Researchers have discovered flaws in Apple's Private Relay feature, which is designed to hide user IP addresses in Safari. A website created by the researchers can reveal real IP addresses even when Private Relay is active, impacting iCloud+ subscribers.
The discovery of flaws in Apple's Private Relay feature raises concerns about user privacy and the effectiveness of the company's security measures for its premium subscribers. It highlights potential risks for users relying on the service to shield their online activity.
Apple's Private Relay, a privacy feature for iCloud+ subscribers designed to obscure user IP addresses when browsing with Safari, has been found to have vulnerabilities that allow for the circumvention of its protections. Researchers Talal Haj Bakry and Tommy Mysk detailed these flaws, which stem from issues within Apple's WebKit browser engine, used across all iOS browsers. They have also launched a website enabling users to test whether their real IP addresses are being exposed even with Private Relay enabled.
The researchers stated they chose not to report the issue directly to Apple, citing a history of lengthy delays and potential denial of problems in past interactions with the company. Private Relay functions solely within Safari and is distinct from system-level VPNs. Apple did not immediately respond to a request for comment.