Redakcja Choose TV
A privacy issue affecting users has been detected in iCloud Private Relay, part of iCloud+. Security researchers have found that in certain circumstances websites can obtain the real IP address, even though the feature is meant to hide it. Apple has confirmed it is reviewing the report and is working to verify it.
Researchers found that iCloud Private Relay doesn't always hide the IP address
New findings by researchers Tommy Mysk and Talal Haj Bakry indicate that iCloud Private Relay does not protect users in all situations. The feature was designed to route traffic from the Safari browser through two independent servers, so that neither Apple nor the websites visited should simultaneously know the user's identity and their online activity. However, a problem arises when using passkeys, a modern login method that does not use traditional passwords. When a site requests passkey confirmation, the iPhone system fetches the relevant verification file outside of Safari's mechanisms. That means the request bypasses Private Relay and reaches the website without additional protection. As a result, the server can see the user's real IP address instead of the address provided by Apple's service. The researchers emphasise that this affects any site supporting passkeys or even merely declaring support for them. According to their analysis, there is currently no way to avoid this behaviour when using Safari with Private Relay enabled. That means the privacy protection Apple claims in this scenario does not work as intended.
Apple is investigating the issue, but full VPNs remain the safer option
This isn't the first time iCloud+ privacy-related services have sparked controversy. There were recent reports of an issue with the Hide My Email feature that, in certain cases, could reveal a user's real email address. The situation with Private Relay is different, as it concerns the disclosure of the real IP address. Researchers note that traditional VPNs are not vulnerable to this flaw. That's because they encrypt all of a device's network traffic at the system level, not just the browser's traffic. So people using Private Relay to boost anonymity while browsing the internet may want to consider using a full VPN service until the issue is fixed. Apple said it has reviewed the report and is analysing the findings. For now the company hasn't said when a potential fix will be made available to users. It's also unclear how many users may have been exposed to having their IP address revealed in the scenario described.
Studies show that iCloud Private Relay does not always provide full anonymity when using the internet. In certain situations related to handling passkeys, websites can obtain the user's real IP address. Apple is investigating the reported issue, but until a fix is released, people seeking maximum privacy protection may consider using a classic VPN service.
source: Digital Trends
