Rendered at 19:46:38 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
rickstanley 2 days ago [-]
When I go to https://leaks.psylo.app on "Possible IP leaks" side I see only "WebAuthn" with my real IP and, occasionally, WebTransport with an incorrect IP. For "HTTPS Traffic" it always show some other relay. Using Safari 26.5
I'm not sure what would I use WebAuthn for, if ever, maybe I could disable it through "Feature Flags" menu?; regardless, I never treat Apple's services as "premium", since the email fingerprinting thing. I pay mainly for Hide My Email, just to organise things per domain, and it's cheap.
goalieca 2 days ago [-]
Webauthn is the api for Passkeys and things.
sam_lowry_ 1 days ago [-]
So WebAuthn leaks real IPs, who would have thought!
Semaphor 1 days ago [-]
Depends on the browser apparently? Only on Webkit is what it says, it’s not clear if the site doesn’t support FF, or if FF is secure.
lapcat 1 days ago [-]
WebKit passes the request to a separate system process.
On Mac, Firefox and Chrome, which don't use WebKit, handle WebAuthn themselves.
inigyou 1 days ago [-]
Yeah. For authentication. It's important that the large tech company knows who you are.
TeMPOraL 1 days ago [-]
Yes, who would've thought Passkeys are a bad idea.
Now for yet another reason.
Semaphor 1 days ago [-]
It’s more than just Passkeys, Webauthn is super convenient with my YubiKeys, I even have it set up as 2FA on some selfhosted services.
6 hours ago [-]
Barbing 20 hours ago [-]
Tommy Mysk, Talal Haj Bakry: how long did you wait after informing Apple of their incompetence before this public disclosure, please?
Thank you for uncovering this and for the website proving the bug.
mysk 13 hours ago [-]
We didn't inform Apple at all. The reason why we didn't is explained here:
Understood, thank you, sad Apple has done enough to lose the trust of experts such as yourselves.
Reading your comment and this 404 piece, perhaps you informed them in the minutes* before disclosure and got some kind of approval? (But essentially that wasn’t really informing them ahead of time, simplified in your comment… or I’m thick somehow, hehe well I can be!)
“We have already informed them. They said the issue was ‘dire,’ but they let us disclose the issue. They didn't provide any time when they will address this,” Mysk said.
*Edit: or informed after and “let us disclose” meant they didn’t demand retraction
irusensei 1 days ago [-]
Apple private relay is very flawed but on the other hand most sites that view connections originating from VPN as suspicious seem to be ok with Apple Private Relay. If you have VPN on your router private relay on top of it could be a good way to do ip address laundering.
lxgr 1 days ago [-]
I find it pretty annoying that iCloud Private Relay does not work together with VPNs.
I mainly use VPNs to access bank sites (or other sites that are annoying enough to use IP country as a proxy for traffic being evil/legitimate) when traveling, but I often forget to turn off the VPN afterwards, and then spend the rest of my day browsing from my home IP (that terminates the VPN), which would have been hidden behind Private Relay if I'd actually been browsing from my home Wi-Fi.
Cross-site/app ad targeting getting creepy good despite using different browser profiles for work/personal browsing etc. is usually a good tell (at least on IPv6).
bernd289 1 days ago [-]
There was at least one other Private Relay issue that doesn’t seem to have received much public attention.
I found and reported an IP leak to Apple in December 2025. The issue was caused by an EDNS Client Subnet (ECS) configuration problem in Akamai’s infrastructure, which could result in the client’s real IP being forwarded when it shouldn’t have been.
Apple confirmed the fix at the end of March 2026, and then I unexpectedly received a $5,000 Security Bounty in July.
Lots of these seem unnecessary, especially collecting "bandwidth usage" and "timestamps".
exabrial 2 days ago [-]
I love iCloud private relay, but I need a way to turn it off. A command line utility would be amazing, along with the ability to turn off/on DNS-over-HTTP.
TechRemarker 2 days ago [-]
You can turn if off in settings > iCloud. Either temporary for a day and auto back on, or permanently until you turn it back on.
exabrial 2 days ago [-]
Yep, but one cannot script that, make it a part of a bash or automator actions, which is a problem.
dabbz 2 days ago [-]
There's a PLIST entry possibly relevant to it in
`~/Library/Preferences/com.apple.networkserviceproxy.plist`
I couldn't figure out how to get any changes to reflect but maybe it's a good pointer towards a solution?
EDIT: Reading into this, looks like they're very intentional about not allowing arbitrary enable/disable calls to it, likely to prevent a hostile entity from switching it off on unsuspecting users. The systems setting calls an XPC into a daemon that makes a web request, then validates the response from the API to update the PLIST structure.
tredre3 1 days ago [-]
> hostile entity from switching it off on unsuspecting users
I agree it's likely to prevent third parties from messing with the setting, but not hostile third parties specifically. Think of a VPN app or file sharing browser extensions who might want to disable the relay "to be helpful".
Because a truly hostile entity capable of changing local settings can already obtain the device's real IP and also capture traffic, the two things private relay is meant to prevent. There would be no point. If anything it might increase the odds of detection.
xnyan 23 hours ago [-]
Apple often plays a game where they blend security and business interests, but represent it only as a security interest.
They own the OS and could do for private relay like what they do for screen recording: when it's in use, overlay an unhideable visual indicator that it's that it's in use. Make it visually obvious when it turns off.
dgsii 2 days ago [-]
Have you tried recording UI events in Automator and saving it as an Application? Then you could execute the .app via script. I haven't done this but in theory it should work.
user43928 1 days ago [-]
osascript with System Events seems to work for opening the right modal in Settings and flipping the switch On, in a quick test.
I did not verify whether it works reliably.
If it does, one could probably package it as a .app and grant only that the Accessibility permission.
klausa 2 days ago [-]
I desperately wish there was a "Turn off for five minutes, I'm dealing with dumb corpsec auth stuff" option.
acdha 23 hours ago [-]
On iOS: page menu —> kebab menu —> show IP address
pasc1878 1 days ago [-]
In macOS view->reload and show IP address
kittikitti 1 days ago [-]
Thank you for this report. My real IP on my phone was constantly leaking and I knew that WebKit was a culprit. However, I doubt that this was an accident. This is a backdoor that Apple planted.
Barbing 2 hours ago [-]
To what benefit of theirs or others?
davidkarpik 1 days ago [-]
[flagged]
SnipeOfficial 2 days ago [-]
[flagged]
selvum 1 days ago [-]
[dead]
glub103011 1 days ago [-]
[dead]
walrus01 2 days ago [-]
Weird advertising on site: "Psylo is our privacy-first browser for iOS and iPadOS"
Correct me if I'm wrong but doesn't Apple disallow any actual 3rd party browser engines? Like, any browser on iOS that isn't the standard safari is just a skin on top of webkit/safari. It doesn't exactly inspire confidence that some third party browser will be able to implement things any better (as compared to like, running Firefox on Android, which actually implements the firefox browser engine).
hnav 2 days ago [-]
My read is that the main value prop is that they configure the WKWebView to not share any state cross-tabs. In the post they state that they've disabled DNS prefetch, WebTransport and WebAuthn so obviously they're hardening beyond what ships in Safari (though some of this may already be covered by lockdown mode).
internet2000 2 days ago [-]
Networking is not handled by the rendering engine, which is an only a part of a browser app. That’s a credible claim.
TingPing 2 days ago [-]
Networking is very core to webkit of course. But it has apis to block and modify requests.
afavour 2 days ago [-]
But WKWebView does handle its own networking. You’re able to implement block lists, just the same as you can via browser plugin, but in this instance networking definitely is handled by WebKit.
Aaargh20318 2 days ago [-]
Networking is handled by WebKit but based on the article it looks like the app configures itself as a HTTP proxy for WebKit and uses that to handle networking.
I'm not sure what would I use WebAuthn for, if ever, maybe I could disable it through "Feature Flags" menu?; regardless, I never treat Apple's services as "premium", since the email fingerprinting thing. I pay mainly for Hide My Email, just to organise things per domain, and it's cheap.
On Mac, Firefox and Chrome, which don't use WebKit, handle WebAuthn themselves.
Now for yet another reason.
Thank you for uncovering this and for the website proving the bug.
https://x.com/mysk_co/status/2085026605529768261
Glad you found the website helpful. Thank you.
Reading your comment and this 404 piece, perhaps you informed them in the minutes* before disclosure and got some kind of approval? (But essentially that wasn’t really informing them ahead of time, simplified in your comment… or I’m thick somehow, hehe well I can be!)
https://www.404media.co/apples-private-relay-is-exposing-use...*Edit: or informed after and “let us disclose” meant they didn’t demand retraction
I mainly use VPNs to access bank sites (or other sites that are annoying enough to use IP country as a proxy for traffic being evil/legitimate) when traveling, but I often forget to turn off the VPN afterwards, and then spend the rest of my day browsing from my home IP (that terminates the VPN), which would have been hidden behind Private Relay if I'd actually been browsing from my home Wi-Fi.
Cross-site/app ad targeting getting creepy good despite using different browser profiles for work/personal browsing etc. is usually a good tell (at least on IPv6).
I found and reported an IP leak to Apple in December 2025. The issue was caused by an EDNS Client Subnet (ECS) configuration problem in Akamai’s infrastructure, which could result in the client’s real IP being forwarded when it shouldn’t have been.
Apple confirmed the fix at the end of March 2026, and then I unexpectedly received a $5,000 Security Bounty in July.
Lots of these seem unnecessary, especially collecting "bandwidth usage" and "timestamps".
I couldn't figure out how to get any changes to reflect but maybe it's a good pointer towards a solution?
EDIT: Reading into this, looks like they're very intentional about not allowing arbitrary enable/disable calls to it, likely to prevent a hostile entity from switching it off on unsuspecting users. The systems setting calls an XPC into a daemon that makes a web request, then validates the response from the API to update the PLIST structure.
I agree it's likely to prevent third parties from messing with the setting, but not hostile third parties specifically. Think of a VPN app or file sharing browser extensions who might want to disable the relay "to be helpful".
Because a truly hostile entity capable of changing local settings can already obtain the device's real IP and also capture traffic, the two things private relay is meant to prevent. There would be no point. If anything it might increase the odds of detection.
They own the OS and could do for private relay like what they do for screen recording: when it's in use, overlay an unhideable visual indicator that it's that it's in use. Make it visually obvious when it turns off.
I did not verify whether it works reliably.
If it does, one could probably package it as a .app and grant only that the Accessibility permission.
Correct me if I'm wrong but doesn't Apple disallow any actual 3rd party browser engines? Like, any browser on iOS that isn't the standard safari is just a skin on top of webkit/safari. It doesn't exactly inspire confidence that some third party browser will be able to implement things any better (as compared to like, running Firefox on Android, which actually implements the firefox browser engine).