PSA: Apple’s Private Relay can leak your real IP address

Apple's Private Relay, a feature intended to protect users' online privacy by hiding their IP address during web browsing, has been found to potentially expose real IP addresses due to multiple technical flaws, according to new research published by security experts Talal Haj Bakry and Tommy Mysk. The discovery was shared publicly on Tuesday, with the researchers setting up a website allowing users to test whether their actual IP address could be leaked despite using the service. A test conducted by TechCrunch confirmed that the site successfully exposed real IP addresses, raising concerns about the effectiveness of Apple's privacy measures. The vulnerability stems from three specific issues within Apple's WebKit browser engine, which powers Safari on iOS devices. These flaws allow third-party services to bypass the protections offered by Private Relay, thereby revealing users' true IP addresses. Unlike traditional virtual private networks, which operate at the system level to secure all network traffic, Private Relay is limited to Safari and requires users to subscribe to iCloud+. As such, it does not provide the same level of protection across all applications and services. The researchers behind the discovery, Mysk and Bakry, have previously expressed frustration with Apple's response to security vulnerabilities. In a recent post on X, Mysk stated that their decision not to report the issue directly to Apple was based on past experiences involving prolonged delays, inconsistent communication, and instances where Apple denied the significance of the problems. Instead, the team opted to make the findings public to raise awareness among users and developers. In addition to highlighting the flaw, the researchers have taken steps to address it by developing a private browser called Psylo. This tool includes built-in safeguards designed to prevent IP address leaks, offering an alternative solution for users concerned about their online privacy. While Psylo is still under development, its release is anticipated to provide additional options for individuals seeking enhanced privacy protections beyond what Apple currently offers. The revelation has sparked discussions within the cybersecurity community about the broader implications of such vulnerabilities, particularly regarding trust in major tech companies to safeguard user data effectively. Some experts argue that the incident underscores the need for more transparent and timely responses from technology firms when critical security issues are identified. Others emphasize the importance of independent verification and public disclosure as essential components of maintaining accountability in the digital space. As the situation unfolds, it remains unclear how Apple will respond to the findings. The company has yet to comment on the matter, leaving many questions about the scope of the issue and potential remedies unresolved. Meanwhile, users are advised to remain vigilant about their online privacy practices and consider supplementary tools or services that offer stronger protections against IP address exposure. The ongoing developments highlight the evolving nature of cybersecurity threats and the challenges faced by both users and developers in navigating them.