Leak Week

speaking of this week's show we always start with the lowdown and the first story i have in here is apple's private relay can the leak your real ip address so we talked about hiding my email maybe a couple weeks ago it wasn't doing what it's supposed to do now we got the private relay not doing what it's supposed to do a new report from security researchers talal haj bakri And Tommy Misk found that Apple's private relay, the iCloud plus feature that we pay for, that's supposed to hide your IP address while browsing in Safari, can be circumvented and expose your real IP address anyway.

Flaws trace back to three features baked in the WebKit, the browser engine every iOS browser is required to use.

which is also why this isn't fixable by just switching browsers on the phone.

Private relay only works with some Safari and isn't a full VPN.

It doesn't protect the system.

It doesn't protect that system at the system level.

Jeez Louise.

The researchers built a site tech crunch confirmed.

It works.

Notably, the researchers chose not to report this to Apple first saying past experience taught them that That route means month of delays, inconsistent communication, and in some cases, denying the issue's impact entirely.

We can confirm this because that was the complaint with the hide my email.

The dude sent it to Apple.

They said, we working on it.

He sends it to him again and say, hey, don't worry.

We're working about it.

I think he said it to him three times.

And they said it was

fixed.

I hope he said it was fixed, right?

The last time they said it was fixed.

And then he went back and, you know, spot check, you know, their email.

answer still wasn't fixed finally went to the news the tech blogs ate it up so now fast forward to the private relay the research is like you know what you're not gonna do is catch us slipping and have us back and forth and for a year and y'all not doing something so they put it out in the wild and now the tech blogs have gotten a hold of it And they're running wild with this.

So what do you think is going on? Are the researchers getting smarter? Is Apple getting more lax? What's going on with these features that are supposed to be private, that are supposed to protect our data, that are having these obvious like lax insecurity issues that random people are not random, but people outside of Apple are finding them before Apple can get to them.

So this is really strange.

First, what are we really paying for in iCloud Plus? Because it sounds like we're spending money monthly on this subscription service that was touted as, oh, this is the best platform.