In partnership with
THE USEFUL TECH
📘 THE DEEP DIVE · WEDNESDAY TUTORIAL · ISSUE #005
👋 HEY, IT'S RAJA
On Monday we fixed two small iPhone annoyances. Today, a large one, and this is the rare week where the news is more important than the tip.
On August 5, security researchers Talal Haj Bakry and Tommy Mysk published findings showing that iCloud Private Relay can hand your real IP address to a website. Not through some elaborate attack, but through ordinary browsing. Apple has confirmed it is investigating, and the fix is currently slated for the autumn.
If you pay for iCloud+, this is your feature. Here is what actually broke, how to check your own phone, and what to do in the meantime.
Your voice. Every platform. No writing required.
You ghost your own socials by Wednesday. SureThing learns your voice and ships native posts to LinkedIn, X, Instagram, and TikTok, without you writing a thing.
📘 The IP address you pay to hide
What the Private Relay flaw really is, why it reaches further than Safari, and the four honest options you have until Apple ships a fix.
First, what Private Relay actually is
This matters more than the bug, because most people have the wrong model in their head.
Private Relay is an iCloud+ feature that routes your Safari browsing and DNS queries through two separate hops, run by two different companies, so that no single party (Apple included) can connect your identity to the sites you visit. That is a genuinely clever design, and it does the job it was built for.
What it is not is a VPN. It only covers Safari. It does not protect traffic from your other apps; it does not operate at the system level, and it was never intended to. Apple has always documented it this way. The gap between that documentation and what people assumed they were buying is where this whole story lives.
What broke
The researchers found three features in WebKit, the browser engine underneath Safari, that can make network requests outside the proxied path Private Relay controls. Once a request leaves that path, it goes straight out from your device carrying your real IP address, and the relay never sees it.
The three are DNS prefetching, WebTransport, and WebAuthn-related origin requests. That last one is the ugly one, so it is worth understanding properly.
Why the passkey path is the worst of the three
Passkeys are the good guys here. They are a genuinely better replacement for passwords, and you should be using them. The problem is architectural rather than anything wrong with passkeys themselves.
When a site initiates a passkey sign-in, WebKit does not handle it inside the browser. It hands the request to the operating system's credential service, which issues its own HTTPS request directly from the device. That service has no idea a proxy was configured for the browser, so it does not use one.
The result is that a website only has to claim it supports passkeys to trigger the request. It does not need you to complete a sign-in. It does not need you to have an account. Visiting the page is close to enough.
Why this reaches beyond Safari
Here is the part that turns an Apple problem into an iOS problem. Every browser on iOS is required to use WebKit underneath, whatever the icon on your Home Screen says. So this affects other browsers built to route traffic through proxies, including Tor browsers on iOS, which is a considerably more serious matter for anyone relying on one.
Actual VPNs are unaffected, because they work at the system level and catch traffic regardless of which part of the OS generated it. That distinction is the whole practical lesson of this story.
How to check your own phone
The researchers published a test page alongside their write-up at mysk.blog, which loads in your browser and tells you whether your real IP address is exposed. It is the fastest way to see this for yourself rather than taking anyone's word for it, including mine.
Turn Private Relay on, visit the page, and compare what it reports against the IP address Private Relay is supposedly giving you.
⚠️ Worth keeping in proportion: this is an information leak, not a breach. Nobody got into your account, nothing was installed on your phone, and no passwords are at risk. What leaks is your IP address, which reveals your rough location and your network provider, and which can be combined with other signals to profile or track you.
Your four options right now
Use a real VPN for anything that genuinely matters. If your reason for hiding your IP is serious rather than incidental, Private Relay was already the wrong tool and this week just made that legible. A system-level VPN covers every app, not one browser.
Keep Private Relay on anyway. This is what I would do for ordinary browsing. It still blocks the tracking it was designed to block, and turning it off makes your situation strictly worse, not better. A leaky umbrella beats no umbrella.
Recalibrate what you expect from it. Treat Private Relay as a tracking-reduction feature rather than an anonymity feature. That was always the accurate description, and holding it in your head correctly is worth more than any toggle.
Watch for the fix. Apple's response to the researchers indicates a fix is planned for the autumn, which likely means it arrives inside iOS 27 rather than as a quick server-side patch. That is a slower timeline than the Hide My Email bug got last month, and the difference is that this one probably needs a software update on the device.
The part I keep thinking about
Apple let the researchers disclose this before shipping a fix. That is unusual, and it tells you something. Companies normally push for silence until a patch is out. Choosing disclosure suggests Apple would rather people knew, which in turn suggests the fix is not quick.
The broader lesson is the one this newsletter keeps circling back to. Privacy features on your phone are specific tools with specific edges, not a general force field. Knowing exactly what each one covers is the actual skill.
Knowing what each setting actually does
Private Relay is one feature among dozens on your iPhone where the name promises more than the setting delivers, or less. The Ultimate iPhone Setup Guide is 89 pages working through the settings, apps, shortcuts, and buried features that most people never find, with plain explanations of what each one genuinely covers. It is $29.
If you want the full technical write-up, check it out here: https://mysk.blog/2026/08/04/webkit-proxy-icloud-private-relay-ip-leak/
That's it for today. See you Friday with five useful things, and they will all be privacy settings worth ten minutes of your weekend.
Keep it useful,
Raja · The Useful Tech
P.S. Enjoyed this? Forward it to a friend who loves their Apple gear a little too much.