PSA: Apple’s Private Relay can leak your real IP address

Apple’s Private Relay, an opt-in diagnostic designed to fell a user’s IP code erstwhile they browse the net with Safari, tin beryllium circumvented to uncover the supposedly hidden IP code owed to a bid of flaws.

Researchers revealed the issues in a blog post connected Tuesday. The researchers besides set up a website wherever anyone tin cheque if their existent IP code leaks, adjacent if they usage Private Relay. In a trial connected Tuesday, TechCrunch verified that the tract was capable to uncover our existent IP address. 

The contented was archetypal reported by 404 Media.

Talal Haj Bakry and Tommy Mysk, the researchers who recovered the issue, wrote successful their blog station that the occupation lies with 3 features successful Apple’s web browser motor WebKit, which is utilized by each browsers successful iOS. Private Relay is only disposable to iCloud+ subscribers, and is not similar a Virtual Private Network, oregon VPN, which protects someone’s IP code astatine the strategy level. Private Relay lone works portion utilizing Safari. 

Mysk wrote successful a station connected X that they chose not to study the contented to Apple due to the fact that “our past acquisition with Apple tells america that reporting this contented would impact months of delays, inconsistent communication, and successful immoderate cases, denying the issue’s interaction entirely.”

Apple did not instantly respond to a petition for comment. 

Mysk and his colleagues make a backstage browser called Psylo, which they accidental present has mitigations that forestall users’ IP addresses from leaking erstwhile utilizing Psylo.