Flawed Anonymity: Apple's Private Relay Leaks Real IP Addresses

Apple's Private Relay, designed to protect user anonymity, has been found to be vulnerable to a series of flaws, allowing attackers to reveal a user's real IP address.

The issue was discovered by researchers Talal Haj Bakry and Tommy Mysk, who set up a website to test the vulnerability. In a test on Tuesday, TechCrunch verified that the site was able to reveal our real IP address, despite using Private Relay.

According to the researchers, the problem lies with three features in Apple's web browser engine WebKit, which is used by all browsers in iOS. Private Relay is only available to iCloud+ subscribers and is not like a Virtual Private Network (VPN), which protects someone's IP address at the system level. Private Relay only works while using Safari.

Mysk wrote in a post on X that they chose not to report the issue to Apple because "our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue's impact entirely."

The researchers have developed a private browser called Psylo, which they say now has mitigations that prevent users' IP addresses from leaking when using Psylo.

While Apple has not commented on the issue, the revelation raises concerns about the security and anonymity of users who rely on Private Relay for protection.

Key Takeaways:

• Private Relay can be circumvented to reveal a user's real IP address due to flaws in WebKit.

• The issue affects all browsers in iOS, including Safari.

• The researchers have set up a website to test the vulnerability, which has been verified by TechCrunch.

• The issue highlights concerns about the security and anonymity of users who rely on Private Relay.

What's Next:

• Apple may need to address the vulnerabilities in WebKit to ensure the security and anonymity of users who rely on Private Relay.

• The discovery of the issue raises questions about the effectiveness of Private Relay in protecting user anonymity.

• Users who rely on Private Relay should be aware of the potential risks and consider alternative methods for protecting their anonymity.