Redakcja Choose TV
A privacy issue has been discovered in iCloud Private Relay, part of iCloud+. Security researchers found that in certain situations websites can obtain the real IP address, even though the feature is supposed to hide it. Apple confirmed it is reviewing the report and is working to verify it.
Researchers discovered that iCloud Private Relay does not always hide the IP address
New findings by researchers Tommy Mysk and Talal Haj Bakry indicate that iCloud Private Relay does not protect users in every situation. The feature was designed to route Safari traffic through two independent servers so that neither Apple nor visited sites should simultaneously know the user's identity and their online activity. The problem arises, however, when using passkeys, the modern passwordless login method. When a site asks to confirm a passkey, the iPhone system fetches the relevant verification file outside Safari's mechanisms. That means the request bypasses Private Relay and reaches the website without additional protection. As a result, the server can see the user's real IP address instead of the address provided by Apple's service. The researchers emphasize that this applies to any site that supports passkeys or even merely declares support for them. According to their analysis, there is currently no way to avoid this behavior when using Safari with Private Relay enabled. This means Apple's claimed privacy protection in this scenario does not work as expected.
Apple is investigating the issue, but full VPNs remain the safer solution
This is not the first time iCloud+ privacy features have sparked controversy. Recently there was also a report about an issue with the Hide My Email feature, which in certain cases was reported to reveal the user's real email address. With Private Relay the situation is different, because it involves revealing the user's real IP address. Researchers point out that traditional VPNs are not vulnerable to this flaw. This is because they encrypt all of the device's network traffic at the system level, not just web browser traffic. People using Private Relay to increase their anonymity while browsing the internet may therefore consider using a full VPN service until the issue is resolved. Apple said it has reviewed the report and is analyzing the findings. So far the company has not said when a potential fix will be released to users. It is also unknown how many users may have been exposed to IP address disclosure in the described scenario.
Studies show that iCloud Private Relay does not always provide full anonymity when using the internet. In certain situations related to handling passkeys, websites may obtain the user's real IP address. Apple is investigating the reported issue, but until a fix is released, people seeking the highest level of privacy protection may consider using a traditional VPN service.
source: Digital Trends
