Apple’s Private Relay Isn’t So Private After All, Can Leak Your IP Address
Surprisingly, one culprit behind the leak is passkey technology, which is supposed to be a more secure way to authenticate data such as site logins.
Apple's iCloud Private Relay, designed to protect users' web traffic, may not be as private as advertised. Security researchers at Mysk discovered that even with iCloud Private Relay active, a device's IP address can still be transmitted, potentially revealing a person's identity or location. This feature, available to paid iCloud Plus subscribers, routes web traffic through proxy servers to hide the user's IP address and the website being visited. However, it does not function as a VPN, which encrypts all internet traffic.
Researchers Talal Haj Bakry and Tommy Mysk created a test website to check if iCloud Private Relay could be compromised. When tested on an iPhone 17 Pro and a MacBook Pro with iCloud Private Relay enabled, the test confirmed the IP address of the user's home internet router. In a statement on X, the researchers explained they chose to publicize the vulnerability rather than report it to Apple first.
The researchers explained that reporting the issue would involve a lengthy process with inconsistent communication, while they felt it was important to expose the issue immediately.
The researchers identified three main ways that iCloud Private Relay can fail to protect users' IP addresses. First, when signing into websites using passkeys, WebKit bypasses the Private Relay proxy and sends data directly from the device, exposing the real IP address. Second, DNS prefetching, a method for speeding up website connections, can pass data directly from the user's network to the website, bypassing the Private Relay mechanism if the website includes the necessary code in its HTML.
Third, WebTransport, a low-latency method, can open a direct connection that bypasses the Private Relay and sends the user's real IP address.
Apple has faced criticism before, with a recent bug in iCloud Hide My Email, another paid feature, seemingly exposing users' real email addresses. This issue is now the subject of a lawsuit accusing Apple of false advertising, fraud, and breach of contract.
Written by urgent.news from CNET's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
