GoKawiilApple’s iCloud Private Relay feature is designed to obscure your web traffic so sites like advertisers, unscrupulous governments or malicious attackers can’t trace that traffic back to you. But it turns out the mechanism isn’t actually as private as Apple says.
As reported by 404 Media, security researchers at software company Mysk discovered that even with iCloud Private Relay active, the IP address of a device or home network can be transmitted, which could be used to reveal a person’s identity or location.
iCloud Private Relay is a feature for paid customers of Apple’s iCloud Plus service. It routes web traffic through proxy servers, obscuring your IP address and the website address you’re visiting, so neither the site nor Apple can see that information.
It’s also a feature that runs within Apple’s WebKit framework, which includes the Safari browser and other apps and services that use WebKit to access websites. It’s specifically not a VPN (Virtual Private Network), which encrypts all internet traffic and runs it through a proxy server.
The researchers, Talal Hak Bakry and Tommy Mysk, set up a website that lets you check whether your connection is vulnerable. When I tested it using an iPhone 17 Pro and a MacBook Pro with iCloud Private Relay enabled, it correctly identified the IP address of my home internet router.
The information in the red box shows the IP address of my home router. Screenshot by Jeff Carlson/CNET
In a post on X, the researchers noted that they chose to make the vulnerability public rather than report it to Apple first.
“Unfortunately, our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue’s impact entirely,” the researchers wrote. “We weren’t willing to wait months, or upwards of a year, sitting on bugs that undermine the core privacy guarantees of [Mysk’s browser] Psylo and iOS Tor browsers while saying or doing nothing.”
An Apple representative didn’t immediately respond to a request for comment.
How iCloud Private Relay is being bypassed
... continue reading