Lawsuit against Apple: Critical vulnerability in iCloud+ exposed user IP addresses
Many users pay for an iCloud+ subscription for the iCloud Private Relay feature, designed to mask IP addresses while browsing. However, new research has uncovered a serious flaw that renders this protection ineffective, leaving users vulnerable to tracking.
Many of us pay monthly for an iCloud+ subscription primarily for peace of mind. One of the key features Apple offers is iCloud Private Relay, which is supposed to mask our IP address while browsing and prevent websites from tracking us. However, a new discovery by security researchers reveals that this important feature simply does not do the job, leaving users completely exposed online.
How does this flaw work in practice?
The problem lies in passkeys technology. Security researchers discovered that when a website supports this technology, your device makes a request to the network outside the browser itself. This request completely bypasses Apple's protection mechanism and exposes your real IP address. Worse, the site does not even have to actually support the technology; it is enough for it to pretend to do so in order to extract your details.
In a normal state, the service is supposed to operate in two stages to protect you. In the first stage, your network provider and Apple see only your address but not the site you are visiting. In the second stage, an external server generates a temporary address for you and connects you to the site. In practice, the new flaw easily bypasses this entire setup.
The lawsuit accusing Apple of fraud
This discovery led to the filing of a class action lawsuit against Apple by the law firm Clarkson, the same firm that previously achieved a $250 million settlement with the company. The lawsuit accuses the tech giant of false advertising and fraud. According to the lawyers, Apple knew or should have known that its promises to consumers were untrue at the time it sold them the expensive subscription.
"This is an outrageous betrayal of consumer trust," the law firm states, noting that Apple built its brand on the promise of unique privacy.
It now turns out that users paid their hard-earned money for protection that did not work, leaving them exposed to tracking and profiling. We reached out to Apple for a response regarding the serious findings, but such a response has not yet been received.
