{"id":7037782,"date":"2026-08-11T09:30:20","date_gmt":"2026-08-11T09:30:20","guid":{"rendered":"https:\/\/peraltafinancing.com\/apple-2\/michael-tsai-blog-webkit-ip-and-dns-leaks-affecting-proxies-and-private-relay\/"},"modified":"2026-08-11T09:30:20","modified_gmt":"2026-08-11T09:30:20","slug":"michael-tsai-blog-webkit-ip-and-dns-leaks-affecting-proxies-and-private-relay","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=7037782","title":{"rendered":"Michael Tsai – Blog – WebKit IP and DNS Leaks Affecting Proxies and Private Relay"},"content":{"rendered":"


\n<\/p>\n

\n

Talal Haj Bakry and Tommy Mysk<\/a> (Mastodon<\/a>, Hacker News<\/a>, MacRumors<\/a>, Mac Power Users<\/a>):<\/p>\n

\n

WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features \u2014 DNS prefetching, WebAuthn Related Origin Requests, and WebTransport \u2014 that bypass the configured proxy and send traffic directly from the device, which exposes the user\u2019s real network. The same leaks also affect Apple\u2019s iCloud Private Relay.<\/p>\n

[\u2026]<\/p>\n

It must be noted that VPNs are not affected, since they tunnel the device\u2019s entire network traffic at the system level.<\/p>\n

[\u2026]<\/p>\n

We\u2019ve addressed all three leaks in Psylo 1.3.1[\u2026] Passkeys and WebTransport have legitimate uses, so both can be re-enabled at any time through per-silo toggles. This keeps Psylo leak-free out of the box, while users who need one of these features on a given site can opt in explicitly, with a clear understanding of the trade-off.<\/p>\n<\/blockquote>\n

Psylo<\/a>:<\/p>\n

\n

In an ideal world, we\u2019d report the issues to Apple, they acknowledge the issue, and ship a fix in a timely manner. Unfortunately, our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue\u2019s impact entirely.<\/p>\n

We weren\u2019t willing to wait months, or upwards of a year, sitting on bugs that undermine the core privacy guarantees of Psylo and iOS Tor browsers while saying or doing nothing. <\/p>\n

[\u2026]<\/p>\n

Should we knowingly leave our users exposed while waiting for a system-level fix? We didn\u2019t think that was acceptable or fair to our users. Or should we quietly ship our own mitigations without telling anyone? We didn\u2019t think that was acceptable either. Security fixes deserve transparency, especially when they involve tradeoffs.<\/p>\n<\/blockquote>\n

Psylo<\/a>:<\/p>\n

\n

Soon after we published the blog, we sent a link to the blog and demo website to Apple in a security report to make them aware of it. Now the report is already in the status \u201cWe\u2019re planning to address the issue you reported.\u201d and a fix is planned for Fall 2026 \ud83e\udd2f\ud83e\udd2f\ud83e\udd2f<\/p>\n<\/blockquote>\n

Mysk<\/a>:<\/p>\n

\n

It used to take months and months to reach this status. We got there in less than 24h<\/p>\n<\/blockquote>\n

Running to the press always helps\u2026<\/p>\n

Previously:<\/p>\n

Apple Security Bounty<\/a> iCloud Private Relay<\/a> iOS<\/a> iOS 26<\/a> Mac<\/a> macOS Tahoe 26<\/a> Orion<\/a> Passkeys<\/a> Privacy<\/a> Psylo<\/a> Security<\/a> Tor<\/a> WebKit<\/a><\/p>\n

<\/a>
\n2 Comments
\n <\/h2>\n
\n
\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"

Talal Haj Bakry and Tommy Mysk (Mastodon, Hacker News, MacRumors, Mac Power Users): WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features \u2014 DNS prefetching, WebAuthn Related Origin Requests, and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11768],"tags":[11057,3767,24143,16538,1823,11448,68016,148007,17088,33603],"dealstore":[],"offerexpiration":[],"class_list":["post-7037782","post","type-post","status-publish","format-standard","hentry","category-apple-2","tag-affecting","tag-blog","tag-dns","tag-leaks","tag-michael","tag-private","tag-proxies","tag-relay","tag-tsai","tag-webkit"],"yoast_head":"\nMichael Tsai - Blog - WebKit IP and DNS Leaks Affecting Proxies and Private Relay - Som2ny Network<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fivemor.com\/?p=7037782\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Michael Tsai - Blog - WebKit IP and DNS Leaks Affecting Proxies and Private Relay - Som2ny Network\" \/>\n<meta property=\"og:description\" content=\"Talal Haj Bakry and Tommy Mysk (Mastodon, Hacker News, MacRumors, Mac Power Users): WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features \u2014 DNS prefetching, WebAuthn Related Origin Requests, and […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fivemor.com\/?p=7037782\" \/>\n<meta property=\"og:site_name\" content=\"Som2ny Network\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-11T09:30:20+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fivemor.com\/?p=7037782#article\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/?p=7037782\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\"},\"headline\":\"Michael Tsai – Blog – WebKit IP and DNS Leaks Affecting Proxies and Private Relay\",\"datePublished\":\"2026-08-11T09:30:20+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fivemor.com\/?p=7037782\"},\"wordCount\":415,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"keywords\":[\"affecting\",\"Blog\",\"DNS\",\"Leaks\",\"Michael\",\"Private\",\"Proxies\",\"Relay\",\"Tsai\",\"WebKit\"],\"articleSection\":[\"Apple\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fivemor.com\/?p=7037782#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fivemor.com\/?p=7037782\",\"url\":\"https:\/\/fivemor.com\/?p=7037782\",\"name\":\"Michael Tsai - Blog - WebKit IP and DNS Leaks Affecting Proxies and Private Relay - Som2ny Network\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/#website\"},\"datePublished\":\"2026-08-11T09:30:20+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fivemor.com\/?p=7037782#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fivemor.com\/?p=7037782\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fivemor.com\/?p=7037782#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/fivemor.com\/?bp_activities=1\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Michael Tsai – Blog – WebKit IP and DNS Leaks Affecting Proxies and Private Relay\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fivemor.com\/#website\",\"url\":\"https:\/\/fivemor.com\/\",\"name\":\"Som2ny Network\",\"description\":\"Daily Deals\",\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fivemor.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/fivemor.com\/#organization\",\"name\":\"Som2ny Network\",\"url\":\"https:\/\/fivemor.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"contentUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"width\":300,\"height\":86,\"caption\":\"Som2ny Network\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/fivemor.com\"],\"url\":\"https:\/\/fivemor.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Michael Tsai - Blog - WebKit IP and DNS Leaks Affecting Proxies and Private Relay - Som2ny Network","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fivemor.com\/?p=7037782","og_locale":"en_US","og_type":"article","og_title":"Michael Tsai - Blog - WebKit IP and DNS Leaks Affecting Proxies and Private Relay - Som2ny Network","og_description":"Talal Haj Bakry and Tommy Mysk (Mastodon, Hacker News, MacRumors, Mac Power Users): WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features \u2014 DNS prefetching, WebAuthn Related Origin Requests, and […]","og_url":"https:\/\/fivemor.com\/?p=7037782","og_site_name":"Som2ny Network","article_published_time":"2026-08-11T09:30:20+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fivemor.com\/?p=7037782#article","isPartOf":{"@id":"https:\/\/fivemor.com\/?p=7037782"},"author":{"name":"admin","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371"},"headline":"Michael Tsai – Blog – WebKit IP and DNS Leaks Affecting Proxies and Private Relay","datePublished":"2026-08-11T09:30:20+00:00","mainEntityOfPage":{"@id":"https:\/\/fivemor.com\/?p=7037782"},"wordCount":415,"commentCount":0,"publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"keywords":["affecting","Blog","DNS","Leaks","Michael","Private","Proxies","Relay","Tsai","WebKit"],"articleSection":["Apple"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fivemor.com\/?p=7037782#respond"]}]},{"@type":"WebPage","@id":"https:\/\/fivemor.com\/?p=7037782","url":"https:\/\/fivemor.com\/?p=7037782","name":"Michael Tsai - Blog - WebKit IP and DNS Leaks Affecting Proxies and Private Relay - Som2ny Network","isPartOf":{"@id":"https:\/\/fivemor.com\/#website"},"datePublished":"2026-08-11T09:30:20+00:00","breadcrumb":{"@id":"https:\/\/fivemor.com\/?p=7037782#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fivemor.com\/?p=7037782"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fivemor.com\/?p=7037782#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/fivemor.com\/?bp_activities=1"},{"@type":"ListItem","position":2,"name":"Michael Tsai – Blog – WebKit IP and DNS Leaks Affecting Proxies and Private Relay"}]},{"@type":"WebSite","@id":"https:\/\/fivemor.com\/#website","url":"https:\/\/fivemor.com\/","name":"Som2ny Network","description":"Daily Deals","publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fivemor.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/fivemor.com\/#organization","name":"Som2ny Network","url":"https:\/\/fivemor.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/","url":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","contentUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","width":300,"height":86,"caption":"Som2ny Network"},"image":{"@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","caption":"admin"},"sameAs":["https:\/\/fivemor.com"],"url":"https:\/\/fivemor.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/7037782","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7037782"}],"version-history":[{"count":0,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/7037782\/revisions"}],"wp:attachment":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7037782"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7037782"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7037782"},{"taxonomy":"dealstore","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fdealstore&post=7037782"},{"taxonomy":"offerexpiration","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fofferexpiration&post=7037782"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}