Understanding How WebKit Features Can Affect iCloud Private Relay Privacy

iCloud Private Relay provides an extra privacy layer for iCloud+ users using Safari. It prevents websites from seeing your actual IP address and location. However, security researchers have identified WebKit features that might bypass this protection.

WebKit Features and Private Relay Bypass

Researchers Talal Haj Bakry and Tommy Mysk discovered that certain WebKit features can bypass Private Relay’s intended privacy. These features include DNS prefetching, a WebAuthn feature related to passkeys, and WebTransport.

DNS Prefetching

Web browsers use DNS prefetching to speed up page load times by looking up addresses before you click them. Unfortunately, WebKit can route DNS requests through your device’s normal DNS connection instead of the protected path, potentially revealing your real network details.

WebAuthn Requests

WebAuthn allows passkeys to work across related websites. However, during passkey verification, the operating system might contact a site directly, exposing your real IP address even with Private Relay active.

WebTransport Connections

WebTransport establishes direct, low-latency connections with servers. This connection can expose your genuine IP address as it bypasses Private Relay’s protection.

Impact on Apple Users

These findings are especially relevant for Safari users relying on iCloud Private Relay for privacy. They can also impact other browsers or applications using WebKit’s proxy configuration. Unlike VPNs, which tunnel traffic at the system level, WebKit’s method involves browser-level proxy settings, making it susceptible to leaks highlighted by the research.

Protecting Your Privacy on Safari

Keep Private Relay On

Turning Private Relay off removes current protections. It is found in your iPhone under Settings > your name > iCloud > Private Relay.

Update Apple Devices Regularly

Always install the latest device updates to receive privacy and security improvements. Access this under Settings > General > Software Update.

Consider a Full-Device VPN

When hiding your IP address is crucial, use a VPN. It offers a different protection level unaffected by the WebKit leaks. Note that a VPN won’t make you invisible online, as sites may still recognize you if you log in or provide data.

Continue Using Passkeys

Despite the findings, passkeys remain secure. The concern lies with the network request, not the passkey itself. Passkeys are vital for protecting accounts from phishing and password theft.

Monitor Browser Privacy Updates

Browser developer Psylo has adjusted how these mechanisms operate. Psylo version 1.3.1 now automatically blocks DNS prefetch while disabling WebTransport and WebAuthn by default.

Privacy features work best when their limitations are understood. While iCloud Private Relay offers useful security benefits, it shouldn’t replace full-device VPNs if safeguarding your IP is essential.

Kurt “CyberGuy” Knutsson encourages you to stay informed about tech tips and security alerts by signing up for updates at CyberGuy.com.