Researchers uncover WebKit bugs that bypass proxy-based privacy

Users of Apple’s Private Relay feature may not be as anonymous as they would like. Security researchers found that Apple’s web browser Safari occasionally shares users’ real IP address and location with websites, even though it shouldn’t.

When Apple introduced iOS 15 back in September 2021, it also announced its latest privacy feature: Private Relay.

Private Relay is a VPN service that encrypts a user’s internet traffic by routing it through 2 servers.

How does this work? Apple operates the first server and removes your IP address from the traffic. Apple assigns an anonymous IP address and forwards the traffic to a second server.

A third party operates this server and assigns a temporary IP address to the traffic. Lastly, it directs users to the website they want to visit.

By separating this information, no one knows which websites a user visits. Not even Apple or an internet service provider knows what he’s doing online. This is how Apple strives to protect its customers’ privacy.

In theory, that is. In practice, it doesn’t always work that way.

Security researchers Tommy Mysk and Talal Hai Bakry found 3 ways for websites to unintentionally identify a user’s IP address and location. They claim this is due to Safari’s underlying browser engine: Apple WebKit.

The first method is called DNS prefetching. DNS prefetching lets a website ask the browser to resolve a hostname before it’s needed. So when it later needs to connect to that hostname, the lookup is already done, and the connection starts faster.

However, Webkit sends that DNS lookup request outside of Private Relay, meaning that the website’s DNS server sees your request coming from your real network, thus revealing your actual IP address and location.

The second method is called WebAuthn-related origin requests, which refers to the web standard behind passkeys. According to the researchers, browser proxies like Private Relay are also bypassed when using passkeys. Instead of the browser, the operating system handles the request, causing users to share their IP address.

The third method to reveal your real IP address is through WebTransport, a new and faster way for websites to communicate with your browser. The researchers claim that WebKit sometimes creates WebTransport connections directly from a user’s device instead of through the privacy proxy, allowing websites to discover their real IP address even when Private Relay is enabled.

According to Mysk and Bakry, these issues apply to Safari’s Private Relay, but also to other browsers that claim to encrypt users’ network traffic.

The security researchers have reported the issues to Apple, which is currently working on a solution that should be available this fall.