Apple’s Private Relay, an opt-in feature designed to hide a user’s IP address when they browse the internet with Safari, can be circumvented to reveal the supposedly hidden IP address due to a series of flaws.
Researchers revealed the issues in a blog post on Tuesday. The researchers also set up a website where anyone can check if their real IP address leaks, even if they use Private Relay. In a test on Tuesday, TechCrunch verified that the site was able to reveal our real IP address.
Talal Haj Bakry and Tommy Mysk, the researchers who found the issue, wrote in their blog post that the problem lies with three features in Apple’s web browser engine WebKit, which is used by all browsers in iOS. Private Relay is only available to iCloud+ subscribers, and is not like a Virtual Private Network, or VPN, which protects someone’s IP address at the system level. Private Relay only works while using Safari.
Mysk wrote in a post on X that they chose not to report the issue to Apple because “our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue’s impact entirely.”
Apple did not immediately respond to a request for comment.
Mysk and his colleagues develop a private browser called Psylo, which they say now has mitigations that prevent users’ IP addresses from leaking when using Psylo.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Lorenzo Franceschi-Bicchierai is a Senior Writer at TechCrunch, where he covers hacking, cybersecurity, surveillance, and privacy.
You can contact or verify outreach from Lorenzo by emailing lorenzo@techcrunch.com, via encrypted message at +1 917 257 1382 on Signal, and @lorenzofb on Keybase/Telegram.
Scale faster. Grow your portfolio. Gain practical expertise. No matter your goal, Disrupt can empower you.Save up to $330 today!
Influencers draw backlash for attending OpenAI’s first luxury trip
Sequoia’s Shaun Maguire leads $1B round for nuclear startup Valar Atomics
Malaysia is reportedly shutting down Balaji Srinivasan’s Network School
YouTuber Hank Green says his AI usage is ‘not healthy’
WhatsApp is testing a new folder for messages from large businesses
Okta buys AI security startup Permiso — source says for about $200M
