Apple's ‘Private Relay’ Is Exposing Users’ Real IP Addresses
Security researchers have discovered that Apple's iCloud Private Relay, a privacy feature designed to mask IP addresses, is failing to protect users on certain websites. The flaw allows websites to identify a user's real IP address, potentially compromising their anonymity.
Why it matters
This vulnerability undermines the trust users place in Apple's paid privacy services, highlighting ongoing challenges in maintaining effective digital anonymity tools.
A series of issues in Apple’s web browser engine — the tech underlying all browsers on iOS — means that Apple’s iCloud Private Relay tool, which is supposed to hide a user’s IP address, in many cases doesn’t actually work. Instead, the issues mean a malicious attacker can set up a website to learn a Private Relay user’s real IP address, or that many websites have also already collected this information incidentally. The issues also impact OnionBrowser, an iOS app for browsing the web through the Tor anonymity network, the researchers who discovered the issues say.
The Private Relay leak is the second issue to recently impact Apple’s paid-for privacy products. Last month 404 Media reported a bug in Apple’s Hide My Email feature was actually revealing peoples’ real email addresses . Apple knew about that issue for more than a year before fixing it .
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in