iCloud Private Relay Vulnerability Exposes IP Addresses
Apple's security feature may leak your IP even when using Safari.
1Vulnerability Discovery
Security researchers Talal Haj Bakry and Tommy Mysk uncovered a critical flaw in iCloud Private Relay. Websites can obtain users' real IP addresses even when using Safari. Apple acknowledged the severity but hasn't provided a fix timeline. The researchers were granted permission to disclose the issue publicly.
2Passkey Connection
The issue stems from Passkey authentication requests operating outside browsers via WebAuthn framework. These requests bypass iCloud Private Relay's protection, allowing specially crafted websites to retrieve IPs. Average users wouldn't suspect this limitation, as the feature is marketed as privacy-enhancing.
3Affected Browsers
The vulnerability impacts not just Safari but also some Tor browsers using WebKit's proxy relay. Researchers developed a proof-of-concept test site. Apple's quick fix for a similar Hide My Email leak suggests potential rapid response, though this may require device-level updates.
4Key Difference from VPNs
iCloud Private Relay isn't a full VPN—it only routes Safari traffic rather than encrypting all device internet activity. This functional gap explains the current security limitation. Unlike traditional VPNs, it can't protect non-browser processes, creating the vulnerability's technical basis.
5Apple's Response Strategy
Apple's permission for public disclosure suggests the fix may take time. While Hide My Email required server-side patches, this issue might need client software updates. The company's transparency indicates recognition of the flaw's significance, prompting users to consider temporary precautions.
6User Risk Profile
The vulnerability particularly threatens users accessing location-sensitive services. IP exposure could compromise anonymity and enable targeted attacks. Researchers recommend using proper VPNs until Apple addresses the issue, highlighting the need for clearer feature limitations documentation.
7Industry Implications
The findings spotlight technical constraints in privacy services. A similar 2022 WebKit vulnerability earned $250,000 through Apple's security program. Current events reignite debates about browser-based security solutions' scope, emphasizing the need for comprehensive protection frameworks.
8Recommended User Actions
Experts advise using full VPNs for sensitive operations until Apple releases fixes. Users should review security settings and monitor official updates. This incident underscores the importance of understanding digital privacy tools' limitations, prompting reevaluation of online protection strategies.
Original article: Macworld — iCloud Private Relay'de IP Adresi Sızıntısı Riski