HN Debrief

IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay

  • Privacy
  • Security
  • Browsers
  • Apple

The post demonstrates several ways WebKit can leak a user’s real IP address or DNS requests even when traffic is supposed to go through a proxy browser or Apple’s iCloud Private Relay. The key claim is not that every page load is exposed. Standard HTTPS traffic still appears to use the relay in many cases. The problem is that specific browser features and supporting system services can bypass that path. People testing the proof site mostly saw leaks through WebAuthn, and sometimes WebTransport, while ordinary page traffic stayed behind another relay IP. That narrowed the practical concern from “Private Relay is completely broken” to “some high-value APIs can punch holes through it.”

If you rely on iCloud Private Relay or an iOS privacy browser for IP hiding, treat it as partial protection, not a hard anonymity boundary. Test the exact browser features your app or staff use, especially WebAuthn and any system-level networking paths that may skip your proxy assumptions.

Discussion mood

Skeptical and mildly cynical. People broadly believed the leaks were real, saw them as another example of Apple privacy features being useful but leaky at the edges, and focused on the limits of trusting WebKit-based browsers or Private Relay as strong anonymity tools.

Key insights

  1. 01

    WebAuthn escapes into system code

    The leak looks tied to how WebAuthn is implemented, not just to generic page networking. WebKit hands the request to a separate system process on Mac, which explains why Firefox and Chrome on macOS did not show the same behavior. That shifts the problem from “Safari proxy bug” to a deeper boundary issue between browser privacy controls and OS-level authentication plumbing.

    If your threat model includes hiding client IPs, audit every browser feature that crosses into OS services. Do not assume a proxy setting or relay covers authentication flows just because normal page fetches do.

      Attribution:
    • lapcat #1
    • Semaphor #1
  2. 02

    Private Relay already had an ECS leak

    A commenter reported a separate iCloud Private Relay leak from late 2025 where Akamai infrastructure forwarded the client IP through EDNS Client Subnet. Apple confirmed a fix and later paid a bounty. That matters because it shows the weak point is not only WebKit APIs. The DNS and CDN layer can also reintroduce origin IP data even when the product promise says otherwise.

    Treat relay privacy as an end-to-end systems problem that includes DNS providers and CDN configuration. Vendor claims are not enough. Re-test after infrastructure changes and ask specifically about EDNS Client Subnet handling.

      Attribution:
    • bernd289 #1
  3. 03

    iOS privacy browsers can only harden WebKit

    Psylo’s pitch is credible only in a narrow sense. On iOS it cannot swap out WebKit, so it works by isolating tab state, configuring WKWebView, and disabling features like DNS prefetch, WebTransport, and WebAuthn. That gives it some room to reduce exposure, but it cannot fix proxy leaks inside the engine or system paths it does not control.

    When evaluating privacy browsers on iOS, look for what they disable and isolate, not claims about a fundamentally different network stack. If a risky API is still enabled, assume the app may inherit WebKit’s leaks.

      Attribution:
    • hnav #1
    • Aaargh20318 #1
    • inigyou #1
  4. 04

    Private Relay survives where VPNs get blocked

    Despite the leaks, people still find Private Relay operationally useful because many sites that flag or block VPN traffic accept Apple’s relay addresses. One commenter even described stacking it over a router VPN as a kind of IP laundering, while another complained that VPN use can silently disable the protection they actually want for day-to-day browsing. The product is winning on compatibility, not on a strong security boundary.

    For employees who travel or depend on consumer sites that dislike VPNs, Private Relay may be the more usable option. Build policies around its compatibility benefits, but keep separate controls for real anonymity or sensitive access paths.

      Attribution:
    • irusensei #1
    • lxgr #1

Against the grain

  1. 01

    Claims of a planted backdoor overreach

    Calling the leak an intentional Apple backdoor goes well beyond the evidence presented. The more grounded explanation is messy architecture, where browser promises break when traffic moves into system services and special-case APIs. Treating every privacy bug as deliberate sabotage makes it harder to diagnose the actual failure modes.

    Focus your internal risk reviews on technical boundaries and reproducible leak paths, not motive. You will get to fixes faster if you ask which component escaped the proxy, not why a vendor wanted it to.

      Attribution:
    • kittikitti #1

In plain english

Akamai ↩
A large content delivery and internet infrastructure provider used by many major websites and services.
CDN ↩
Content Delivery Network, infrastructure that sits between users and servers to cache, route, and protect web traffic.
DNS ↩
Domain Name System, the internet service that translates human-readable site names into IP addresses.
DNS prefetch ↩
A browser optimization that looks up domain names before you click them so pages can load faster.
EDNS Client Subnet ↩
An extension to DNS that can include part of the user’s IP address in DNS queries so CDNs can return a nearby server.
iCloud Private Relay ↩
An Apple service that hides a user’s IP address from websites by routing traffic through relay servers.
VPN ↩
Virtual Private Network, a service that routes traffic through another machine or network to provide secure remote access.
WebAuthn ↩
Web Authentication, a browser standard used for passkeys, security keys, and other phishing-resistant login methods.
WebKit ↩
The browser engine used by Safari and by all third-party browsers on iOS and iPadOS.
WebTransport ↩
A web API for low-latency client-server communication that can keep long-lived connections and send data in both directions.
WKWebView ↩
Apple’s app component for embedding WebKit web content inside an iPhone, iPad, or Mac application.

Reference links

Leak test and story resources

  • Psylo leak test page
    Used by commenters to test whether their browser or relay setup leaked a real IP address through specific APIs.
  • Psylo privacy policy
    Raised as a check on what the privacy-focused browser itself collects.