by Dan Moren
Report: Apple’s Private Relay may not be as private as thought
A story by 404 Media’s Joseph Cox, who last month broke the news about a flaw in Apple’s Hide My Email feature, is now back to report that iCloud Private Relay, a feature that is supposed to obfuscate users’ IP addresses, may not be so private:
A series of issues in Apple’s web browser engine — the tech underlying all browsers on iOS — means that Apple’s iCloud Private Relay tool, which is supposed to hide a user’s IP address, in many cases doesn’t actually work. Instead, the issues mean a malicious attacker can set up a website to learn a Private Relay user’s real IP address, or that many websites have also already collected this information incidentally. The issues also impact OnionBrowser, an iOS app for browsing the web through the Tor anonymity network, the researchers who discovered the issues say.
Fascinatingly, this flaw seems to be due to the implementation of passkeys: the authentication happens out of band, in a separate connection, and therefore never runs through Private Relay.
The security researchers who uncovered the issue have put up a site that lets you check if you’re affected; I wasn’t able to test it this morning, as the Wi-Fi network I’m using as of this writing doesn’t support Private Relay at all. (Joke’s on me, I guess!) They’ve also reported the vulnerability to Apple, who did not provide a timeline for fixing it, but allowed them to disclose the issue nonetheless.
Cox points out that along with the Hide My Email bug, this is the second time that a vulnerability has affected Apple’s paid privacy features, since both are part of the iCloud+ subscription. Though Apple did finally patch the Hide My Email flaw late last month, a second flaw is not a great look for a company that prides itself on privacy and security.