Toggle sidebar Toggle sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Apple's iCloud Private Relay is Leaking Users' Real IP Addresses

germanbeer007 said:
Your link literally says:

"to help prevent websites and network providers from creating a detailed profile about you"

not

"to prevent websites and network providers from creating a detailed profile about you"
Click to expand...
Sure, go ahead and address something I never touched on (websites and network providers creating a detailed profile on users) and just ignore what I put in bold.

The topic is about Private Relay revealing users' IP address when it's suppose to prevent websites from seeing it.

Protect your web browsing with iCloud Private Relay on iPhone

iCloud Private Relay on iPhone hides your IP address and web browsing activity from network providers and websites.
support.apple.com support.apple.com

When you subscribe to iCloud+, you can use iCloud Private Relay to help prevent websites and network providers from creating a detailed profile about you. When iCloud Private Relay is on, the traffic leaving your iPhone is encrypted and sent through two separate internet relays. This prevents websites from seeing your IP address and exact location while preventing network providers from collecting your browsing activity in Safari.
 
  • Like
Reactions: paranoidgraylady, Sincci, JohnWick1954 and 7 others
germanbeer007 said:
The goal of iCloud Private relay is to *help* protect privacy. Any user who needs protection for all device traffic would rely on VPN. Private relay deals with Safari traffic, WebAuthn fetch is a security-service request which happens outside of Safari (even in apps which majority understandably do not expect any level of protection via private relay).

A website can autolaunch an installed app too where private relay does not protect the user from.
Click to expand...
Lol! Your whole argument seems to be "Well, its on you (the user) for relying on what Apple says. You should use a VPN instead."

Apple's own documentation (check out what @sw1tcher posted for you) claims to hide your IP address from websites when browsing with Safari while using a facility included in a service they charge money for. It is not doing that. End of story.

And congratulations on describing why it doesn't work, just like the original MR post did and I quoted in my post.
 
  • Like
Reactions: gusmula, JohnWick1954, insomniac86 and 3 others
It may be time to just get off the internet except in certain limited and necessary cases. Both Private Relay and Hide My Email don’t seem to work… and both of the ad-blockers I have installed on my device don’t block much anymore. The ******tification of the internet has brought us to a point where it may not be worth the trouble anymore. At least that’s how I feel today.
 
  • Sad
  • Like
Reactions: paranoidgraylady and gusmula
Mr_Ed said:
Lol! Your whole argument seems to be "Well, its on you (the user) for relying on what Apple says
Click to expand...
Apple said "you can use iCloud Private Relay to help prevent websites and network providers from creating a detailed profile about you. ".

it doesn't say "you can use iCloud Private Relay to prevent websites and network providers from creating a detailed profile about you. "


Lol!
 
  • Haha
  • Like
Reactions: CyberGene, jhwalker and BigMcGuire
bmot said:
Isn’t that a valid legal reason for refunding all users of this subscription fully.
Click to expand...

I do think it's grounds for a class action suit which will refund the lawyers fully, and might get us each an Airtag or something-- but it would inflict some modicum of pain on Apple for getting it wrong, and that's important.

Private Relay doesn't obscure all traffic, that's obvious, but it was reasonable to expect it obscured web traffic. This is a fairly trivial work around and the standard of service shouldn't be "private unless they actually try".
 
svish said:
Too bad that such an issue exists. Should never have been like this. Wonder why such issues happen in the first place. Hopefully Apple will fix it immediately.
Click to expand...
There is just one reason this happens, and no Apple won't be fixing it because they lack the skill to do so at this point in time. I'm not even sure what they're doing over there anymore.

Have been using Apple's products since the Apple II. Still am.
Not happy.

Not because of just this. It's just Apple in 2026.
...and Apple in 2025, 2024, 2023 and so on going back to well before Covid. The M1 was the good piece that came out during that time period (and the following M-series chips and computers that use them, hardware wise). The M-series is great, but I'd expect a multi-trillion dollar corporation to be doing just a bit more, or at least pretend that they're even trying.

For many years now, Apple isn't the Apple many of us know or knew and grew up with. They have just dropped the entire ball at this point. Again, this isn't about private relay passkey leaks. It's just about the company and its products, services and attitude in the past many years.

No real better place to go to at this time either.
Sure, I use Linux also for work, but not much or enough. And as far as it has come, it's still nowhere near even this level of macOS that we have.

Sadly Apple (or Microsoft), take your pick, has us all pretty locked in. It's iPhone or Android for mobile, and yet again, I'm not really even sure anymore who the winner or loser really is.

Sad state of things all around that I never thought I'd see from this company.
 
  • Like
  • Love
  • Sad
Reactions: paranoidgraylady, gusmula, 01cowherd and 4 others
Analog Kid said:
I do think it's grounds for a class action suit which will refund the lawyers fully, and might get us each an Airtag or something-- but it would inflict some modicum of pain on Apple for getting it wrong, and that's important.

Private Relay doesn't obscure all traffic, that's obvious, but it was reasonable to expect it obscured web traffic. This is a fairly trivial work around and the standard of service shouldn't be "private unless they actually try".
Click to expand...
Remember the infamous "facetime bug"? That didn't get very far in the courts. Who knows what can happen if a lawsuit is filed related to this issue.
 
germanbeer007 said:
"but it is not a VPN that masks all traffic from a device. Passkeys use the WebAuthn standard, which stores a private key on your device, not the Safari browser. The request the system sends to the website isn't protected by Private Relay and can leak your IP address."

Ok?

It's not a real VPN therefore your IP shouldn't be masked at all times. No one has the expectation that your IP is private. So what's the issue?

Sounds to me just more complaining. 🤦‍♂️
Click to expand...
I kind of thought private relay was a kind of “hides some stuff, sometimes” thing that reduced your internet footprint and made it harder to connect the dots.

It doesn’t make you invisible, and there are plenty of times when I am warned it’s not available at all.
 
alphaod said:
I'm pretty sure there's more ways than this for an attacker to find someone's local IP... probably a call to their customer service you can get everyone's SSNs too. Sure this needs a fix, but there's bigger problems than this.
Click to expand...

There are always bigger problems. Doesn't mean that a problem is not a problem and shouldn't be brought to light and addressed.

It's a paid privacy service that's not working as advertised.
 
  • Like
  • Love
Reactions: paranoidgraylady and JohnWick1954
triumvirate said:
If Apple can’t get this and Hide my Email right with iCloud, why should people trust them with all of their personal data in iCloud storage? Apple used to chest-pump about their extremely serious concern for user privacy… seems the bean counters have other priorities.
Click to expand...

Remember the CSAM fiasco? That's when I completely stopped taking their claims of being focused on privacy as much more than marketing.

Use Cryptomator or something similar for any info that needs protecting. Use Bitwarden for financials and other important passwords. Use Apple software for stuff where convenience is important enough to somewhat sacrifice security.
 
  • Like
Reactions: paranoidgraylady
For a company like Apple that usually leaves not stone unturned, this bug looks glaring. How did they miss this during testing? Same issue with Hide my email. Unless maybe it was a feature provided by Apple to the ad business.
 
germanbeer007 said:
Apple said "you can use iCloud Private Relay to help prevent websites and network providers from creating a detailed profile about you. ".

it doesn't say "you can use iCloud Private Relay to prevent websites and network providers from creating a detailed profile about you. "


Lol!
Click to expand...
I honestly don’t know what else to say. If you had stopped after the initial bad take, people probably would’ve laughed it off and moved on. But you keep coming back and doubling down, now using one weaker, general marketing line to dodge Apple’s much stronger and more specific technical promise. It’s getting a little awkward to watch.

It’s a bug. Bugs happen. Chrome has plenty of security bugs too. The difference here is that people are paying for this service, which is why Apple is getting so much criticism over it.

There really isn’t anything to defend Apple on here.

Edit: typo
 
  • Like
Reactions: SnowCrocodile and JohnWick1954
Sami13496 said:
I have turned off Private Relay because it slows down website loading too much.

I only visit websites that I know are trustworthy.
Click to expand...
Safari’s security is fairly good, and it can block many malicious attacks. But Private Relay isn’t really meant to improve that security. Its main purpose is to anonymize your identity and make it harder for advertising companies to profile you.

No matter how trustworthy a website is, there may still be tracking pixels logging your visits, clicks, scrolling behavior, and other activity, then sending that data to advertisers along with my IP address which is one of the strongest ID. Just look at something like the Snowflake Marketplace.

It may not harm me directly or immediately, but eventually, if not already, they’ll have enough data to predict my behavior and influence what I buy. For example, they might determine that I like a certain product more when it is shown in red, so they start showing me ads featuring the red version.

A lot of people simply don’t like being profiled and manipulated that way.
 
  • Like
Reactions: paranoidgraylady
I have mixed feelings on Private Relay. It has been stable recently but it has had outages in the past. It also isn't super fast, those of us with fiber GBPS+ ISP plans.

https://objective-see.org/ As someone who has used products from this site - I'm also aware of the limitations of Private Relay. Most people don't want to deal with the downsides of real security.

Interesting...
 
Typical American reaction… courts… cue the class action lawfare.

Years before the Snowden revelations I had a relative working at 🇨🇦 CSIS who simply told me never to do anything online or in a text message risky because it could be front page news the next day.

All your international phone call call and text messages are already monitored by your government.
 
  • Disagree
  • Like
Reactions: paranoidgraylady and SnowCrocodile
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back