Skip to main content
  1. Home
  2. Computing
  3. News

Apple’s Private Relay VPN seems to be leaking user data

Alex Blake
By

When Apple unveiled iCloud+ at its Worldwide Developers Conference (WWDC) in June 2021, one of its key features was a secure VPN called Private Relay. Yet a fresh report claims the service has been leaking user data on MacOS, potentially meaning it’s not as secure as previously thought.

Private Relay works by obfuscating various identifying pieces of information when you browse the internet. It encrypts your data, separates your page requests from your IP address, then assigns you a spoof IP address. The idea is that it becomes impossible for anyone (including Apple) to see which websites you are visiting.

Related Videos
Apple products are seen in the store.
Jakub Porzycki/NurPhoto/Getty Images

However, it seems there are cracks in its defenses. Doubts were raised by VPN service Mullvad, which alleges that Private Relay can cause the system it’s installed on to ignore network firewall rules. When that happens, Private Relay can leak that the system is communicating to Apple servers.

That might not seem like much, but the upshot of this is that it signals to your local network and your ISP that you are likely using a Mac computer. It’s not the most damaging information out there, but if a bad actor is snooping on your network traffic, that could give them ideas for a line of attack.

Calling home to Apple

New iCloud features on a Mac.

Digging into the specifics, Mullvad spotted QUIC data (that is, data from a protocol designed to make web traffic faster and more secure) leaving its test computer outside of the Private Relay VPN tunnel. In other words, this data had somehow escaped Private Relay’s secure connection and was leaking to the outside world. Disabling Private Relay stopped the leak in its tracks.

While Mullvad couldn’t determine what data was leaked (it was encrypted, after all), the fact that any data at all was leaking was cause for concern. The report’s authors explain that, “We believe [the leaked information is] just some heartbeat signal calling home to Apple.” As previously noted, that could flag up the user’s system to other network users.

Mullvad’s report claims that, for now, the only way to prevent this data leak is to disable Private Relay entirely. Until Apple patches the flaw, that might be the best course of action if you are concerned.

In the meantime, if you are looking for a replacement for Private Relay, we’ve put together a list of the best VPN services that will keep your data safe and protected.

Editors' Recommendations

Topics
LastPass reveals how it got hacked — and it’s not good news
A depiction of a hacker breaking into a system via the use of code.

Last year was a particularly bad one for password manager LastPass, as a series of hacking incidents revealed some serious weaknesses in its supposedly rock-solid security. Now, we know exactly how those attacks went down -- and the facts are pretty breathtaking.

It all began in August 2022, when LastPass revealed that a threat actor had stolen the app’s source code. In a second, subsequent attack, the hacker combined this data with information found in a separate data breach, then exploited a weakness in a remote-access app used by LastPass employees. That allowed them to install a keylogger onto the computer of a senior engineer at the company.

Read more
A beginner’s guide to Tor: How to navigate the underground internet
A person using a laptop at a desk.

While the internet has dramatically expanded the ability to share knowledge, it has also made issues of privacy more complicated. Many people are justifiably worried about their personal information being stolen or viewed, including bank records, credit card info, and browser or login history.

If you're looking for more privacy while browsing, Tor is a good way to do that, as it is software that allows users to browse the web anonymously. It should be noted that Tor can be used to access illegal content on the dark web, and Digital Trends does not condone or encourage this behavior.
Why does Tor exist?
In this climate of data gathering and privacy concerns, the Tor browser has become the subject of discussion and notoriety. Like many underground phenomena on the internet, it is poorly understood and shrouded in the sort of technological mysticism that people often ascribe to things like hacking or Bitcoin.

Read more
Apple’s second-generation VR headset is already in the works
A rendering of an Apple mixed-reality headset (Reality Pro) in a gold color seen from the front.

Apple’s first mixed-reality headset hasn’t even been released, yet the company is already working on a second-generation model that will bring even more power and performance to the table, according to a new report. That suggests we might not have long to wait before the successor device hits the shelves.

The news comes from Bloomberg reporter Mark Gurman in his Power On newsletter. Gurman claims that the first edition of the headset -- likely dubbed Reality Pro -- will come with the same M2 chip that powers the latest MacBook Air, plus a separate chip that will handle augmented reality (AR) and virtual reality (VR) experiences.

Read more