Apple’s Private Relay, an opt-in feature designed to hide a user’s IP address when they browse the internet with Safari, can be circumvented to reveal the supposedly hidden IP address due to a series of flaws.
Researchers revealed the issues in a blog post on Tuesday. The researchers also set up a website where anyone can check if their real IP address leaks, even if they use Private Relay. In a test on Tuesday, TechCrunch verified that the site was able to reveal our real IP address.
The issue was first reported by 404 Media.
Talal Haj Bakry and Tommy Mysk, the researchers who found the issue, wrote in their blog post that the problem lies with three features in Apple’s web browser engine WebKit, which is used by all browsers in iOS. Private Relay is only available to iCloud+ subscribers, and is not like a Virtual Private Network, or VPN, which protects someone’s IP address at the system level. Private Relay only works while using Safari.
Mysk wrote in a post on X that they chose not to report the issue to Apple because “our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue’s impact entirely.”
Apple did not immediately respond to a request for comment.
Mysk and his colleagues develop a private browser called Psylo, which they say now has mitigations that prevent users’ IP addresses from leaking when using Psylo.