Apple's iCloud Private Relay May Reveal Your True IP Address to Websites Unbeknownst to You

Concerns Arise Over Apple’s iCloud Private Relay Privacy Feature

Recent findings have cast a shadow over Apple’s iCloud Private Relay, a feature developed to enhance user privacy while browsing the internet. Researchers have disclosed that certain requests can compromise the very privacy iCloud Private Relay aims to protect, revealing users’ real IP addresses to websites without any notification.

The Discovery

Security researchers Tommy Mysk and Talal Haj Bakry unveiled the unsettling details surrounding iCloud Private Relay's vulnerabilities. They reported that specific requests tied to passkeys can circumvent the privacy feature integrated into iCloud+. Furthermore, they noted that a variety of WebKit functions might inadvertently leak users’ IP and DNS data.

Impact on Users

• Passkey-Related Requests: Requests linked to Apple’s new authentication system can directly expose users' real IP addresses to websites.
• WebKit Functions: Various functionalities within WebKit could further contribute to the inadvertent leakage of sensitive information.
• Third-Party Browsers: The issue is not confined to Apple’s own Safari browser; some third-party browsers utilizing WebKit may also be impacted.

Potential Risks

This revelation raises several concerns for users who rely on iCloud Private Relay to maintain their online anonymity. By exposing real IP addresses, websites could potentially track users' browsing habits, undermining the core promise of privacy that is crucial for digital safety.

Apple's Response

In light of these findings, Apple has acknowledged the issue and is currently investigating the extent of the leaks. The tech giant has yet to provide a timeline for when a resolution may be implemented or whether any countermeasures are already in development.

What This Means for iCloud+ Users

While iCloud Private Relay was developed to offer users a more secure browsing experience, this incident raises significant questions about the reliability of such privacy-focused services. Users relying on these features must remain vigilant until Apple releases further information on the matter and implements necessary fixes.

Summary of Findings

Issue	Description	Impact
Passkey Requests	Requests related to the authentication system can bypass iCloud+ privacy.	Exposes users’ real IP addresses to websites.
WebKit Functions	Certain functions leak IP and DNS data.	Increased risk of tracking and data exposure.
Third-Party Browsers	Some non-Safari browsers using WebKit are affected.	Broader risk beyond Apple’s ecosystem.

Conclusion

As digital privacy continues to be a paramount concern in our increasingly connected world, incidents like this serve as a reminder of the challenges that even established tech giants face in safeguarding user information. The iCloud Private Relay issue emphasizes the importance of transparency and the need for continuous improvements in privacy technologies. Users should stay informed and exercise caution while utilizing these services until more robust solutions are put in place by Apple.

Apple’s iCloud Private Relay can expose your real IP address to websites without a prompt or any visible indication 😬 Researchers found that passkey-related requests can bypass the iCloud+ privacy feature, while other WebKit functions may also leak IP and DNS data. Some third-party browsers are affected as well. Apple says it’s investigating the issue. Source: security researchers Tommy Mysk and Talal Haj Bakry Apple’s iCloud Private Relay can expose your real IP address to websites without a prompt or any visible indication 😬 Researchers found that passkey-related requests can bypass the iCloud+ privacy feature, while other WebKit functions may also leak IP and DNS data. Some third-party browsers are affected as well. Apple says it’s investigating the issue. Source: security researchers Tommy Mysk and Talal Haj Bakry