay can quietly leak your real IP address through passkeys, and Apple says it's now investigating the issue.
Apple's iCloud Private Relay, designed to hide your IP address while browsing, may not be as private as advertised, according to recent research by security experts Tommy Mysk and Talal Haj Bakry. The researchers found that Private Relay fails to conceal your IP address fully. This happens because passkeys, when requested by a website, bypass Safari and Private Relay.
Instead, the website directly receives the validation file from your iPhone's credential service, which fetches the file using your real IP address. Websites that support or pretend to support passkeys can thus see your actual IP address, even with Private Relay turned on. This issue is not exclusive to Private Relay; Apple's Hide My Email tool has also inadvertently exposed users' real email addresses.
However, regular VPNs are unaffected as they encrypt all device traffic, not just browser traffic. Apple is reportedly investigating the researchers' findings, and users relying on Private Relay for sensitive activities might consider switching to a full VPN until the issue is resolved.
Written by urgent.news from Digital Trends's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
