Apple Private Relay leaks the IP addresses it hides

Apple’s Private Relay is supposed to hide your IP address. Researchers have found three ways it does not.

The paid feature, part of an iCloud+ subscription, masks your real IP address while you browse in Safari. But three flaws in WebKit, Apple’s browser engine, quietly route some traffic around it. Security researchers Talal Haj Bakry and Tommy Mysk laid out the leaks this week. 404 Media, which broke the story, verified that a test site could read a protected user’s real IP.

The most alarming of the three involves passkeys. “Any website that supports, or pretends to support, passkeys can see the user’s real IP address despite having iCloud Private Relay on,” Mysk said. Opening the site is enough. A log-in never has to happen.

Three ways out of the tunnel

Private Relay routes Safari’s traffic through two relays, so no single party sees both who you are and where you go. The catch is that not all of a page’s traffic takes that path.