AI Generated Image
Apple's ‘Private Relay’ Is Exposing Users’ Real IP Addresses
404 Media • • general
Key Points:
- Security researchers discovered that Apple’s iCloud Private Relay, designed to hide users’ IP addresses on iOS Safari, can leak real IP addresses due to issues in Apple’s WebKit browser engine and how passkeys operate.
- The vulnerability allows malicious websites to bypass Private Relay protections because certain web requests made by the device’s credential service occur outside the browser, exposing the user’s true IP address.
- These flaws also affect OnionBrowser, a Tor-based iOS app, potentially compromising user anonymity, though the official Tor Browser from the Tor Project remains unaffected.
- This is the second recent privacy flaw in Apple’s paid services after a Hide My Email bug was found to reveal real email addresses, which Apple had known about for over a year before fixing.
- Apple has acknowledged the report and is investigating the issue, while affected developers have expressed concern over the severity and timing of a fix.
