A series of issues in Apple’s web browser engine — the tech underlying all browsers on iOS — means that Apple’s iCloud Private Relay tool, which is supposed to hide a user’s IP address, in many cases doesn’t actually work. Instead, the issues mean a malicious attacker can set up a website to learn a Private Relay user’s real IP address, or that many websites have also already collected this information incidentally. The issues also impact OnionBrowser, an iOS app for browsing the web through the Tor anonymity network, the researchers who discovered the issues say.
The Private Relay leak is the second issue to recently impact Apple’s paid-for privacy products. Last month 404 Media reported a bug in Apple’s Hide My Email feature was
actually revealing peoples’ real email addresses
. Apple knew about that issue for more than a year
before fixing it
.
“In short: any website that supports, or pretends to support, passkeys can see the user’s real IP address despite having iCloud Private Relay on,” security researcher Tommy Mysk, who
discovered the issue
along with Talal Haj Bakry, told 404 Media.
💡
Do you know about any other privacy issues like this? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.
The researchers
developed a site
that lets Private Relay users check if the issues impact them. In 404 Media’s tests, the site did return the real IP address of a user that was supposed to be protected by Private Relay.
Private Relay is part of Apple’s paid iCloud+ subscription. It is designed to mask a user’s IP address while they browse the web in Safari. “Normally when you browse the web, information contained in your web traffic, such as your DNS records and IP address, can be seen by your network provider and the websites you visit. This information could be used to determine your identity and build a profile of your location and browsing history over time,” Apple’s

… [more]