Apple’s Private Relay Issue — How IP Addresses Slip Through

Apple’s iCloud Private Relay touts itself as a security feature ensuring privacy for its paid subscribers. However, recent reports suggest users may not enjoy the privacy they thought they would.

Security researchers Talal Haj Bakry and Tommy Mysk posted on their official blog about the security vulnerabilities of iOS and macOS users. The post explains how a WebKit-based browser (which is pretty much every browser) installed on Apple devices might expose a user’s IP address. The IP address is not leaked to every website; it may only be exposed during certain WebKit transactions and activities.

Three features were identified that could lead to a leak of an IP address and/or its related information:

●    DNS Prefetching - a browser may “prefetch” the IP address of a link on a website you are visiting. This process is done to ensure the website loads faster when the user chooses to load it. It’s standard practice: to get the IP address of a link, the requesting browser should also provide an IP address. Unfortunately, the request bypasses the Private Relay, revealing the real IP address.

●    WebAuthn Passkeys - WebKit’s treatment of Passkeys also shows the user’s real IP address. When a website checks for available Passkeys, the browser bypasses Private Relay as it connects directly from the device.

●    WebTransport - the IP address leak is pretty straightforward on this WebKit feature. According to the blog post, “WebTransport opens a direct HTTP/3 connection and bypasses the proxy, which also exposes the device’s real IP address.”

Aside from the blog post itself, tech websites have also verified and supported the claims of the security problem. According to Likehacker.com, “Both 404 Media and TechCrunch verified the issue in their own tests.”

Public Awareness Before Informing Apple

This leak is not just a small part of the internet; it affects almost every Apple user. Normally, it can be addressed to Apple so a fix could be implemented as soon as possible. But this is not the experience of the security researchers. The following is their experience with Apple’s treatment of issues as posted on X:

“In an ideal world, we’d report the issues to Apple, they acknowledge the issue, and ship a fix in a timely manner. Unfortunately, our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue’s impact entirely.”

The security researchers are deeply concerned about the security flaw because they are also the developers of Psylo, a security-focused browser.

Using a VPN

The ideal temporary solution before a fix is done is to use a VPN. Because it encrypts every transaction going in and out of the device, the user’s IP address is secured. However, it is important to select a good VPN. Free VPNs may reduce connection speeds and, in some cases, monitor user data. A paid VPN subscription is recommended because premium providers typically prioritize reliable connectivity while maintaining fast internet speeds. Be sure to check reviews and the latest news about any paid VPN you're considering to ensure it provides secure, private, and reliable connectivity.