Redakcja Choose TV
A privacy-related issue affecting users has been discovered in iCloud Private Relay, which is part of the iCloud+ package. Security researchers found that in certain situations websites may be able to obtain the real IP address, even though the feature is supposed to hide it. Apple has confirmed it is analysing the report and is working to verify it.
Researchers discovered that iCloud Private Relay does not always hide the IP address
New findings by researchers Tommy Mysk and Talal Haj Bakry indicate that iCloud Private Relay does not protect users in every situation. The feature was designed to route Safari traffic through two independent servers, so that neither Apple nor the sites visited should simultaneously know both the user's identity and their online activity. However, a problem arises when using passkeys, a modern login method that does away with traditional passwords. When a site requests confirmation of a passkey, the iPhone system retrieves the relevant verification file outside Safari's mechanism. This means the request bypasses Private Relay and reaches the website without the additional protection. As a result, the server can see the user's real IP address instead of an address provided by Apple's service. The researchers emphasise that this affects any site that supports passkeys or even merely declares support for them. According to their analysis, there is currently no way to avoid this behaviour when using Safari with Private Relay active. That means the privacy protection Apple promises does not work as expected in this scenario.
Apple is analysing the issue, but full VPN services remain the safer option
This is not the first time iCloud+ privacy features have sparked controversy. There were recent reports of a problem with the Hide My Email feature, which in certain cases was revealing users' real email addresses. With Private Relay the situation is different, because it involves disclosure of the user's real IP address. Researchers note that traditional VPNs are not vulnerable to this flaw. This is because they encrypt all of the device's network traffic at the system level, not just browser traffic. People using Private Relay to increase anonymity while browsing the internet may therefore want to consider using a full VPN service until the issue is resolved. Apple said it has reviewed the report and is analysing the reported findings. So far the company has not said when a potential fix will be made available to users. It is also unknown how many users may have been at risk of having their IP address exposed in the scenario described.
Research shows that iCloud Private Relay does not always provide full anonymity when using the internet. In certain situations related to the handling of passkeys, websites can access the user's real IP address. Apple is investigating the reported issue, but until a patch is released, people seeking maximum privacy protection may consider using a traditional VPN service.
source: digitaltrends
