GoKawiilSecurity researchers last week revealed a flaw in Apple’s iCloud Private Relay feature. While this is supposed to protect your IP address from the websites you visit, a vulnerability means that it often fails to do so.
Any time there’s a problem with an Apple product or service, a class action lawsuit is sure to follow, and this is no exception …
What is iCloud Private Relay?
As we’ve explained previously, iCloud Private Relay isn’t quite a VPN, but it is intended to fulfil a similar privacy function in terms of preventing your web usage being tracked when you are using Safari as your browser. Here’s how Apple describes it:
Your IP address is visible to your network provider and to the first relay, which is operated by Apple. Your DNS records are encrypted, so neither party can see the address of the website you’re trying to visit.
The second relay, which is operated by a third-party content provider, generates a temporary IP address, decrypts the name of the website you requested, and connects you to the site.
In other words, your ISP sees only that you are accessing an Apple server, and the website you visit sees only an IP address generated by that server.
What’s the flaw?
Security researchers found that any website that supports passkeys can see your real IP address.
In a quirk of how passkeys work, a user’s device makes a web request outside of the browser itself. Meaning, that request essentially bypasses Private Relay and exposes a user’s real IP address, even though to them it may look like they are simply interacting with a website as normal.
... continue reading