Apple offers iCloud Private Relay to iCloud+ users for added privacy when browsing with Safari. This feature is designed to hide your actual IP address and location. However, security researchers Talal Haj Bakry and Tommy Mysk have identified ways certain WebKit features bypass this protection.
How iCloud Private Relay Works
iCloud Private Relay functions by routing Safari requests through two separate relays. Your internet provider sees your IP, but DNS records remain encrypted. A second relay assigns a temporary IP to the website, limiting data collection about your location and browsing.
Research Findings on WebKit Leaks
Three WebKit mechanisms were identified that can leak your information:
DNS Prefetching
This feature speeds loading by looking up link addresses before they’re clicked. Researchers found these DNS requests may expose your real network, bypassing Private Relay’s path.
WebAuthn Passkey Issue
WebAuthn uses passkeys across related websites, requiring device verification through direct network contact. This can reveal your real IP while Private Relay is active.
WebTransport Connections
WebTransport maintains quick connections with servers, but WebKit may establish these connections outside the proxy path, exposing your IP.
Impact on Apple Users
The findings affect Safari users using iCloud Private Relay. They can also impact privacy-focused browsers on iOS and macOS using WebKit’s proxy. VPNs remain unaffected, as they operate at the system level, not browser level.
Steps to Protect Your Privacy
- Keep Private Relay On: Retain its protection by keeping it enabled via Settings > your name > iCloud > Private Relay.
- Update Devices: Install updates promptly. Check under Settings > General > Software Update.
- Use VPNs for IP Privacy: A full-device VPN can provide system-wide protection if you need strong IP privacy.
- Continue Using Passkeys: Despite the WebAuthn issue, passkeys still offer good security against phishing and password theft.
Browser Updates and Privacy Concerns
Browser developer Psylo has modified its browser to handle these mechanisms differently. DNS prefetch hints are blocked by default, and WebTransport and WebAuthn are disabled.
Understanding privacy feature limits is essential, even with beneficial tools like iCloud Private Relay. These findings highlight the importance of being aware of the underlying processes, as well as the settings you enable.
Kurt “CyberGuy” Knutsson, a tech journalist, stresses the importance of not solely relying on iCloud Private Relay to replace a full-device VPN.