For those using iCloud+ and Safari, Apple offers an extra layer of privacy with iCloud Private Relay. This feature prevents websites from accessing your actual IP address and exact location. However, security researchers have identified vulnerabilities in some WebKit features that can bypass this protection.
Researchers Talal Haj Bakry and Tommy Mysk found that DNS prefetching, a WebAuthn feature connected to passkeys, and WebTransport can circumvent WebKit’s proxy configuration. Two methods can reveal your real IP address, while the other can disclose information about your DNS servers.
How iCloud Private Relay Protects You
iCloud Private Relay, available to iCloud+ subscribers, encrypts DNS records while providing websites a temporary IP address instead of your actual one. This approach prevents any single entity from knowing both your identity and browsing activity.
WebKit Vulnerabilities
Each identified vulnerability has different implications:
- DNS Prefetching: This feature speeds up page loading by preloading URLs. However, WebKit can send these requests via your regular DNS, exposing your real network path.
- WebAuthn Requests: Used for credentials across websites, WebAuthn can send verification files directly from your device, disclosing your real IP address.
- WebTransport Connections: Designed for low-latency server connections, this feature can bypass Private Relay, revealing your IP address.
Impact on Apple Users
The issues matter most for users relying on Safari with iCloud Private Relay for privacy. WebKit-based browsers on iOS and macOS are also affected. VPNs are not impacted by these leaks as they tunnel traffic at the system level.
Maintaining Privacy on Safari
Steps to enhance your privacy include:
- Keep Private Relay enabled to protect Safari traffic.
- Update your Apple devices regularly to receive security patches.
- Use a reliable full-device VPN for critical IP privacy.
- Stay informed on browser privacy features and updates.
Browser developer Psylo has introduced changes to counter these vulnerabilities, showing that developers can close specific leaks.
Takeaways
While iCloud Private Relay offers significant protection, users should be aware of its limitations. The invisibility of these vulnerabilities highlights the need for understanding the nuances of privacy tools. Discoveries like these are crucial as they inform users of their true privacy boundaries.
If these findings affect your trust in Private Relay, or you plan to continue using it, share your thoughts at CyberGuy.com.
Leave a Reply