Uh-oh: Apple’s ‘private’ VPN-style service could leak your IP address

Apple built its company around protecting users’ privacy and security. Outgoing CEO Tim Cook even called privacy a “fundamental human right.” Unfortunately, Apple’s secure walled garden has crumbled in recent months, all thanks to a rise in software bugs and security features that don’t work as advertised. Now, a new threat rears its ugly head as reports claim that Apple’s VPN-like service, iCloud Private Relay, doesn’t actually mask users’ IP addresses at all.

Apple was proud to show off a string of privacy-focused features for iCloud+ subscribers during WWDC in 2021. One of them was Hide My Email, a perk meant to hide your email from websites, marketers, and other groups online. Unfortunately, as one man found out when he threatened the girlfriend of FBI Director Kash Patel, Hide My Email isn’t foolproof. Apple actually has the keys to the original sender and can hand these over to a government agency upon request. Even worse, a bug uncovered several months later proved that Hide My Email doesn’t actually hide users’ email addresses from anybody, despite claims otherwise. So much for privacy.

Apple’s missteps keep piling up, and it’s clear that the company is in desperate need of a reboot.

Now another feature shown off that same day — iCloud Private Relay — doesn’t work as advertised either. The service was meant to function as a VPN lite for Safari. While it didn’t stop apps from seeing the IP address on your device, it blocked websites from viewing this information while browsing the web in Apple’s Safari web browser — or at least that’s how it was supposed to work.

Just as Hide My Email didn’t actually hide email addresses, a new report claims that iCloud Private Relay doesn’t hide IP addresses either in some cases.

The problem stems from a bug in Apple’s web browser engine called WebKit that bypasses iCloud Private Relay and exposes the user’s real IP address when a website requests to verify a passkey saved on the device when logging in. Even worse, other browsers that use Apple’s WebKit on iOS, iPadOS, and macOS are susceptible to the same flaw, turning this into a widespread problem in Apple’s ecosystem.

RELATED: Don’t be fooled: This Apple privacy feature won’t protect your identity

itsarasak thithuekthak/Getty Images

How to protect your IP address from an iCloud Private Relay leak

The good news is that there are two things you can do to protect yourself.

1. Since the problem is connected directly to passkeys, accounts that rely on a username and password to gain access should not trigger an IP address leak. That means if you have an account protected by a passkey and you wish to keep your IP address private, delete the passkey from your phone and use conventional login methods until the problem is fixed.
2. Third-party VPN services are not affected by the bug. That means if you use Proton VPN, ExpressVPN, or a comparable alternative that is properly configured and enabled, you don’t have to worry about iCloud Private Relay giving away your IP address.

Is there any hope that Apple will pull itself together?

Apple is currently looking into the issue, but that hasn’t stopped a lawsuit from taking hold. A class action was recently filed, accusing Apple of false advertising and fraud, among other charges. The case is very similar to the recent feud over delayed Apple Intelligence features, where the company ultimately paid a $250 million settlement to make it go away.

At this point, Apple’s missteps keep piling up, and it’s clear that the company is in desperate need of a reboot. Luckily, new blood is on the way. This fall, CEO Tim Cook will step down from his role and turn the reins of leadership over to John Ternus, the current senior vice president of hardware engineering and an Apple veteran who started his career in 2001 under Steve Jobs. While there’s no way to know how Ternus will handle his new responsibilities, tech aficionados are excited to have a “product guy” back in control, whereas Tim Cook’s background was primarily in operations as the chief operating officer before his promotion by Jobs.

This is also a big year for Apple’s software teams. All major releases of iOS, iPadOS, macOS, and WatchOS later this fall are quality-of-life updates meant to squash bugs, improve performance, and refine the user experience for years to come. So far, beta testers agree that the new updates are a big improvement from current iterations, but time will tell if this experience carries over to the masses. Hopefully, there are also some privacy and security improvements under the hood to reverse course on Apple’s current downward spiral.

Like Blaze News? Bypass the censors, sign up for our newsletters, and get stories like this direct to your inbox. Sign up here!