Researchers say iCloud Private Relay can expose real IPs via passkey-related requests

Security researchers found that Apple's iCloud Private Relay can expose users' real IP addresses because some passkey-related requests bypass Safari and its proxy protections at the operating-system level. "In short: any website that supports, or pretends to support, passkeys can see the user's real IP address despite having iCloud Private Relay on," security researcher Tommy Mysk, who discovered the issue along with Talal Haj Bakry, told 404 Media. The flaws also affect OnionBrowser, an iOS app for browsing the web through the Tor anonymity network. It does not, however, impact the official Tor Browser itself. From the report: The researchers developed a site that lets Private Relay users check if the issues impact them. In 404 Media's tests, the site did return the real IP address of a user that was supposed to be protected by Private Relay. [...] In a quirk of how passkeys work -- a broadly secure alternative to usernames and passwords which use the WebAuthn standard -- a user's device makes a web request outside of the browser itself. Meaning, that request essentially bypasses Private Relay and exposes a user's real IP address, even though to them it may look like they are simply interacting with a website as normal. "Because the fetch is issued by the operating system's credential service rather than by Safari, it never enters Private Relay's proxied path. The destination server sees the device's real IP address either way," the researchers write in their research. [...] "We have already informed them. They said the issue was âdire,' but they let us disclose the issue. They didn't provide any time when they will address this," Mysk said. Read more of this story at Slashdot.

Apple's paid Safari protection feature that promises to keep your IP masked doesn't always work, according to security researchers Tommy Mysk and Talal Haj Bakry. It turns out iCloud Private Relay can expose your real IP to websites that use or pretend to use passkeys. ‌iCloud‌ Private Relay is a service included with paid ‌iCloud‌+ plans. It is supposed to hide your IP and DNS information when you browse the web using Safari, but it is not a VPN that masks all traffic from a device. Passkeys use the WebAuthn standard, which stores a private key on your device, not the Safari browser. The request the system sends to the website isn't protected by Private Relay and can leak your IP address. WebKit hands WebAuthn ceremonies to the operating system's credential service, which issues the HTTPS request itself, directly from the device and unaware of any proxy the host app configured. A page can set rpId to a host of its choosing, and the fetch fires even without user interaction: with mediation: "conditional" and no UI ever appears. [...] Because the fetch is issued by the operating system's credential service rather than by Safari, it never enters Private Relay's proxied path. The destination server sees the device's real IP address either way. An attacker who wants to find someone's protected IP can do so by setting up a website that uses WebAuthn. There is no visible passkey prompt and no other indication that an IP address has been accessed in the background. The researchers also found two other WebKit features that can leak IP addresses and DNS data. DNS prefetching (added in iOS 26) reveals a user's real DNS servers, while WebTransport (added in iOS 26.4) can reveal an IP address. Apple told 404 Media that it is investigating the report. Mysk and Haj Bakry created a website to let you test whether Apple's service is leaking your IP address. Since the issue is baked into how WebKit works, some third-party browsers are affected too. Apple will need to address the issue, and in the meantime, users can opt for a VPN for more protection.Tag: iCloudRelated Forum: Apple Music, Apple Pay/Card, iCloud, Fitness+This article, "Apple's iCloud Private Relay is Leaking Users' Real IP Addresses" first appeared on MacRumors.comDiscuss this article in our forums

Macworld A pair of security researchers found a critical problem with Apple’s iCloud Private Relay feature. Even when using Safari, a website can fairly easily get your real IP address. Researchers Talal Haj Bakry and Tommy Mysk just disclosed the issue. Apple is aware of it; according to a report form 404 Media, Mysk said, “We have already informed them. They said the issue was ‘dire,’ but they let us disclose the issue. They didn’t provide any time when they will address this.” Here’s how it works, in basic terms: iCloud Private Relay is a nice security feature but it is not a VPN. It only works when you use Safari. Passkeys—the helpful biometric alternative to remembering different passwords for every site—operate outside the browser, using the WebAuthn framework on Apple devices. So if you set up a website to make a request for a Passkey credential origin, it’s not protected by iCloud Private Relay because the Passkey request is technically happening outside the browser. Of course, if you’re an everyday user, you don’t have any reason to know or suspect this. You’re using Safari, you have the paid iCloud+ Private Relay service turned on, you should be hidden, right? The issue also affects browsers that use WebKit’s proxy relay, including some Tor browsers. The researchers built a proof-of-concept site you can use to check if you’re affected. We don’t know when Apple is going to address the issue, but a vulnerability in Hide My Email that exposed real email addresses was fixed very quickly by Apple after the issue became public. That only required a back-end server fix, while this iCloud Private Relay issue might require a software update on devices. The fact that Apple let the researchers disclose the issue before the fix means Apple wants users to know about the problem and suggests it could take some time to fix. iCloud Private Relay is not a VPN This is a good time to remind everyone that iCloud Private Relay is not a VPN. A traditional VPN routes all the internet traffic for your entire device through other servers, sometimes providing other features as well at the core network level. iCloud Private Relay operates only in the Safari browser. It’s a nice perk of iCloud+, but not a full VPN substitute. That difference is the root cause of this new issue. You can be browsing with Safari and a website can make a special kind of request that happens outside the usual browser stack—by design—and thus is not affected by iCloud Private Relay. Apple will obviously need to address this quickly. If you’re interested in a real VPN, check out our list of the best VPNs.