Apple’s new Private Relay is leaking your original address through WebRTC | Hacker News Reader

Apple’s new Private Relay is leaking your original address through WebRTC

old.reddit.com

253 pointsrexbee51 comments

Not terribly surprising as I believe WebRTC has been a known issue for leaking your IP for a long time with VPNs. With that said I confirmed it does indeed leak my IP on iPad. The surprising part is that Apple sidestepped the issue.

Side note: tried to test it on my Mac but for some reason it wanted me to "upgrade" to iCloud+, despite being an Apple One customer. Guess that's because the macOS betas are fairly out of cycle compared to the iOS ones and (presumably) their infra.

After you press the upgrade button it realizes you have it and opens the gates.

Thanks for the tip, tried a few times but no luck. I did use relay previously so could be a random bug.

If you haven’t tried it yet, quit all Apple apps, sign out of iCloud in System Preferences, reboot (do not skip this step), sign back in at System Preferences and see if that heals it.

Can you turn it off, there are some options in the Develop menu in Safari regarding WebRTC. Not sure its enough though.

You do need iCloud+, which is not included in Apple One despite the extra iCloud GB.

No, it’s included - there’s just a beta glitch the first time (or two) you try to turn it on.

Huh? This is surprising to me. I was just about to consolidate to apple one.

I expect that for clarity's sake this will be changed when iCloud+ officially launches.

Some webs says it’s included, but in Beta 1 wasn’t and I didn’t look further. It make sense it’s just an update in the branding.

You can do lots of suprising things with ICE in the browser. I was really excited to find[0]. Go to this[1] JSFiddle and type in `$hostname.local` or a device on your network. I have a `WDMyCloud.local` for example.

I think you could make something really interesting. A web page could make a pretty unique fingerprint of you by all the IoT/Printers/$X devices on your network.

[0] https://github.com/rtcweb-wg/mdns-ice-candidates/issues/121

[1] https://jsfiddle.net/10eq2rzh/

So, I guess webrtc should be disabled by default and a site that tries to use it should trigger a permission prompt (like camera and microphone access).

uBlock Origin has an option to prevent local IP leak:

"Prevent WebRTC from leaking local IP addresses"

https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...

I personally use Firefox and have WebRtc disabled (about:config => media.peerconnection.enabled: false).

If I really need it I switch to Chromium.

offtopic: what's the non-routable TLD we're all supposed to be using now instead of .local? was it .lan? I tried googling with ddg:) but it's a noisy search

see: https://datatracker.ietf.org/doc/html/rfc6761

And .local. is specified in multicast-dns: https://datatracker.ietf.org/doc/html/rfc6762

This was just discussed [0] last week, actually! The tl;dr is that there’s no great alternative to registering an actual domain name and using it (or a subdomain of it) for your network. The only viable TLD otherwise is .arpa

[0]: https://news.ycombinator.com/item?id=28192247

.Home.arpa not just .arpa

Thanks for the correction.

Isn’t it a double address like .home.lan or some such?

Yup! If you want something that just works (no need to prefix with http[s] in your browser’s omnibar, works with Apple devices, etc), `.home.arpa`[0] is the canonical option.

A somewhat on topic tangent:

I did a fair amount of tinkering with this after finding my manually defined `.local` dns entries wouldn’t work with Apple devices. Apple devices see such addresses as reserved for mDNS and will only look them up via mDNS.

To get everything working on my network, I ended up going down the rabbit hole of local DNS naming schemes. In the end I found I prefer the look and feel of `.lan`, so I live on the edge and make my custom DNS entries using that.

Some browsers think I’m searching for stuff when I type “hostname.lan”, but prefixing with http:// fixes that. Wherever I can I try to set up mDNS, though, since it just works and doesn’t require any central administration. Sadly, not all devices are customizable enough for me to use mDNS everywhere.

[0]: https://serverfault.com/a/1041148

.home.arpa

It's .home.arpa, but I'd be very surprised if IANA ever let anyone register .home, .lan, or .localdomain.

What's wrong with .local?

It is reserved for use with Multicast DNS specifically.

Is it true that using WebRTC relies on Javascripts

Yes. It's a JS API.

This is why I have a VPN router. All traffic is VPN-ified to/from the wifi signal, and you don't have to risk having your real / naked IP exposed. You can even route another VPN over that VPN for a sort of fake Tor with no problems. Check out GL.iNEt routers: https://www.gl-inet.com/

You can even get little travel routers that you can use when traveling. No affiliation, just pointing out something many don't even see as an option they have.

I do this too. I also use dns over tls for my VPN network. Non VPN network uses root hints. Two ssids one two different vlans. One VPN, one web.

#ad

you don’t need specialized hardware to do this

No, but GL.iNet routers come with a 1-click solution. It's really handy, cheap and capable. Of course, you can install OpenWRT etc on any router as well. Just not quite as easy. Also no affiliation, but I love the little travel routers.

Icloud private relay is great. I really hope Apple expands it too all traffic and not just safari.

Do the extra hops introduce any noticeable latency for you when browsing?

Not really. It's a bit slow but on mobile it doesn't really matter as I am not downloading huge amounts of data.

I just tested this on my android device with an always on VPN and kill switch that's on. Even the egress IP is not leaked - Only the local 10.x.x.x addresses are.

When you're not connected to WiFi you likely have a public IPv4 from the mobile provider.

Correct me if I’m wrong, but isn’t it stated in the description that private relay works only with http(s) transport protocol in Safari? WebRTC doesn’t get through the tunnel by design.

What critical functionality/common website will I break by disabling webrtc on all my devices?

Most video or audio calling sites for starters

What does this mean? Is this only relevant for users of WebRTC, whatever that is, or for everyone?

WebRTC is a JavaScript API, so this is relevant to anyone who uses the web. (Assuming, of course, they have JS enabled.)

Alright, so in practice Hide my email doesn’t work, the sites you sign up at will still receive your real email. That seems incredibly badly implemented by Apple.

But how can the browser even have your email? Or is Apple leaking in from their systems somehow?

It's not about hide my email, it's about their proxy leaking your ip

Apple is a privacy nightmare... a bit like google is evil.

"Private Relay".

One outcome of the CSAM debacle is that security researchers will be poking lots of new holes in Apple.

WebRTC has been having these problems for at least 6 years straight. At what point can we call this a deliberate back door?

When there’s evidence that it’s either deliberate or a back door? Those words have specific meanings and WebRTC doesn’t fit that description.

I agree it’s not a back door but if you’ve been put on notice of a serious security flaw then after a certain amount of time I do think your failure to take corrective action is “deliberate”.

How serious is it, really? The vast majority of users will connect to a web server with their IP anyway so I’d assume it’s more a question of weighting it behind other privacy improvements — for example, ad blocking and tracker protection are probably making more of a difference for most people.

Should at least warn you, "this site wants to use WebRTC, this will reveal your real IP address. OK?"

Reply on news.ycombinator.com