Privacy features sold as a single switch are rarely as simple as the switch suggests. The latest reminder comes from Apple's iCloud Private Relay, the iCloud+ feature that promises to hide your IP address while you browse — and which, security researchers have now shown, sometimes does not.
The researchers, including Tommy Mysk, built test pages that returned visitors' real, unmasked IP addresses with Private Relay switched on. The cause is three flaws in WebKit, the browser engine every iOS browser is required to use, which allow certain operating-system-level requests to slip past Private Relay's proxy path entirely. Among the triggers: requests made by passkeys through the WebAuthn standard. "Any website that supports, or pretends to support, passkeys can see the user's real IP address despite having iCloud Private Relay on," Mysk told 404 Media, whose own tests confirmed the demonstration site worked as described.
The "pretends to support" clause deserves a moment's attention. A site does not need a legitimate passkey feature to exploit this; it merely needs to go through the motions. And because the flaws live in WebKit rather than in Safari alone, the exposure reaches further than Apple's own browser — the researchers found at least one Tor client for iOS, OnionBrowser, leaking real addresses, though the official Tor Browser is not affected. The flaws were disclosed on 4 August, and Apple says it is investigating.
It is worth being clear about what Private Relay ever promised. It is not a virtual private network, however much its marketing rhymes with one. It routes Safari traffic only, not the rest of your device's activity, and Apple has always said so — quietly, in the small print, where such distinctions live.
So, what to do. If Private Relay is your comfort against casual tracking and advertising profiles, carry on; it still does that job most of the time, and WebKit fixes will arrive through normal software updates, which you should install promptly. But if your safety or livelihood genuinely depends on hiding your location — journalists, the harassed, anyone with a determined adversary — this episode is the argument for not resting that weight on a convenience toggle. Use a proper VPN, or the Tor Browser, which held up here.
Private Relay is a comfort feature. Comfort features are worth having, so long as nobody mistakes them for armour.
