Apple's iCloud Private Relay is Leaking Users' Real IP Addresses

[MacRumors]

Apple's paid Safari protection feature that promises to keep your IP masked doesn't always work, according to security researchers Tommy Mysk and Talal Haj Bakry. It turns out iCloud Private Relay can expose your real IP to websites that use or pretend to use passkeys.

iCloud Private Relay is a service included with paid iCloud+ plans. It is supposed to hide your IP and DNS information when you browse the web using Safari, but it is not a VPN that masks all traffic from a device. Passkeys use the WebAuthn standard, which stores a private key on your device, not the Safari browser. The request the system sends to the website isn't protected by Private Relay and can leak your IP address.

WebKit hands WebAuthn ceremonies to the operating system's credential service, which issues the HTTPS request itself, directly from the device and unaware of any proxy the host app configured. A page can set rpId to a host of its choosing, and the fetch fires even without user interaction: with mediation: "conditional" and no UI ever appears. [...]

Because the fetch is issued by the operating system's credential service rather than by Safari, it never enters Private Relay's proxied path. The destination server sees the device's real IP address either way.

An attacker who wants to find someone's protected IP can do so by setting up a website that uses WebAuthn. There is no visible passkey prompt and no other indication that an IP address has been accessed in the background.

The researchers also found two other WebKit features that can leak IP addresses and DNS data. DNS prefetching (added in iOS 26) reveals a user's real DNS servers, while WebTransport (added in iOS 26.4) can reveal an IP address.

Apple told 404 Media that it is investigating the report.

Mysk and Haj Bakry created a website to let you test whether Apple's service is leaking your IP address. Since the issue is baked into how WebKit works, some third-party browsers are affected too. Apple will need to address the issue, and in the meantime, users can opt for a VPN for more protection.

Article Link: Apple's iCloud Private Relay is Leaking Users' Real IP Addresses

 

[ghostface147]

Come on man. What is going on here?

 

[winxmac]

First, Hide My Email, and now, Private Relay.

 

[alphaod]

I'm pretty sure there's more ways than this for an attacker to find someone's local IP... probably a call to their customer service you can get everyone's SSNs too. Sure this needs a fix, but there's bigger problems than this.

 

[bmot]

Isn’t that a valid legal reason for refunding all users of this subscription fully.

 

[germanbeer007]

"but it is not a VPN that masks all traffic from a device. Passkeys use the WebAuthn standard, which stores a private key on your device, not the Safari browser. The request the system sends to the website isn't protected by Private Relay and can leak your IP address."

Ok?

It's not a real VPN therefore your IP shouldn't be masked at all times. No one has the expectation that your IP is private. So what's the issue?

Sounds to me just more complaining. 🤦‍♂️

 

[coolfactor]

These scenarios may reveal the original IP address for the user, but is that IP address somehow tied to the protected IP address? In other words, can an attacker know for sure which IP addresses all belong to the same individual?

That part isn't clearly explained.

 

[whateverest]

It's not a real VPN therefore your IP shouldn't be masked at all times.

Even with active VPN in iOS, certain traffic is transmitted outside the tunnel.

 

[germanbeer007]

Even with active VPN in iOS, certain traffic is transmitted outside the tunnel.

That's not an iCloud Private Relay specific issue.

 

[apple contributor]

Waa?
Private relay and hide my email are not why i am paying for icloud (but they are a superb addition i use daily). I know some wifi routers block private relay, but it doesn’t matter. That both hide my email and private relay are broken is a little saddening, since apple is built on privacy, but not scandalous.

 

[dominiongamma]

So much for Apple and privacy.

 

[svish]

Too bad that such an issue exists. Should never have been like this. Wonder why such issues happen in the first place. Hopefully Apple will fix it immediately.

 

[tcphoto1]

It's not a fault, it's a feature...

 

[boswald]

I am paying for iCloud+ for other reasons, but this was a nice "peace of mind" benefit I felt comfortable with when using the web. First Hide My Email doesn't work, and now this? What is going on at Apple? If I didn't need the iCloud space I'd cancel (third-party solutions are not an option).

 

[sw1tcher]

iCloud Private Relay is a service included with paid iCloud+ plans. It is supposed to hide your IP and DNS information when you browse the web using Safari,

Apple: Introducing iCloud+ Pro. With iCloud+ Pro, you can now mask your IP address and DNS information when you browse the web."

 

[jwm]

I wonder what the devs are working on this week.

 

[OldNewMBP]

Apple... really?

 

[Mr_Ed]

First, Hide My Email, and now, Private Relay.

I wonder what's next . . . Are they still running those ads about Safari being truly private?

 

[TheDailyApple]

Besides avoiding brand lock-in, this is another excellent reason to use proton.

 

[yabeweb]

What goes on your phone......leaks.

 

[Dorfdad]

"but it is not a VPN that masks all traffic from a device. Passkeys use the WebAuthn standard, which stores a private key on your device, not the Safari browser. The request the system sends to the website isn't protected by Private Relay and can leak your IP address."

Ok?

It's not a real VPN therefore your IP shouldn't be masked at all times. No one has the expectation that your IP is private. So what's the issue?

Sounds to me just more complaining. 🤦‍♂️

Just for the record VPNS do not protect you. Look at latest Microsoft news where they can identify you through vpn’s…

 

[match14]

Is Apple a joke now?

 

[Mr_Ed]

"but it is not a VPN that masks all traffic from a device. Passkeys use the WebAuthn standard, which stores a private key on your device, not the Safari browser. The request the system sends to the website isn't protected by Private Relay and can leak your IP address."

Ok?

It's not a real VPN therefore your IP shouldn't be masked at all times. No one has the expectation that your IP is private. So what's the issue?

Sounds to me just more complaining. 🤦‍♂️

It still looks like Apple is misrepresenting the feature if it actually works as described in the MR post:

WebKit hands WebAuthn ceremonies to the operating system's credential service, which issues the HTTPS request itself, directly from the device and unaware of any proxy the host app configured. A page can set rpId to a host of its choosing, and the fetch fires even without user interaction: with mediation: "conditional" and no UI ever appears. [...]

Because the fetch is issued by the operating system's credential service rather than by Safari, it never enters Private Relay's proxied path. The destination server sees the device's real IP address either way.

While you IP is visible to your ISP, the whole point of private relay seems to be that it is NOT visible beyond that when browsing with Safari. Seem they failed.

 

[sw1tcher]

It's not a real VPN therefore your IP shouldn't be masked at all times. No one has the expectation that your IP is private. So what's the issue?

Sounds to me just more complaining. 🤦‍♂️

Apple says with Private Relay enabled, your privacy is protected, meaning websites cannot see your IP or DNS info

About iCloud Private Relay - Apple Support

iCloud Private Relay — part of an iCloud+ subscription — helps protect your privacy when you browse the web in Safari.

support.apple.com

How Private Relay works

Normally when you browse the web, information contained in your web traffic, such as your DNS records and IP address, can be seen by your network provider and the websites you visit. This information could be used to determine your identity and build a profile of your location and browsing history over time.

iCloud Private Relay is designed to protect your privacy by ensuring that when you browse the web in Safari, no single party — not even Apple — can see both who you are and what sites you're visiting.



Apple even says if you have problems with some websites, you might need to disable Private Relay so sites can see your real actual IP address.

Manage iCloud Private Relay for specific websites, networks, or system settings - Apple Support

Some websites, networks, and services might need to see your IP address or require the ability to audit traffic, perform network-based filtering, or view your browsing history.

support.apple.com

Manage iCloud Private Relay for specific websites, networks, or system settings

Some websites, networks, and services might need to see your IP address or require the ability to audit traffic, perform network-based filtering, or view your browsing history.


If Private Relay isn't designed to hide your actual IP, then what is it for then?

Protect your web browsing with iCloud Private Relay on iPhone

iCloud Private Relay on iPhone hides your IP address and web browsing activity from network providers and websites.

support.apple.com

When you subscribe to iCloud+, you can use iCloud Private Relay to help prevent websites and network providers from creating a detailed profile about you. When iCloud Private Relay is on, the traffic leaving your iPhone is encrypted and sent through two separate internet relays. This prevents websites from seeing your IP address and exact location while preventing network providers from collecting your browsing activity in Safari.

 

[EU-Regulations]

gooPPLE. and what to expect.