IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay

5 hours ago

WebKit-based browsers on iOS and macOS route traffic through proxy servers, but three WebKit features bypass the proxy: DNS prefetching, WebAuthn Related Origin Requests, and WebTransport.
DNS prefetching resolves hostnames via the device's normal DNS path, revealing the user's real DNS servers instead of the proxy's. It is available since iOS 26.0.
WebAuthn Related Origin Requests make the OS credential service fetch a validation file directly from the device, exposing the real IP address. Available since iOS 18.0.
WebTransport opens a direct HTTP/3 connection that bypasses the proxy, exposing the real IP address. Available since iOS 26.4.
These leaks also affect Apple's iCloud Private Relay but not VPNs, as VPNs tunnel all network traffic at the system level.
The Tor Project and Onion Browser developers have been notified about these issues.
Psylo 1.3.1 fixes the leaks by blocking dns-prefetch hints and disabling WebTransport and WebAuthn by default, with per-silo toggles for legitimate use.

Carl is a lightweight BitTorrent client that features Nostr-based discovery and built-in Tor anonymity.
It does not require accounts or collect telemetry; user identity is managed via a local Nostr key.
Connects directly to peers when privacy is not a priority, with trackers and DHT enabled.

GeoSpoof is a browser extension that spoofs your real location to match your VPN IP, covering all browser location detection APIs.
It overrides multiple browser signals like geolocation, timezone, and WebRTC IP leaks to ensure a consistent fake identity across dozens of APIs.
Features include city-based location setting, VPN sync with automatic re-sync, per-site rules, saved favorites, and a built-in verification page for testing.

WebSockets enable two-way communication with a web server, reducing HTTP overhead by keeping the connection open.
A WebSocket connection starts as HTTP and then upgrades to the WebSocket protocol, avoiding repeated request-response cycles.
WebSockets allow the server to push unsolicited data to the client, solving a limitation of traditional HTTP.

Mastodon serves different content (HTML, ActivityPub JSON, API JSON) for the same URL based on the Accept header, requiring careful cache key normalization.
The cache key must include a normalized variant of the Accept header to prevent serving the wrong content type to clients.
Key assumptions: AUTHORIZED_FETCH disabled, no signed URLs, federation uses HTTP Signatures (not Authorization header).

Safari MCP server introduced in Safari Technology Preview 247.
Enables agents to access browser data (DOM, network requests, screenshots, console logs).
Speeds up debugging by reducing context switching between browser and terminal.

Carl is a lightweight BitTorrent client that features Nostr-based discovery and built-in Tor anonymity.
It does not require accounts or collect telemetry; user identity is managed via a local Nostr key.
Connects directly to peers when privacy is not a priority, with trackers and DHT enabled.

GeoSpoof is a browser extension that spoofs your real location to match your VPN IP, covering all browser location detection APIs.
It overrides multiple browser signals like geolocation, timezone, and WebRTC IP leaks to ensure a consistent fake identity across dozens of APIs.
Features include city-based location setting, VPN sync with automatic re-sync, per-site rules, saved favorites, and a built-in verification page for testing.

WebSockets enable two-way communication with a web server, reducing HTTP overhead by keeping the connection open.
A WebSocket connection starts as HTTP and then upgrades to the WebSocket protocol, avoiding repeated request-response cycles.
WebSockets allow the server to push unsolicited data to the client, solving a limitation of traditional HTTP.

Mastodon serves different content (HTML, ActivityPub JSON, API JSON) for the same URL based on the Accept header, requiring careful cache key normalization.
The cache key must include a normalized variant of the Accept header to prevent serving the wrong content type to clients.
Key assumptions: AUTHORIZED_FETCH disabled, no signed URLs, federation uses HTTP Signatures (not Authorization header).

Safari MCP server introduced in Safari Technology Preview 247.
Enables agents to access browser data (DOM, network requests, screenshots, console logs).
Speeds up debugging by reducing context switching between browser and terminal.

Hasty Briefsbeta