Understanding iCloud Private Relay and Its Privacy Gaps

If you’re an iCloud+ subscriber using Safari, you may have activated iCloud Private Relay for extra privacy. This feature conceals your real IP address and location. However, security researchers recently uncovered ways that some WebKit features can bypass this protection.

How WebKit Features Bypass iCloud Private Relay

Researchers Talal Haj Bakry and Tommy Mysk found that DNS prefetching, a WebAuthn feature, and WebTransport can bypass WebKit’s proxy settings. This can inadvertently expose your actual IP address or DNS servers.

These methods don’t require downloading malicious files. They rely on legitimate browser technologies.

Here’s an overview of how these bypasses work and who they affect.

DNS Prefetching and Network Exposure

Web browsers often prefetch DNS to speed up browsing. Normally, these requests should remain private. However, in some cases, WebKit sends them through the normal DNS path, not via the proxy, revealing your real network.

WebAuthn and IP Exposure

The WebAuthn standard allows passkeys to be verified across related domains. This verification sometimes occurs outside Safari’s normal paths, potentially exposing your device’s true IP address.

WebTransport and Direct Connections

WebTransport aims to maintain low-latency connections with servers. Researchers found that this can happen outside the proxy, revealing your IP address.

Implications for iCloud Private Relay Users

Safari users relying on iCloud Private Relay to hide their IP addresses are most affected. Privacy-focused apps using WebKit’s proxy settings can also be impacted.

VPNs are not susceptible to these WebKit proxy leaks since they operate at a system level.

Recommendations for Improved Privacy

• Keep Private Relay On: Don’t turn off Private Relay; it still protects most Safari traffic.
• Update Devices Regularly: Install updates for iOS, iPadOS, and macOS as soon as they’re available.
• Consider a VPN: Use a reputable VPN if concealing your real IP is crucial.
• Use Passkeys: Despite the findings, passkeys remain a secure option.
• Monitor Browser Privacy Updates: Stay updated on how your browser handles these issues.

Conclusion

iCloud Private Relay provides substantial privacy but isn’t foolproof. Understanding these limits helps you make informed decisions about protecting your online identity. While waiting for Apple to address these gaps, using a VPN might offer the additional security you need.