Apple's iCloud Private Relay is Leaking Users' Real IP Addresses
Security researchers have discovered that Apple's iCloud Private Relay feature fails to mask user IP addresses when interacting with WebAuthn passkeys. The vulnerability exists because the operating system's credential service bypasses the proxy path used by Safari.
Why it matters
This flaw undermines the privacy promises of a paid security feature, potentially allowing websites to track users' real IP addresses without their knowledge.
Apple's paid Safari protection feature that promises to keep your IP masked doesn't always work, according to security researchers Tommy Mysk and Talal Haj Bakry . It turns out iCloud Private Relay can expose your real IP to websites that use or pretend to use passkeys.
iCloud Private Relay is a service included with paid iCloud + plans. It is supposed to hide your IP and DNS information when you browse the web using Safari, but it is not a VPN that masks all traffic from a device. Passkeys use the WebAuthn standard, which stores a private key on your device, not the Safari browser. The request the system sends to the website isn't protected by Private Relay and can leak your IP address.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in