Apple’s ICloud Private Relay Feature May Actually Reveal Your Real IP Address.
If you use iCloud Private Relay, Apple’s paid service for masking IP addresses, your online activity may not actually be private. As 404 Media reports , vulnerabilities in Apple’s web browser engine allow IP addresses to be disclosed, both maliciously and accidentally, even when they should be hidden.
How Private Relay Reveals IP Addresses
iCloud Private Relay , part of Apple’s iCloud+ subscription, is designed to hide your identity and the websites you visit while browsing in Safari. Without it, your carrier and the websites you browse can see your IP address and DNS records, which can be used to track your location and browsing history over time. Private Relay encrypts DNS records and generates a temporary IP address, preventing any single party, including Apple, from accessing your information.
The issue, discovered by security researchers Talal Haj Bakri and Tommy Mysk, is related to how passwords work. Web requests are made outside the browser and Private Relay protection, meaning websites that support passwords can see users’ real IP addresses. This obviously affects Safari traffic, but the researchers also discovered the issue in Onion Browser, an iOS app that encrypts traffic over the Tor network. Both 404 Media and TechCrunch confirmed the issue in their own tests.
The researchers said they notified Apple but received no information about a timeline for fixing the vulnerability. Apple generally handles privacy issues fairly well, but this isn’t the first such incident in recent months. In July , it was discovered that the “Hide My Email” email masking service had a vulnerability that effectively exposed users’ real email addresses. Apple reportedly knew about it for over a year and claimed to have fixed the bug, but this wasn’t the case.
While Private Relay can be a useful privacy tool—if it works as intended—it’s not a true VPN (virtual private network), as it only provides protection when browsing in Safari. If you want to hide your IP address and encrypt your data across all apps and browsers on your device, you might want to consider a separate VPN service .