<\/p>\n
If you pay for iCloud+ and use Safari, you may have turned on iCloud Private Relay for an extra layer of privacy. Apple<\/a> designed the feature to prevent websites from seeing your actual IP address and exact location.<\/p>\n Now, security researchers<\/a> have found three ways that certain WebKit features can slip outside that protection.<\/p>\n Researchers Talal Haj Bakry and Tommy Mysk discovered that DNS prefetching, a WebAuthn feature connected to passkeys and WebTransport can bypass WebKit’s proxy configuration. Two of those methods can expose your real internet protocol (IP) address. The other can reveal information about the DNS servers your device is using.<\/p>\n What makes this especially concerning is that these are legitimate browser technologies<\/a>. A website does not necessarily need to convince you to download a suspicious file or install a shady app for the network requests to occur.<\/p>\n Here’s how these iCloud Private Relay leaks work, who may be affected and what you can do to better protect your privacy.<\/p>\n New! Free live CyberGuy class: Protect Your Money From Today\u2019s Biggest Threats<\/strong><\/p>\n Join us Saturday, Aug. 29, at 10 a.m. ET for a free CyberGuy LIVE class<\/strong> covering five simple steps to help defend yourself against AI scams, fraud, identity theft and financial hacks. Kurt “CyberGuy” Knutsson will explain how to set up bank alerts, strengthen your account logins, protect your phone number, freeze your credit and help secure your retirement savings against unauthorized transfers. No technical experience is needed. You\u2019ll also receive our financial protection checklist, and every registrant will get a link to the class recording afterward.<\/p>\n Reserve your free spot today at CyberGuyLive.com.<\/strong><\/p>\n ARE APPLE DEVICES SPYING? WHAT YOUR IPHONE TRACKS<\/strong><\/a><\/p>\n Apple’s iCloud Private Relay is available to iCloud+ subscribers and works with Safari browsing. When you turn it on, Apple sends your Safari requests through two separate internet relays. Your internet provider can see your IP address, but your DNS records are encrypted. A second relay then gives the website a temporary IP address instead of your actual one.<\/p>\n The design keeps any single party from seeing both who you are and which websites you visit. That makes Private Relay useful if you want to reduce the amount of location and browsing information websites can collect about you. However, the newly documented WebKit behavior creates paths around that relay.<\/p>\n The researchers identified three separate mechanisms. Each works a little differently.<\/p>\n Browsers often try to make websites load faster by looking up the addresses of links before you click them. This process is called DNS prefetching. Normally, you would expect those lookups to follow the same privacy path as the rest of your browsing.<\/p>\n The researchers found that WebKit can instead send these DNS requests through your device’s normal DNS connection. As a result, a website could see DNS requests coming from your real network instead of the proxy. The issue has been available on iOS since iOS 26.0, according to the researchers.<\/p>\n This does not directly hand over everything you are doing online. However, it can expose network information that Private Relay was expected to shield.<\/p>\n The second issue involves WebAuthn, the web standard used by passkeys. Some companies operate several websites and want the same passkey to work across those related domains. WebAuthn has a feature that lets a device verify whether those websites belong together. To do that, the operating system may contact a website directly to retrieve a small verification file.<\/p>\n According to the researchers, that request happens outside Safari’s normal proxied network path. Therefore, the destination server can receive your device’s real IP address even while Private Relay is active.<\/p>\n Importantly, this research does not show that an attacker can steal your passkey through this flaw. The privacy exposure comes from the network request used during verification. So, there is no reason to abandon passkeys because of this finding.<\/p>\n WebTransport gives websites a faster way to maintain low-latency connections with servers. Certain interactive web services can benefit from that speed.<\/p>\n However, researchers found that WebKit can establish a WebTransport connection directly from your device instead of sending it through the configured proxy.<\/p>\n When that happens, the server on the other end can see your actual IP address. Private Relay does not intercept that connection because it occurs outside the network path Private Relay normally protects. WebTransport became publicly available on iOS with iOS 26.4.<\/p>\n SHARED VPN VS DEDICATED IP: WHICH ONE IS RIGHT FOR YOU?<\/strong><\/a><\/p>\n