Apple's iCloud Private Relay is Leaking Users' Real IP Addresses

[onenorth]

Well for starters, quoting the right terms of service would be helpful. iTunes and App Store ToS have no bearing on iCloud. Good thing there are lawyers much better versed in legalese and suits are already in the works.

I quoted the MacOS ToS.

 

[OnePieceIsReal]

A couple of VPN providers have such "Kill Switches" for non tunneled traffic. But I doubt they can override routing of iOS self generated traffic. Needs to be tested in any case.

I believe they were first to fully figure it out but it’s why they warn people if you plan to update app you need to turn that off or you will be in limbo,

 

[noanker]

Fantastic priorities: Apple can update the interface with corporate virtue signals, but its supposedly “Private” Relay can let a website unmask your real IP without so much as a warning - privacy as branding, security as an afterthought, and then cash the subscription checks and call it progress.

 

[The1stHelmetUser]

Good catch, but if think the page the researchers have created and the app behind the research test page, psylo.app does not show nothing new. The Webauthn standard expose the IP by the protocol definition. What is the big deal here maybe the Private Relay. It has operational limitations too.

Worth to say that the app behind the test page probably also can not bypass JA4+ fingerprinting techniques, I haven't even found a single mention about this fingerprint on their website, blog, etc. Curisouly this fingerprints are today on the mainstream CDNs and major vendors on the Internet security industry, most of the times not to track users but to protect them against fraudsters btw. but anyway. Many vendors and marketers trying to push their fantasy solutions.

Selling privacy is very hard today since there are thousands of ways to identify IPs, devices, etc. It is better not be born though.

 

[paranoidgraylady]

How do I get a refund? I've been using both Hide my Email and Private relay. Thanks in advance /N

So should I turn off the two WebKit settings above? Should I turn off private relay?
WebKit settings always look suspicious to me about 75% of the time but when I look them up they seem benign or ok. On the other hand, I often see the information from apple and I didn’t trust them before this recent debacle, now it’s just confirming what I read ages ago and as recently as today in the “privacy” practices. They need a lot more practice.
Thanks for your advice in advance, or anyone else who has any about WebKit settings for MAX privacy and I don’t care about anyone else. Sorry, but my phone, my data.

 

[I7guy]

So should I turn off the two WebKit settings above? Should I turn off private relay?
WebKit settings always look suspicious to me about 75% of the time but when I look them up they seem benign or ok. On the other hand, I often see the information from apple and I didn’t trust them before this recent debacle, now it’s just confirming what I read ages ago and as recently as today in the “privacy” practices. They need a lot more practice.
Thanks for your advice in advance, or anyone else who has any about WebKit settings for MAX privacy and I don’t care about anyone else. Sorry, but my phone, my data.

You can turn off the settings and then will have privacy none of the time vs some (until Apple closes the loop on this) of time if the settings are left on.

 

[Acidsplat]

It looks like macOS 27 beta 6 and iOS 27 beta 6 fixed this, because I'm not seeing my IP leaked on the test site: https://leaks.psylo.app/

Can someone also confirm?