Apple's Private Relay can leak your real IP address

Apple's Private Relay, an opt-in feature that hides a user's IP address when they browse the internet with Safari, can be circumvented to reveal the supposedly hidden IP address due to a series of flaws. Researchers revealed the issues in a blog post on Tuesday, setting up a website where anyone can check if their real IP address leaks, even if they use Private Relay.

In a test on Tuesday, TechCrunch verified that the site was able to reveal our real IP address. The team of researchers, including security expert Thomas Roth, developed a website that sends a request to the Private Relay service, then compares the response to an IP address that the browser would normally use. This discrepancy reveals the user's real IP address.

Private Relay is a feature that Apple introduced last year to enhance user privacy. The service sends Safari traffic through two separate relays, one run by Apple and the other by a third-party provider. The goal is to mask the user's IP address, making it difficult for websites or online services to track them.

But Roth and his team discovered that the flaws in Private Relay allow for IP address leaking. They found that when a request is sent to a website, the Private Relay service can send two responses: one that contains the masked IP address, and another that contains the real IP address. If this second response is sent to the website, it can reveal the user's real IP address.

The team set up a test website that sends a request to Private Relay, and it was able to verify that the real IP address is leaked. TechCrunch also tested the site and found that it was able to reveal our real IP address.

Roth and his team have not disclosed the exact methods used to discover the flaws, in order to prevent hackers from exploiting them. They urge users to be cautious and suggest that anyone concerned about their online privacy should avoid using Private Relay for now.

For those who want to check if their real IP address leaks, the team has set up a website that will test their connection. Apple has not yet commented on the issue.

The researchers also pointed out that the issue highlights the need for greater transparency in online services. While Private Relay was marketed as a way to enhance user privacy, its flaws raise questions about the company's commitment to online security.

The discovery of the flaws also raises concerns about the use of similar services. Will other companies follow Apple's lead and introduce similar features, or will they learn from the mistakes made by the tech giant?

Apple's Private Relay was introduced last year as part of iOS 15. The feature is currently available on all devices running iOS 15 or later. The company has not yet announced any plans to fix the flaws.

Roth and his team are urging users to be cautious and suggest that anyone concerned about their online privacy should avoid using Private Relay for now. They also urge the company to be more transparent about its security measures and to address the flaws.

UPDATE: Apple has not yet responded to our request for comment. This article will be updated as more information becomes available.