Recently uncovered bugs in Private Relay and Hide My Email have exposed a glaring truth: no single company can act as your sole privacy shield<\/p>\n
When you purchase through links on our site, we may earn an affiliate commission. Here\u2019s how it works.<\/p>\n
For years, many assumed that buying an Apple device guaranteed out-of-the-box privacy protection. However, this reputation is beginning to unravel.<\/p>\n
Last week, researchers found that Apple\u2019s iCloud Private Relay tool \u2014 a paid add-on feature that encrypts Safari browser traffic to hide a user's IP address \u2014 could leak the very detail it\u2019s expected to protect.<\/p>\n
These revelations come about a month after 404 Media reported that Hide My Email, another feature included in the paid iCloud+ subscription, also leaked users\u2019 real email addresses. While Apple has now issued a patch, it only did so after the news broke, despite reportedly being aware of the flaw for at least one year.<\/p>\n
The situation raises a critical question: can 'marketing privacy\u2019 ever match technical reality? And if we cannot rely solely on Apple\u2019s tools, what can we do to really protect our privacy online?<\/p>\n
Apple markets iCloud Private Relay as a feature designed to protect your privacy. By securing your traffic when you browse on Safari, the company claims that "no single party \u2014 not even Apple \u2014 can see both who you are and what sites you're visiting."<\/p>\n
To achieve this, the feature is supposed to route your requests through two separate proxy servers, or relays. This means that the second relay \u2014 the one that connects you to the website \u2014 can't see your real IP address or original DNS request.<\/p>\n
That is what should happen in theory. However, recent findings by security researchers Talal Haj Bakry and Tommy Mysk suggest otherwise.<\/p>\n
The iOS developers came across a series of issues in Apple's web browser engine by chance. In June, a user of their Psylo browser \u2014 a privacy-first app for iPhone and iPad specifically designed to defeat browser fingerprinting \u2014 contacted them to report DNS leaks.<\/p>\n
While iCloud Private Relay functions as a proxy limited to Safari browsing, a VPN operates at the operating system level. By encrypting network traffic across the entire device rather than just a single browser, a VPN ensures that all application data, background processes, and connections are protected behind a system-wide encrypted tunnel.<\/p>\n
Not only did the duo identify the origin of the DNS exposure, but they also found two additional leaks while investigating. Crucially, neither leak was the fault of their own app. \u201cThe problem is not within our implementation, but it\u2019s a systemwide issue in the iOS infrastructure,\u201d Mysk told TechRadar.<\/p>\n
The first vulnerability involves DNS prefetching, a feature designed to speed up browsing. According to their tests, Safari was incorrectly resolving domain queries outside the secure proxy tunnel, leaking a user\u2019s real DNS server.<\/p>\n
The second leak is more troubling and concerns what\u2019s known as WebTransport, a protocol designed to enable faster communication between a web browser and a website. Researchers found it was exposing the user\u2019s real IP address \u2014 the very detail users believed they were masking by using Private Relay.<\/p>\n
Similarly, Bakry and Mysk discovered that the passkey system \u2014 the framework that allows for passwordless logins \u2014 also bypasses the proxy and reveals users\u2019 real IPs.<\/p>\n