Recent findings have highlighted potential privacy concerns for Apple users who depend on iCloud Private Relay to maintain anonymity online. Vulnerabilities in WebKit, the engine powering iOS browsers, may inadvertently reveal users’ real IP addresses.
Understanding the WebKit Vulnerabilities
The exposure stems from a flaw in WebKit, which can reveal a visitor’s actual IP address when a website either supports or purports to support passkeys. This issue emerges when a separate network request bypasses the protected browser route during sign-in, allowing malicious sites to capture IP details.
Researchers Tommy Mysk and Talal Haj Bakry discovered this vulnerability, and 404media confirmed its existence by demonstrating how a test page could return a user’s real IP address, compromising the intended privacy protection.
Implications for User Privacy
iCloud Private Relay aims to conceal an iCloud+ subscriber’s IP address while browsing in Safari, though it does not offer the comprehensive protection of a full-device VPN. The flaw is significant as an IP address can disclose a user’s network provider and approximate location, potentially contributing to user profiling.
This vulnerability doesn’t indicate device infections or account compromises, but it does highlight a privacy breach. The technique allows malicious operators to log IP addresses without any need for the user to install software or divulge passwords, merely by interacting with passkeys on a site.
Impact on Browsing Anonymity
The WebKit flaw also affects the OnionBrowser, an iOS app using the Tor network. As iOS browsers are required to use WebKit, apps may inherit privacy limitations. OnionBrowser developer Mike Tigas noted that some leaks are controllable by Apple, while others do not affect the app under default settings.
Although the official Tor Browser remains unaffected, users seeking anonymity should recognize that Private Relay is not a substitute for comprehensive privacy tools. Users are advised to apply Apple updates and use the Tor Browser for enhanced anonymity when necessary.
Until Apple addresses the issue, caution is advised when dealing with unfamiliar websites requesting or simulating passkey support, especially where privacy is paramount. Organizations should recognize Private Relay’s limitations and adjust their security protocols accordingly.
