A story by 404 Media’s Joseph Cox, who last month broke the news about a flaw in Apple’s Hide My Email feature, is now back to report that iCloud Private Relay, a feature that is supposed to obfuscate users’ IP addresses, may not be so private:

A series of issues in Apple’s web browser engine — the tech underlying all browsers on iOS — means that Apple’s iCloud Private Relay tool, which is supposed to hide a user’s IP address, in many cases doesn’t actually work. Instead, the issues mean a malicious attacker can set up a website to learn a Private Relay user’s real IP address, or that many websites have also already collected this information incidentally. The issues also impact OnionBrowser, an iOS app for browsing the web through the Tor anonymity network, the researchers who discovered the issues say.

Fascinatingly, this flaw seems to be due to the implementation of passkeys: the authentication happens out of band, in a separate connection, and therefore never runs through Private Relay.

The security researchers who uncovered the issue have put up a site that lets you check if you’re affected; I wasn’t able to test it this morning, as the Wi-Fi network I’m using as of this writing doesn’t support Private Relay at all. (Joke’s on me, I guess!) They’ve also reported the vulnerability to Apple, who did not provide a timeline for fixing it, but allowed them to disclose the issue nonetheless.

Cox points out that along with the Hide My Email bug, this is the second time that a vulnerability has affected Apple’s paid privacy features, since both are part of the iCloud+ subscription. Though Apple did finally patch the Hide My Email flaw late last month, a second flaw is not a great look for a company that prides itself on privacy and security.

Go to the linked site.

Read on Six Colors.

From an un-bylined post on OpenAI’s site:

Apple’s request for a preliminary injunction is both based on false information and completely unnecessary because we do not have, nor want, any of their trade secrets. We’re much more interested in building innovative products and technologies that push the frontier.

The post itself includes numerous transcripts of message conversations¹ and emails that supposedly bolster OpenAI’s case that it studiously avoided using Apple information.

This is, as The Verge’s Jess Wetherbed notes, a pure public opinion play. Because if they have evidence, the only correct answer is “we’ll see you in court.”

What kept running through my head while reading this was the old legal chestnut: “If you have the facts on your side, pound the facts. If you have the law on your side, pound the law. If you have neither on your side, pound the table.”

Go to the linked site.

Read on Six Colors.