Apple's 'Private Relay' Is Exposing Users' Real IP Addresses
- Reference: 0184871590
- News link: https://yro.slashdot.org/story/26/08/05/1918253/apples-private-relay-is-exposing-users-real-ip-addresses
- Source link:
> The researchers [4]developed a site that lets Private Relay users check if the issues impact them. In 404 Media's tests, the site did return the real IP address of a user that was supposed to be protected by Private Relay.
>
> [...] In a quirk of how passkeys work -- a broadly secure alternative to usernames and passwords which use the WebAuthn standard -- a user's device makes a web request outside of the browser itself. Meaning, that request essentially bypasses Private Relay and exposes a user's real IP address, even though to them it may look like they are simply interacting with a website as normal.
>
> "Because the fetch is issued by the operating system's credential service rather than by Safari, it never enters Private Relay's proxied path. The destination server sees the device's real IP address either way," the researchers write in their research. [...] "We have already informed them. They said the issue was âdire,' but they let us disclose the issue. They didn't provide any time when they will address this," Mysk said.
[1] https://www.404media.co/apples-private-relay-is-exposing-users-real-ip-addresses/
[2] https://mysk.blog/2026/08/04/webkit-proxy-icloud-private-relay-ip-leak/
[3] https://www.torproject.org/
[4] https://leaks.psylo.app/
You think that's bad? (Score:1)
Apple exposes Trump supporters on social networks via Apple News links. (Since they bribed Trump, if you are still buying Apple stuff or posting Apple News links which funnel traffic to them, you are a Trump supporter by definition.)
Trump's just a president (Score:1)
You typically expose people for fraud or embezzlement or corruption, not for being one of the ~1/2 Americans who voted for one president or another, sheesh.
Re: Trump's just a president (Score:1)
It's different when the person they support rapes children, to most of us anyway
Re: (Score:2)
Why would you believe something so outlandish as that? If you believe every accusation somebody throws out there, you'll spend all your days clicking through news articles, only to find unproven, heavily interpreted, questionable, highly biased writing. People vote based on their policies, nothing wrong with that.
Re: Trump's just a president (Score:2)
More evidence has been presented that Trump raped children than that Cosby raped women. Did you have any trouble believing Cosby was guilty?
Re: (Score:1)
Evidence against Trump is just ginned up by his political enemies, because they want to discredit him. I've seen the same process unfold for every single previous president for the last 30 years. If you disagree with his policies, have a policy argument, otherwise you're just talking past your fellow citizens, and not convincing anyone.
Re: (Score:2)
You think that if that same election were held today, the outcome would be the same?
Hint: Trump doesn't have anywhere near the support today he did in November 2024.
Re: (Score:2)
> Since they bribed Trump, if you are still buying Apple stuff or posting Apple News links which funnel traffic to them, you are a Trump supporter by definition.
And who is the average consumer supposed to buy phones, tablets, and computers from? Google is guilty of supporting Trump. Microsoft is guilty of it as well. You could argue amounts and all that, but ultimately the average consumer has very little ability to avoid it.
Re: (Score:2)
All large companies have done the same. You're currently using products from companies that have done such. Apple understands that the little gift and donation allowed them to avoid tariffs, which saved them billions. Every big company kisses up to every president. It's not that they like them, they just understand that they have to play along to get their own business the most benefit.
Clickbait Headline (Score:4, Informative)
It's not Private Relay exposing it. Passkey works through a separate connection and setup. That's what's exposing such, passkey, not Private Relay. Folks always looking for ways to blame Apple. If you set up a passkey with a site, hiding your identity with Private Relay isn't hiding your identity anyways.
Re: Clickbait Headline (Score:1)
Exactly, but please don't confuse all the young padawans with simple facts
Re: (Score:1)
But it _IS_ a shortcoming of Private Relay that it can't/doesn't wrap up the passkey traffic as well.
It's like with S/MIME, the email headers (including To, From, and Subject) are not encrypted nor protected by the S/MIME signature (and same goes for PGP encrypted emails). Many people don't realize that. I even had to prove it to my coworkers back in the day. It's the sort of thing that should be well known if you're using it, just like this situation.
Re: (Score:3)
But the issue is that you don't have to have a passkey set up for a site - any site can use the WebAuthn API to get your real IP, whether or not you have set up a passkey.
Re: (Score:2)
> It's not Private Relay exposing it.
How do you define that? I'm not privy to how they have it all implemented. The first question would be whether Private Relay is even designed to signal that the passkey request sent to the credential service is flagged as private. The second would be whether the credential service is designed to be able to route through the proxy. I'm sure there are other possibilities to consider, but those are the big ones. If Private Relay isn't designed to signal the request as private, then a problem exists in Private
Re: (Score:3)
The GP is splitting hairs. The key detail here is that Private Relay isn't a VPN, it's basically just a two-hop anonymizing web proxy. Now ask any non-geek to explain the difference.
There are really two separate problems here, one of which very much is Apple's problem, and the other... I'll leave it to you to decide for yourself.
First and most importantly, this isn't limited only to people using passkey; the remote site can ask for it regardless and the response will include the device's true IP.
And s
Re: (Score:2)
> The GP is splitting hairs.
Agree.
> First and most importantly, this isn't limited only to people using passkey; the remote site can ask for it regardless and the response will include the device's true IP.
I understand that, if only at the concept level. I don't know if they do.
They do, however, also seem to be ignoring location(IP) anonymity. Sure, if it's a site you actually log in to you likely trust them to at least some extent. That doesn't mean you necessarily want them tracking your IP. Further, maybe the site doesn't have any real identifying info on you. Maybe you use an email alias and no real identifying info.
So ... (Score:2)
> Because the fetch is issued by the operating system's credential service rather than by Safari, it never enters Private Relay's proxied path. The destination server sees the device's real IP address either way,"
A server is seeing someone trying to authenticate from one IP address and accepting credentials from a different IP address?
[Morty Smith voice] "Coolsies"
Passkey nonsense (Score:2)
Another problematic issue with passkeys. Itâ(TM)s gonna be a nightmare dealing with the fallout after these companies push people unwittingly towards these poorly thought out systems.
Still kinks to work out (Score:2)
I'm very happy that Apple is including a VPN for "normies." I see a lot of traffic to sites I manage coming from iCloud private relay blocks, and the demographic is teens and twenty somethings.
Having said that, for me, it's a bit mixed. Things get confused when running my OpenVPN or Wireguard split DNS vpn with--and sometimes without--iCloud relay. There are also some OS network-specific settings that involve blocking trackers that impact things too. Safari is kind of "special" in terms of how it looks at n
No shit (Score:2)
Private Relay is an application-level proxy that only works with browser traffic, and I believe only works with Safari. For a paid subscriber feature, I would be a little pissed, because it's basically worthless when a VPN is just superior in every way. And as a paid subscription feature, it really *should* be a full system VPN seeing as all the subscriptions tiers are overpriced for what you get. You can get basically everything they offer, up to 1TB, for free.
Private(tm) Relay! (Score:2)
... now with less privacy!