Apple’s Private Relay Vulnerability Exposed

Apple’s Private Relay, a feature designed to mask a user’s IP address when browsing the internet with Safari, has been found to be susceptible to a series of flaws. This means that even with Private Relay enabled, a user’s real IP address can be revealed, compromising their online anonymity.

The issue was discovered by researchers Talal Haj Bakry and Tommy Mysk, who reported the problem in a blog post on Tuesday. The researchers set up a website where anyone can check if their real IP address is being leaked, even if they have Private Relay enabled. In a test, TechCrunch verified that the site was able to reveal the real IP address of a user who had Private Relay enabled.

The problem lies with three features in Apple’s web browser engine WebKit, which is used by all browsers in iOS. Private Relay is only available to iCloud+ subscribers and does not function at the system level, unlike a Virtual Private Network (VPN). It only works while using Safari.

Mysk wrote in a post on X that they chose not to report the issue to Apple due to past experiences with the company. They claimed that reporting the issue would involve months of delays, inconsistent communication, and in some cases, denying the issue’s impact entirely. Mysk and his colleagues have developed a private browser called Psylo, which has mitigations that prevent users’ IP addresses from leaking when using the browser.

The researchers’ findings have raised concerns about the effectiveness of Private Relay in protecting users’ online anonymity. While the feature is designed to mask a user’s IP address, it can be circumvented by exploiting the flaws in WebKit. This means that users who rely on Private Relay for online anonymity may be putting themselves at risk.

Apple has not responded to a request for comment on the issue. However, the company has been working to improve the security and privacy of its products and services. The discovery of the Private Relay vulnerability highlights the importance of ongoing security research and development in the tech industry.

Private Relay is a feature that is designed to protect users’ online anonymity by masking their IP address. However, the recent discovery of the vulnerability in the feature has raised concerns about its effectiveness. The researchers’ findings highlight the importance of ongoing security research and development in the tech industry.

The issue with Private Relay is not a bug, but rather a flaw in the design of the feature. The researchers’ findings have highlighted the importance of ongoing security research and development in the tech industry. Apple’s Private Relay is a feature that is designed to protect users’ online anonymity, but the recent discovery of the vulnerability has raised concerns about its effectiveness.