Apple's Private Relay feature leaks real IP addresses due to flaws

In a recent revelation, researchers Talal Haj Bakry and Tommy Mysk uncovered significant flaws in Apple's Private Relay feature, which is designed to mask users' IP addresses while browsing the internet using Safari. This feature, available exclusively to iCloud+ subscribers, was intended to enhance user privacy by preventing websites from tracking their real IP addresses. However, the researchers identified that a series of vulnerabilities within Apple's web browser engine, WebKit, could be exploited to reveal users' actual IP addresses, undermining the very purpose of the feature. The findings were shared in a blog post, where the researchers also launched a website that allows users to check if their real IP address is being leaked while using Private Relay. TechCrunch verified the effectiveness of this site, confirming that it could indeed expose the real IP address of users relying on the feature. The issue was initially reported by 404 Media, highlighting the potential risks associated with Apple's implementation of privacy features. Mysk expressed concerns about the reporting process to Apple, citing previous experiences that involved delays and inconsistent communication regarding similar issues. As a result, the researchers opted not to report the vulnerabilities directly to Apple. Instead, they have developed a private browser called Psylo, which they claim has implemented measures to prevent IP address leaks, offering users a more secure browsing experience. This situation raises important questions about the effectiveness of privacy features in technology and the responsibility of companies to ensure user security.