Security researchers have identified a vulnerability in Apple’s iCloud Private Relay, a feature designed to conceal users’ real IP addresses during web browsing. This flaw may inadvertently expose users’ actual IP addresses to websites, undermining the privacy protections the service aims to provide.
iCloud Private Relay operates by routing users’ internet traffic through two separate relays. The first relay, managed by Apple, knows the user’s original IP address but not the destination website. The second relay, operated by a third-party content delivery network, knows the destination website but not the user’s original IP address. This dual-hop architecture is intended to prevent any single entity from accessing both the user’s identity and browsing activity.
The vulnerability arises from how Apple’s WebKit engine handles passkeys—a secure alternative to traditional usernames and passwords that utilize the WebAuthn standard. When a user interacts with a website supporting passkeys, the device makes a web request outside the browser’s typical path. This request bypasses the Private Relay’s protective routing, allowing the destination server to see the user’s real IP address.
Given that all browsers on iOS are required to use Apple’s WebKit engine, this issue affects not only Safari but also other browsers on the platform. Notably, the Onion Browser, which utilizes the Tor network for anonymity, is also impacted. This means that users relying on these browsers for enhanced privacy may unknowingly expose their real IP addresses when interacting with passkey-enabled websites.
The researchers reported the issue to Apple, which acknowledged the severity of the problem. However, Apple has not provided a timeline for a fix but permitted the researchers to disclose the vulnerability publicly. Users concerned about this issue can test their exposure by visiting a website set up by the security researchers.
This discovery underscores the complexities of implementing privacy features in web technologies. While iCloud Private Relay offers significant privacy enhancements, its integration with emerging standards like passkeys introduces unforeseen challenges. Users should remain vigilant and stay informed about potential vulnerabilities, especially when using services that promise enhanced privacy. As the digital landscape evolves, continuous scrutiny and prompt responses to such issues are essential to maintain user trust and security.
