It turns out that vulnerabilities in the browser could allow Apple’s Private Relay to leak real IP addresses.
Private Relay is a privacy feature that is expected to protect Safari users from their true IP address being revealed when surfing the web. But, there are some security flaws that could make it possible for websites to reveal a user’s real IP address despite the safeguarding.
The results suggest that while Apple’s privacy tools are effective within the browser, they may not provide comprehensive protection at the device level.
The researchers who found the problem have made a website so that users can determine if their real IP address can be revealed when using Private Relay. The tool, it turns out, reportedly can still uncover the real IP address as well, even with Private Relay turned on.
There are ways to circumvent Private Relay Protection.
Private Relay is a new feature in Apple’s iCloud+ subscription service that’s designed to enhance online privacy for Safari users.
When using Safari, the feature simply obscures the user’s IP address from the websites or network that they are accessing. In other words, it transmits Internet data via two different Internet relays, complicating the ability of websites to correlate browsing with a user.
But researchers discovered some browser behaviors that would enable a Web site to evade this protection.
Talal Haj Bakry and Tommy Mysk were the security researchers who identified the issue and explained that the problem is linked to three features in Apple’s WebKit browser engine.
WebKit is the engine used for Safari and all browsers on iOS need it.
That means it may impact not just Safari, but other browsers on iPhones and iPads as they share the WebKit framework with Apple.
Private Relay is Not a Full VPN Replacement.
The big difference is that compared to a standard virtual private network (VPN), Apple’s Private Relay isn’t a VPN.
A VPN operates at the device level, which entails concealing an IP address for numerous applications and companies.
Private Relay is only effective when using Safari.
The feature doesn’t apply to apps or other Internet connection on the device.
This restriction may require users to seek extra solutions to achieve total privacy protection outside of Private Relay.
The feature was not meant to replace a full VPN service, but rather to enhance privacy while browsing Safari.
An IP Leak Testing Tool was created by researchers.
To illustrate the problem, the researchers developed a site for people to test and see if their real IP address is disclosed when using Private Relay.
Reports showed that the site was able to detect the actual IP even with Private Relay enabled.
That flaw is due to some WebKit functions that could give a website a way to find out information that Private Relay is supposed to obscure, the researchers said.
The finding underscores the challenge of developing fully secure privacy systems, particularly when different technologies are used in combination.
Researchers did NOT report the issue directly to Apple.
The researchers opted not to submit the vulnerability through Apple’s regular vulnerability reporting.
Mysk said in a statement published online that he and his team had dealt with Apple in the past, which meant they knew that the security reports could take a long time, there may be poor communication, or there may be disagreement regarding the impact of security issues reported.
Apple has not yet made any public statements to the researchers’ claims, nor has it released any details regarding whether or not it is working on a fix.
The security researchers may want to let the company know of the issue in a responsible disclosure process, but sometimes that process can be fraught with disagreements regarding communication and how long it takes.
The worry over privacy continues to grow.
The discovery comes at a time when online privacy has become increasingly important for consumers.
There was a growing awareness on the part of users about the collection of data on browsing habits and online activity by websites, advertisers, and technology companies.
Smart functionalities, such as Private Relay, aim to offer improved privacy safeguards without demanding expertise in complex security tools.
But as seen in such cases, privacy needs have to continually be adapted with new vulnerabilities being identified.
Large technology firms with great security resources could still have issues safeguarding client data.
An alternative browser boasts better protection.
The creators of the discovery have also created a privacy-focused browser called Psylo.
They added that their browser now has protections to block such IP address leaks on users who use the browser for privacy.
Although other privacy browsers may offer further protection, users should be aware of the limitations of any privacy technology that they use.
There is no single characteristic which can ensure absolute anonymity online.
What Users Should Know
The discovery doesn’t rule out Private Relay for users who are privacy conscious.
This feature remains useful in making it more difficult for networks and websites to track browsing activity.
But users should be aware that it is not the same as a VPN, and may not offer full IP address protection in all cases.
Those wishing for a higher level of privacy protection should also consider taking further steps to safeguard themselves, including using trusted VPN services, privacy-focused browsers, and managing app permissions.
Browser Privacy in the future.
This Private Relay problem is a harbinger of a bigger problem for the tech sector: how to safeguard privacy without sacrificing online convenience.
Today’s more sophisticated browser is also more complex, which opening new doors to security vulnerabilities.
Businesses will have to keep developing privacy devices and rapidly patching holes that are found by researchers.
The finding is a reminder, for now, that while privacy tools can mitigate tracking risks, they don’t necessarily prevent them.
