Apple has reversed its plan to move Hide My Email to a private.icloud.com domain and will keep Hide My Email addresses on icloud.com; Sign in with Apple will use private.icloud.com later this year, and developers should allow both domains.
Security researchers say iCloud Private Relay, Apple’s feature designed to mask IP addresses in Safari, can still reveal a user’s real IP when WebAuthn passkeys are used because the OS credential service issues HTTPS requests outside Private Relay; DNS prefetching and WebTransport may also disclose IPs. Apple is investigating, and a test site has been released by the researchers. Since the leak stems from WebKit behavior and affects some third‑party browsers too, users may want to consider using a VPN or disabling Private Relay for certain sites until a fix is deployed.