Apple iCloud+ users using iCloud Private Relay in Safari may face privacy risks. Although designed to protect IP addresses and locations, researchers have highlighted gaps in this layer of security.

Identified Vulnerabilities

Security experts Talal Haj Bakry and Tommy Mysk have identified three potential loopholes in WebKit features, such as DNS prefetching, WebAuthn with passkeys, and WebTransport. These features might allow bypassing the intended protection, exposing users’ real IP addresses and DNS information.

DNS Prefetching

Browsers often prefetch DNS to speed up web browsing. However, WebKit can send DNS requests through typical DNS paths, revealing a user’s actual network details.

WebAuthn Passkey Request

For passkey verification across associated domains, WebAuthn might involve direct communication with websites. This bypasses normal proxy configurations, leading to potential IP exposure without impacting passkey safety.

WebTransport Connections

WebTransport may establish server connections that reveal real IP addresses, as it bypasses Private Relay’s protective path. This feature suits interactive web services needing low-latency connections.

Implications for Users

These issues predominantly affect users relying on Safari with Private Relay. However, the vulnerabilities extend to WebKit-based browsers on iOS and macOS. Users should note that VPNs are not impacted, as they secure traffic differently.

Privacy and Security Measures

To safeguard your browsing activity:

• Keep Private Relay active to protect Safari traffic that uses Apple’s system.
• Maintain up-to-date Apple devices, ensuring prompt security updates.
• Consider using a VPN for robust IP address protection.
• Use passkeys, as they remain secure despite the related IP exposure risk.
• Stay informed about browser updates that address these specific issues.

Apple continues to promote privacy protections through its products. While Private Relay offers significant advantages, it’s vital to understand where its limits lie.

The latest updates from browser developers show steps toward closing these vulnerabilities, highlighting the ongoing importance of privacy features.