A recent discovery by security researchers has brought to light a significant vulnerability in Apple's WebKit engine, revealing that users' genuine IP addresses might not be as hidden as presumed, even when utilizing the iCloud Private Relay feature. This issue specifically arises from how passkey-related requests are handled, bypassing the intended privacy protections of Safari. Apple has acknowledged these findings and is currently looking into the matter, stirring conversations around the robustness of privacy safeguards within its popular ecosystem.
The core of this privacy concern, identified by Tommy Mysk and Talal Haj Bakry, stems from the interaction between WebAuthn requests and the iOS operating system. Unlike typical web traffic that routes through Safari's established browser stack, requests involving passkeys are directly processed by Apple's system-level credential service. This critical distinction means that such requests entirely sidestep the iCloud Private Relay, a service designed to obscure a user's IP address by encrypting and rerouting their internet traffic through multiple relays.
Consequently, when a website initiates a passkey prompt, or even simulates such a request, the user's actual IP address can become visible, despite their belief that Private Relay is actively concealing it. This vulnerability is particularly concerning because the interaction appears seamless to the user, who would likely remain unaware of the underlying exposure. The issue is not confined to Safari alone; because Apple mandates that all iOS browsers are built on its WebKit engine, alternative browsers are similarly affected. Even privacy-focused applications, such as OnionBrowser on the Tor network, have shown to leak real IP addresses under these circumstances. However, traditional system-wide VPNs remain secure, as they operate at the operating system level, encrypting all outgoing traffic.
To substantiate their findings, the researchers developed a specialized website designed to test for this IP address exposure. Their tests reportedly confirmed that devices with iCloud Private Relay enabled indeed revealed their actual IP addresses when subjected to these passkey-related interactions. This revelation marks the second high-profile privacy incident involving an Apple subscription feature in recent memory, following a vulnerability in 'Hide My Email' that was later patched. As Apple investigates this latest report, the timeline and method for addressing this WebKit flaw remain to be seen, leaving users to ponder the true extent of their online privacy.
In essence, the findings underscore a critical loophole in Apple's Private Relay, demonstrating that its protective shield does not extend to all forms of internet traffic, particularly those linked to passkey authentication. This unintended exposure of IP addresses raises questions about the comprehensive nature of the privacy features offered by Apple and highlights the continuous challenge of ensuring robust digital anonymity in an evolving technological landscape.