If you pay for iCloud+ and rely on Private Relay to hide your IP address while browsing, you might want to pay attention to this one. New research by security researchers Tommy Mysk and Talal Haj Bakry, first reported by 404 Media, reveals that Private Relay doesn’t hide your IP address as well as Apple claims.
How does the leak actually happen?
Private Relay is supposed to route your Safari traffic through a two-hop relay so nobody, not even Apple, can connect your identity to the sites you visit. The problem lies in how passkeys work. When a website asks your device to verify a passkey, your iPhone’s credential service fetches the validation file directly, bypassing Safari and Private Relay. Since the request never touches your browser’s protected traffic, the website receiving it sees your real IP address instead of the relay’s.
Mysk explained the scope of the issue plainly, telling 404 Media that “any website that supports, or pretends to support, passkeys” can access this information, even with Private Relay switched on. The researchers also noted in their own research post that because the fetch comes from the “device’s real IP address either way,” there is currently no way around it while using Safari with Private Relay turned on.
Should you be worried?
This isn’t the first privacy hiccup for Apple’s paid iCloud+ features either. Just last month, it was reported that Apple’s Hide My Email tool was quietly exposing users’ real email addresses, a bug the company reportedly knew about for over a year before fixing it.
The silver lining here is that regular VPNs are not affected, since they encrypt your entire device’s traffic at the system level instead of just your browser. If you use Private Relay for anything sensitive, it might be worth switching to a full VPN until Apple sorts this out. Apple has told 404 Media that it is looking into the researchers’ findings, so hopefully a fix isn’t too far away.
