Apple's Private Relay, a feature designed to enhance user privacy by masking their IP addresses, has been found to have significant vulnerabilities. Security researchers have discovered that these issues not only expose users' real IP addresses to malicious websites but also impact the OnionBrowser, an iOS app designed for browsing the web through the Tor anonymity network. This revelation comes on the heels of a previous bug in Apple's Hide My Email feature, which was left unaddressed for over a year before being fixed after media coverage.
The core problem lies in the way passkeys work, a secure alternative to traditional usernames and passwords. When a user's device makes a web request outside of the browser, it bypasses Private Relay, exposing the user's real IP address. This is particularly concerning because all web browsers on iOS use Apple's WebKit engine, which means the issue affects not just third-party browsers but also the built-in Safari browser.
The researchers have developed a tool, accessible at https://leaks.psylo.app/, that allows Private Relay users to check if their IP addresses are being exposed. This tool has confirmed the issue, highlighting the vulnerability of users' privacy. The impact of these vulnerabilities extends beyond individual users, as it affects the very foundation of Apple's privacy-focused products.
Mike Tigas, the creator of OnionBrowser, expressed the gravity of the situation, stating that the issues are 'dire' and are entirely based on how iOS and WebKit work, which are under Apple's control. However, the official Tor Browser, developed by the Tor Project, is not affected by these vulnerabilities, making it the recommended choice for those seeking anonymity online.
This discovery raises serious questions about the effectiveness of Apple's privacy measures and the potential risks faced by users. As Apple investigates the issue, users are advised to be cautious and consider alternative methods to protect their privacy, especially when using web browsers on iOS devices.
