iCloud Private Relay: Privacy Concerns and Solutions

Apple users paying for iCloud+ may have activated iCloud Private Relay for added privacy with Safari. This feature is meant to keep websites from viewing your true IP address and location. However, recent findings by security researchers reveal three ways certain WebKit features might breach these privacy defenses.

Research Findings on WebKit Vulnerabilities

Researchers Talal Haj Bakry and Tommy Mysk discovered how DNS prefetching, a WebAuthn feature linked to passkeys, and WebTransport could bypass WebKit’s proxy setup. Two of these methods might expose your real IP address, while the third might reveal your device’s DNS server information. These findings are concerning due to their foundation in legitimate browser technology and do not require users to download questionable files or apps.

Apple’s iCloud Private Relay is meant to cloak your IP address, yet some WebKit paths can evade this protection. (Kurt “CyberGuy” Knutsson)

Understanding iCloud Private Relay

iCloud Private Relay is available to iCloud+ subscribers, working with Safari browsing. It routes Safari requests via two internet relays; though your provider sees your IP address, your DNS records remain encrypted. The second relay provides a temporary IP address to sites, maintaining anonymity.

This structure ensures no single entity can see both your identity and browsing activity, making Private Relay useful for reducing the collection of location and browsing data by websites. However, the documented WebKit behavior creates exceptions to this protective relay.

How WebKit Leaks Information

The researchers identified three mechanisms bypassing Private Relay’s protection.

• DNS Prefetching: To speed up website loading, browsers often perform DNS lookups for links before they’re clicked. WebKit might send these requests outside the Private Relay’s proxy path, exposing your real network IP.
• Passkey-Related Requests: WebAuthn allows passkeys to work across related domains, verified by a retrieval via the browser. This verification can reveal your IP address as it occurs outside the proxied Safari network path.
• WebTransport Connections: Used for low-latency server connections, WebKit may establish WebTransport connections directly, sidestepping the configured proxy and allowing servers to see your real IP address.

Affected Apple Users

These findings are crucial for Safari users relying on iCloud Private Relay to hide their IP addresses. Privacy-focused browsers and apps employing WebKit’s proxy configuration are also impacted. The proxy leaks identified do not affect VPNs, as VPNs tunnel traffic system-wide, unlike WebKit’s browser-level proxy.

It’s important to remember that VPNs do not eliminate all forms of tracking as websites can still identify users through logins, cookies, and other identifiers.

Implications and Protections

Though these leaks are concerning, users should not hastily deactivate Private Relay. Despite the exceptions found in WebKit, most Safari traffic follows Private Relay’s privacy architecture. Apple aims to keep websites from seeing your real IP address during browsing.

Websites might use the described mechanisms to learn your IP address or DNS connection information, possibly without any warning. However, general IP addresses usually don’t provide home addresses but can expose your internet provider and general location.

Apple, addressing privacy concerns, hasn’t yet commented on the findings.

Improving Privacy with Safari

Steps to enhance privacy amidst concerns:

• Keep Private Relay activated for the protection it offers.
• Regularly update Apple devices to receive privacy and security fixes quickly.
• Consider using a trustworthy VPN for a higher level of IP privacy protection.
• Continue using passkeys as they remain strong account protection measures.
• Monitor browser privacy updates for developers addressing WebKit vulnerabilities.

Understanding the protection offered by privacy features like iCloud Private Relay is crucial. Despite the findings, its value lies in providing meaningful protection with minimal effort. When hiding your IP is critical, supplementing it with a full-device VPN is advisable.

Would knowing a website could bypass Private Relay impact your trust in this feature? Share your thoughts at CyberGuy.com.

Stay informed with my FREE CyberGuy Report for tech tips, security alerts, and exclusive offers. Visit CyberGuy.com for insights trusted by millions, plus access to my Ultimate Scam Survival Guide free upon joining.