Apple's iCloud Private Relay is Leaking Users' Real IP Addresses

Apple's paid Safari extortion diagnostic that promises to support your IP masked doesn't ever work, according to information researchers Tommy Mysk and Talal Haj Bakry. It turns retired iCloud Private Relay tin exposure your existent IP to websites that usage oregon unreal to usage passkeys.


‌iCloud‌ Private Relay is simply a work included with paid ‌iCloud‌+ plans. It is expected to fell your IP and DNS accusation erstwhile you browse the web utilizing Safari, but it is not a VPN that masks each postulation from a device. Passkeys usage the WebAuthn standard, which stores a backstage cardinal connected your device, not the Safari browser. The petition the strategy sends to the website isn't protected by Private Relay and tin leak your IP address.
WebKit hands WebAuthn ceremonies to the operating system's credential service, which issues the HTTPS petition itself, straight from the instrumentality and unaware of immoderate proxy the big app configured. A leafage tin acceptable rpId to a big of its choosing, and the fetch fires adjacent without idiosyncratic interaction: with mediation: "conditional" and nary UI ever appears. [...]

Because the fetch is issued by the operating system's credential work alternatively than by Safari, it ne'er enters Private Relay's proxied path. The destination server sees the device's existent IP code either way.
An attacker who wants to find someone's protected IP tin bash truthful by mounting up a website that uses WebAuthn. There is nary disposable passkey punctual and nary different denotation that an IP code has been accessed successful the background.

The researchers besides recovered 2 different WebKit features that tin leak IP addresses and DNS data. DNS prefetching (added successful iOS 26) reveals a user's existent DNS servers, portion WebTransport (added successful iOS 26.4) tin uncover an IP address.

Apple told 404 Media that it is investigating the report.

Mysk and Haj Bakry created a website to fto you trial whether Apple's work is leaking your IP address. Since the contented is baked into however WebKit works, immoderate third-party browsers are affected too. Apple volition request to code the issue, and successful the meantime, users tin opt for a VPN for much protection.
This article, "Apple's iCloud Private Relay is Leaking Users' Real IP Addresses" archetypal appeared connected MacRumors.com

Discuss this article successful our forums