Posted by lapcat 3 days ago
I'm not sure what would I use WebAuthn for, if ever, maybe I could disable it through "Feature Flags" menu?; regardless, I never treat Apple's services as "premium", since the email fingerprinting thing. I pay mainly for Hide My Email, just to organise things per domain, and it's cheap.
On Mac, Firefox and Chrome, which don't use WebKit, handle WebAuthn themselves.
Now for yet another reason.
I mainly use VPNs to access bank sites (or other sites that are annoying enough to use IP country as a proxy for traffic being evil/legitimate) when traveling, but I often forget to turn off the VPN afterwards, and then spend the rest of my day browsing from my home IP (that terminates the VPN), which would have been hidden behind Private Relay if I'd actually been browsing from my home Wi-Fi.
Cross-site/app ad targeting getting creepy good despite using different browser profiles for work/personal browsing etc. is usually a good tell (at least on IPv6).
Thank you for uncovering this and for the website proving the bug.
https://x.com/mysk_co/status/2085026605529768261
Glad you found the website helpful. Thank you.
Reading your comment and this 404 piece, perhaps you informed them in the minutes* before disclosure and got some kind of approval? (But essentially that wasn’t really informing them ahead of time, simplified in your comment… or I’m thick somehow, hehe well I can be!)
“We have already informed them. They said the issue was ‘dire,’ but they let us disclose the issue. They didn't provide any time when they will address this,” Mysk said.
*Edit: or informed after and “let us disclose” meant they didn’t demand retraction
I found and reported an IP leak to Apple in December 2025. The issue was caused by an EDNS Client Subnet (ECS) configuration problem in Akamai’s infrastructure, which could result in the client’s real IP being forwarded when it shouldn’t have been.
Apple confirmed the fix at the end of March 2026, and then I unexpectedly received a $5,000 Security Bounty in July.
Lots of these seem unnecessary, especially collecting "bandwidth usage" and "timestamps".
I couldn't figure out how to get any changes to reflect but maybe it's a good pointer towards a solution?
EDIT: Reading into this, looks like they're very intentional about not allowing arbitrary enable/disable calls to it, likely to prevent a hostile entity from switching it off on unsuspecting users. The systems setting calls an XPC into a daemon that makes a web request, then validates the response from the API to update the PLIST structure.
I agree it's likely to prevent third parties from messing with the setting, but not hostile third parties specifically. Think of a VPN app or file sharing browser extensions who might want to disable the relay "to be helpful".
Because a truly hostile entity capable of changing local settings can already obtain the device's real IP and also capture traffic, the two things private relay is meant to prevent. There would be no point. If anything it might increase the odds of detection.
They own the OS and could do for private relay like what they do for screen recording: when it's in use, overlay an unhideable visual indicator that it's that it's in use. Make it visually obvious when it turns off.
I did not verify whether it works reliably.
If it does, one could probably package it as a .app and grant only that the Accessibility permission.