iCloud Private Relay can leak your real IP through passkeys: Apple is investigating

Security researchers Tommy Mysk and Talal Haj Bakry say Apple’s iCloud Private Relay can, in some cases, give away your real IP address during passkey verification. That cuts against one of the feature’s main privacy claims. According to Mysk and Bakry, when a website asks for passkey verification, Apple’s credential service may pull the site’s validation file directly, rather than routing the request through Safari’s two-relay system. If that happens, a site that supports passkeys, or even just claims to, could see your actual IP address. Apple says it’s investigating.

NordVPN Download

And because every browser on iPhone and iPad has to run on Apple’s WebKit engine, the problem may reach beyond Safari. Mysk and Bakry also flagged WebKit DNS prefetching and WebTransport issues that can expose your real IP or DNS data in some situations. That matters more now that passkeys are showing up across more of the web.

If you count on Private Relay for anonymity, keep an eye on this. Especially if you’re a journalist, an activist, or living in a country with censorship or heavy surveillance. A VPN protects traffic at the system level, so it isn’t exposed in the same way, and a leaked IP address can still give away your general location and make it easier for third parties to track you from one session to the next.

Private Relay comes with iCloud+ on Apple devices. This report also lands not long after a separate Hide My Email bug exposed users’ real email addresses, which puts more pressure on Apple over how fast it fixes privacy flaws.