WEB Signal 374
Apple's Private Relay feature could reveal your IP address to websites and services
↗
Researchers found that Apple's Private Relay can expose a user's IP address when passkey authentication is used, due to a WebKit issue affecting Safari and other iOS browsers.
Engineers who depend on Private Relay for IP masking may see unintended exposure, particularly when integrating passkey-based login flows. The limitation reveals that the feature does not provide system-wide network protection, which could affect privacy-focused designs.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Private Relay is designed to hide IP addresses in Safari but fails when passkey authentication triggers requests outside the browser.
The underlying WebKit bug means any iOS browser using the engine, including privacy-focused ones like OnionBrowser, can leak the IP during passkey use.
Apple is investigating the issue, but a fix may take time, similar to the delayed resolution of a previous Hide My Email leak.
THE READ
What the cluster adds up to.
Apple’s Private Relay is intended to mask a user’s IP address while browsing with Safari, but security researchers discovered that the protection breaks down when a passkey login initiates an authentication request outside the browser. The failure stems from a bug in Apple’s WebKit engine that does not route those external requests through the Private Relay relay. As a result, the device’s real IP address can be seen by the destination website or service. This undermines the privacy guarantee that Private Relay promises for Safari traffic.
Because WebKit is the underlying rendering engine for all browsers on iOS, the same flaw affects any iOS-based browser, not just Safari. Privacy-oriented browsers such as OnionBrowser and the researchers’ own Psylo browser are therefore vulnerable when a passkey is used for login. The leak occurs regardless of the browser’s stated privacy goals, as the engine itself exposes the IP. Users who rely on these browsers for anonymity may unintentionally reveal their address during passkey authentication.
The researchers disclosed their findings to the OnionBrowser team and the Tor Project, which maintains the anonymity network used by that browser. Apple told the press that it is investigating the report, but a fix may not arrive quickly. A comparable issue with the Hide My Email feature took a long time to patch after it was first reported. Engineers should expect a similar delay before a remedy for the Private Relay leak is deployed.
For developers and operators, relying solely on Private Relay to hide IP addresses is insufficient when applications use passkey authentication. Additional network-level protections, such as a VPN or traffic-routing rules, may be required to prevent IP exposure. Testing should include scenarios where passkey triggers external requests to verify that the IP remains concealed. Until Apple addresses the WebKit bug, the privacy guarantee of Private Relay cannot be assumed for passkey-based flows.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER