Apple’s Private Relay feature has flaws that can expose user IP addresses

Apple's Private Relay, an opt-in feature designed to hide a user's IP address when browsing the internet with Safari, was found to have flaws that can reveal the supposedly hidden IP address. Researchers revealed these issues in a blog post on Tuesday and have created a website where users can test if their IP address is being leaked, even when using Private Relay. TechCrunch verified that the site was able to reveal their real IP address during a test, based on information published by TechCrunch.

The vulnerability lies within three features of Apple's WebKit browser engine, which powers all browsers on iOS. Private Relay, exclusive to iCloud+ subscribers, functions only within Safari and is not a system-level privacy tool like a Virtual Private Network (VPN). The researchers, Talal Haj Bakry and Tommy Mysk, opted not to report the issue directly to Apple, citing past experiences with lengthy delays and inconsistent communication. They have, however, implemented mitigations in their own private browser, Psylo, to prevent IP address leaks. Apple has not yet responded to a request for comment regarding these findings.

Source: TechCrunch