This week's iOS 27 beta is taking a while. Are devs at Apple all working to have this Private Relay mess cleaned by next week?
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Apple's iCloud Private Relay is Leaking Users' Real IP Addresses
- Thread starter MacRumors
- Start date
- Sort by reaction score
I7guy
macrumors Westmere
They just broke an earnings record, so no.
I7guy
macrumors Westmere
Moar emoji. /s Don't believe development work at apple is single threaded, nor constrained by marketing or emojis (as has been suggested at various points in time)
Last edited:
Yes, the website sends out such a request that unmasks the real IP address and receives a reply from a different IP address. Comparing timestamps will probably be enough to link it as request and reply would probably be less than a second apart. Assuming the request takes 30ms to get there and another 30ms for the return trip plus the Apple device processing time it could be as quick as a tenth of a second. And if you're unsure you can probably have your website repeat the request.
In any case, the entire point of that private relay function is to hide the real ip address from websites when browsing Safari and it doesn't do that. Even when this is fixed I don't think Apple is doing their customers any favors offering this service. It doesn't meaningfully protect the user and instead it's more likely to give users a false sense of security. It's also notoriously hard if not impossible to prevent "leaks" with VPN and VPN based services like Private Relay.
These things are good enough to get around geo blocking but evidently even a privacy focused tech giant like Apple can't guarantee that their Private Relay keeps their users' IP addresses private. If that's not warning enough that these offerings aren't to be trusted I don't know what is.
If Apple can’t get this and Hide my Email right with iCloud, why should people trust them with all of their personal data in iCloud storage? Apple used to chest-pump about their extremely serious concern for user privacy… seems the bean counters have other priorities.
No, it doesn't. Just opened test website that checks the problem. They see my real IP address.
Queues
macrumors regular
Looking forward to receiving $4.83 in class-action lawsuit money from this in 2028
How do I get a refund? I've been using both Hide my Email and Private relay. Thanks in advance /N
Apple's paid Safari protection feature that promises to keep your IP masked doesn't always work, according to security researchers Tommy Mysk and Talal Haj Bakry. It turns out iCloud Private Relay can expose your real IP to websites that use or pretend to use passkeys.
iCloud Private Relay is a service included with paid iCloud+ plans. It is supposed to hide your IP and DNS information when you browse the web using Safari, but it is not a VPN that masks all traffic from a device. Passkeys use the WebAuthn standard, which stores a private key on your device, not the Safari browser. The request the system sends to the website isn't protected by Private Relay and can leak your IP address.
An attacker who wants to find someone's protected IP can do so by setting up a website that uses WebAuthn. There is no visible passkey prompt and no other indication that an IP address has been accessed in the background.
The researchers also found two other WebKit features that can leak IP addresses and DNS data. DNS prefetching (added in iOS 26) reveals a user's real DNS servers, while WebTransport (added in iOS 26.4) can reveal an IP address.
Apple told 404 Media that it is investigating the report.
Mysk and Haj Bakry created a website to let you test whether Apple's service is leaking your IP address. Since the issue is baked into how WebKit works, some third-party browsers are affected too. Apple will need to address the issue, and in the meantime, users can opt for a VPN for more protection.
Article Link: Apple's iCloud Private Relay is Leaking Users' Real IP Addresses
Thanks for giving me another good reason to not use passkeys.
turbineseaplane
macrumors Penryn
Astuces iOS
macrumors 68030
Mr. Heckles
macrumors 68000
They should change their name to Butter, because they are on a roll lately. 1st, hide my email and not this.
This is why it’s better to use a VPN anyways.
This is why it’s better to use a VPN anyways.
sw1tcher
macrumors 604
I hear Apple's working on it right now. They're going to call it Private Refund. The service will issue automatic refunds as well as how Private Relay works at hiding a user's IP address.
This cannot be true, for Apple has decreed that privacy is a human right!
But seriously, Apple never seeks to be first but to be the best and doesn’t comment on future products. Stay tuned!
But seriously, Apple never seeks to be first but to be the best and doesn’t comment on future products. Stay tuned!
Mrkevinfinnerty
macrumors 68040
The goal of iCloud Private relay is to *help* protect privacy. Any user who needs protection for all device traffic would rely on VPN. Private relay deals with Safari traffic, WebAuthn fetch is a security-service request which happens outside of Safari (even in apps which majority understandably do not expect any level of protection via private relay).
A website can autolaunch an installed app too where private relay does not protect the user from.
Apple says with Private Relay enabled, your privacy is protected, meaning websites cannot see your IP or DNS info
About iCloud Private Relay - Apple Support
iCloud Private Relay — part of an iCloud+ subscription — helps protect your privacy when you browse the web in Safari.support.apple.com
How Private Relay works
Normally when you browse the web, information contained in your web traffic, such as your DNS records and IP address, can be seen by your network provider and the websites you visit. This information could be used to determine your identity and build a profile of your location and browsing history over time.
iCloud Private Relay is designed to protect your privacy by ensuring that when you browse the web in Safari, no single party — not even Apple — can see both who you are and what sites you're visiting.
Apple even says if you have problems with some websites, you might need to disable Private Relay so sites can see your real actual IP address.
Manage iCloud Private Relay for specific websites, networks, or system settings - Apple Support
Some websites, networks, and services might need to see your IP address or require the ability to audit traffic, perform network-based filtering, or view your browsing history.
Manage iCloud Private Relay for specific websites, networks, or system settings
Some websites, networks, and services might need to see your IP address or require the ability to audit traffic, perform network-based filtering, or view your browsing history.
If Private Relay isn't designed to hide your actual IP, then what is it for then?
Protect your web browsing with iCloud Private Relay on iPhone
iCloud Private Relay on iPhone hides your IP address and web browsing activity from network providers and websites.
When you subscribe to iCloud+, you can use iCloud Private Relay to help prevent websites and network providers from creating a detailed profile about you. When iCloud Private Relay is on, the traffic leaving your iPhone is encrypted and sent through two separate internet relays. This prevents websites from seeing your IP address and exact location while preventing network providers from collecting your browsing activity in Safari.
Your link literally says:
"to help prevent websites and network providers from creating a detailed profile about you"
not
"to prevent websites and network providers from creating a detailed profile about you"
What's next? Mail Privacy Protection? (I’m pretty sure it works maybe 30% of the time).
E2EE that is not E2EE? (technically it’s not because E2EE means zero knowledge and Apple's ADP is NOT zero knowledge).
Apple services are an afterthought at best and a joke at worst.
E2EE that is not E2EE? (technically it’s not because E2EE means zero knowledge and Apple's ADP is NOT zero knowledge).
Apple services are an afterthought at best and a joke at worst.
Apple not worried about this one. Negotiated small percentage of the 99 cents month.
I7guy
macrumors Westmere
They shouldn’t. Don’t give it to Apple, take it to a competitor. However you might not be aware there is a different thing about having policies stating how your PII is handled and bugs in the software.