Security researchers at Mysk have demonstrated that a WebAuthn passkey validation request can expose a user’s real IP address even when Apple’s iCloud Private Relay is enabled, weakening a privacy protection built into paid iCloud accounts.
Private Relay is designed to route Safari traffic through separate proxy services so a website cannot see the user’s actual IP address and Apple cannot see both the user and the destination. It is not a full virtual private network, but it is intended to obscure browsing activity handled through Apple’s WebKit framework.
The passkey issue involves WebAuthn Related Origin Requests, which allow an organization to use one passkey across a limited set of domains it controls. When a page requests a credential for a different relying-party domain, the operating system’s credential service fetches a validation file from that domain.
Mysk researchers Talal Haj Bakry and Tommy Mysk found that the validation fetch travels outside Private Relay because it is issued by the credential service rather than Safari. A page can trigger the request without a visible authentication prompt, allowing the destination server to receive the device’s real IP address.
Passkeys use public-key credentials stored on a device or in a credential manager to replace reusable passwords. Adoption has accelerated across consumer and enterprise services, although deployment benchmarks have identified operational challenges involving recovery, synchronization and support across platforms.
Mysk identified two additional WebKit paths that can bypass Private Relay. DNS prefetching can resolve a domain through the device’s normal DNS path when a page includes the relevant instruction. WebTransport can also establish a low-latency connection that avoids the relay and reveals the source address.
The researchers created a test website that checks whether a device exposes its IP address through the identified methods. CNET reproduced the result on an iPhone 17 Pro and a MacBook Pro with Private Relay active, with the page correctly identifying the home router’s public IP address.
The finding concerns network privacy around passkey use rather than the cryptographic validity of the passkey itself. Receiving the IP address does not give a site the private key or let it sign in as the user, but the leak can reveal location or identity information that Private Relay is meant to conceal.
Apple has continued to extend biometric authentication across its ecosystem, including Face ID checks for trusted-computer access. The identified WebKit behavior affects network requests generated outside the visible browser session.
–
By the ID Tech Editorial Team
