When I go to https://leaks.psylo.app on "Possible IP leaks" side I see only "WebAuthn" with my real IP and, occasionally, WebTransport with an incorrect IP. For "HTTPS Traffic" it always show some other relay. Using Safari 26.5
I'm not sure what would I use WebAuthn for, if ever, maybe I could disable it through "Feature Flags" menu?; regardless, I never treat Apple's services as "premium", since the email fingerprinting thing. I pay mainly for Hide My Email, just to organise things per domain, and it's cheap.
rickstanley
Apple private relay is very flawed but on the other hand most sites that view connections originating from VPN as suspicious seem to be ok with Apple Private Relay. If you have VPN on your router private relay on top of it could be a good way to do ip address laundering.
irusensei
Tommy Mysk, Talal Haj Bakry: how long did you wait after informing Apple of their incompetence before this public disclosure, please?
Thank you for uncovering this and for the website proving the bug.
Barbing
There was at least one other Private Relay issue that doesn’t seem to have received much public attention.
I found and reported an IP leak to Apple in December 2025. The issue was caused by an EDNS Client Subnet (ECS) configuration problem in Akamai’s infrastructure, which could result in the client’s real IP being forwarded when it shouldn’t have been.
Apple confirmed the fix at the end of March 2026, and then I unexpectedly received a $5,000 Security Bounty in July.
Lots of these seem unnecessary, especially collecting "bandwidth usage" and "timestamps".
solenoid0937
Thank you for this report. My real IP on my phone was constantly leaking and I knew that WebKit was a culprit. However, I doubt that this was an accident. This is a backdoor that Apple planted.
kittikitti
I love iCloud private relay, but I need a way to turn it off. A command line utility would be amazing, along with the ability to turn off/on DNS-over-HTTP.
comments (7)
I'm not sure what would I use WebAuthn for, if ever, maybe I could disable it through "Feature Flags" menu?; regardless, I never treat Apple's services as "premium", since the email fingerprinting thing. I pay mainly for Hide My Email, just to organise things per domain, and it's cheap.
rickstanley
irusensei
Thank you for uncovering this and for the website proving the bug.
Barbing
I found and reported an IP leak to Apple in December 2025. The issue was caused by an EDNS Client Subnet (ECS) configuration problem in Akamai’s infrastructure, which could result in the client’s real IP being forwarded when it shouldn’t have been.
Apple confirmed the fix at the end of March 2026, and then I unexpectedly received a $5,000 Security Bounty in July.
bernd289
Lots of these seem unnecessary, especially collecting "bandwidth usage" and "timestamps".
solenoid0937
kittikitti
exabrial