The Apple Privacy You Pay For Is Leaking: The Researchers Decided Not to Report the Bug at All

The feature is called Private Relay and it is supposed to hide your IP address while you browse the internet in Safari. It is not free - it is available only to users paying for an iCloud+ subscription. So this is something people knowingly hand over money for, in order to get privacy.

Two researchers, Talal Haj Bakry and Tommy Mysk, published findings that the feature can be bypassed and the real IP address exposed. The problem, they say, lies in three functions in WebKit - Apple's browser engine, which on iOS is used by every browser, not just Safari.

Rather than leaving it at a claim, they also set up a web page where anyone can check for themselves whether their address is leaking. Testing showed the page manages to reveal the real address even when Private Relay is switched on.

Here comes the part worth more than the flaw itself. The researchers decided not to report the bug to Apple at all. They said why, openly.

"Our experience with Apple so far tells us that reporting this issue would mean months of delay, inconsistent communication, and in some cases outright denial that the problem has any impact at all," Mysk wrote.

That is an accusation against the process, not against the code. Every large technology company has a security disclosure programme and every one of them presents it in its marketing as proof that it works with the research community. When a researcher calculates that publishing openly is faster than waiting for a reply, that says something about how well that programme actually functions. Apple did not respond to a request for comment.

It is worth clarifying what Private Relay never was in the first place. It is not a VPN - it does not protect your address at system level, it only works while you are using Safari. Anyone who thought it made them invisible online was wrong long before this finding.

There is also one detail that deserves attention: Mysk and his colleagues are developing their own browser called Psylo, which they say already has protection against address leaks. The finding is real and verifiable, but the man announcing it is selling an alternative. That does not cancel it out, it just means you should read with your eyes open.

For the ordinary user the conclusion is simpler than it looks. Privacy you buy as a line item in a monthly subscription remains a promise from the company charging you for it - and it lasts as long as that company decides it should last. When someone from the outside shows the promise is leaking, the response comes slowly, if it comes at all.