Apple's iCloud Private Relay Can Actually Expose Your Real IP Address

If you use iCloud Private Relay, Apple's paid IP address masking service, your internet browsing activity may not actually be private. As 404 Media reports , flaws in Apple’s web browser engine allow IP addresses to be revealed, either maliciously or incidentally, even when they're supposed to be hidden. How Private Relay is exposing IP addresses iCloud Private Relay , which is part of Apple's iCloud+ subscription, is supposed to keep both who you are and what sites you visit hidden when you are browsing in Safari. Without it, your network provider and the websites you view can see your IP address and DNS records, which can be used to track your location and browsing history over time. Private Relay is supposed to encrypt DNS records and generate a temporary IP address, keeping any single party, including Apple, from obtaining both. The issue, discovered by security researchers Talal Haj Bakry and Tommy Mysk, is related to how passkeys work. Web requests are made outside of the browser and the protections of Private Relay, meaning that websites that support passkeys can see users' real IP addresses. Obviously, this impacts Safari traffic, but researchers found the issue in Onion Browser, an iOS app that encrypts traffic through the Tor network. Both 404 Media and TechCrunch verified the issue in their own tests. The researchers stated that they informed Apple but haven't been given a timeline for when the vulnerability will be addressed. Apple is generally pretty good o…