Apple's Private Relay Vulnerability Exposes Users' IP Addresses

• •Apple's Private Relay can leak real IP addresses due to flaws in passkey processing.
• •Researchers created a site to test for IP leaks, confirming the vulnerability.
• •Apple has acknowledged the issue but has not committed to a timeline for resolution.

Security researchers have discovered that Apple's iCloud Private Relay can inadvertently expose users' real IP addresses due to flaws in how passkeys are processed. This issue arises when requests bypass Safari's proxy protections, allowing websites to see the user's actual IP address. The researchers, Tommy Mysk and Talal Haj Bakry, created a testing site demonstrating the leak. They opted not to report the issue to Apple due to past experiences with delayed responses. The vulnerability affects users of Private Relay and the OnionBrowser app, but not the official Tor Browser. Apple acknowledged the severity of the issue but has not provided a timeline for a fix. The researchers have developed a private browser called Psylo, which mitigates the IP leak problem.