Apple's iCloud Private Relay Isn't Really That Private

If a privacy feature says it hides your IP address, every network request a website can trigger has to respect that promise. Protecting the main browser traffic is not enough when a side path can quietly go around it.Apple’s iCloud Private Relay is supposed to make Safari browsing harder to tie back to you. It replaces the IP address websites normally see and splits the connection across two relays, so no single party should know both who you are and which sites you visit.That is a useful privacy design. It is also a paid feature inside iCloud+ carrying a very clear promise.New research from Talal Haj Bakry and Tommy Mysk shows that the promise has holes. The researchers found three WebKit features that can bypass the expected proxy path: DNS prefetching, WebAuthn Related Origin Requests, and WebTransport. Two can reveal the device’s real public IP address to a server. The other can send DNS lookups through the device’s normal network path instead of the relay.Their technical write-up…