Why Apple Uses a Proxy for Safari Safe Browsing Lookups

Apple introduced a proxy server for Safari's Safe Browsing lookups to protect user privacy by hiding their IP addresses from third-party security providers like Google and Tencent. By routing these security checks through its own servers first, Apple ensures that the providers verifying the safety of a website cannot link those requests to a specific user's identity or physical location. This architecture allows Safari users to benefit from industry-standard phishing and malware protection without exposing their browsing habits and metadata to external companies.

How Safe Browsing Works in Safari

Safari includes a feature called "Fraudulent Website Warning" to protect users from phishing attacks, malware, and malicious websites. Instead of maintaining its own global database of dangerous websites, Apple relies on established third-party databases—specifically Google Safe Browsing for most of the world, and Tencent Safe Browsing for users in mainland China.

To check if a website is safe without sending the exact URL a user is visiting to Google or Tencent, Safari uses a system of cryptographic hashes. Safari downloads a list of shortened "hash prefixes" of known bad sites. If a user visits a site that matches one of these prefixes, Safari must request the full list of matching hashes from the Safe Browsing provider's server to verify if the exact site is actually dangerous.

The Privacy Vulnerability

Before the introduction of the proxy server in iOS 14.5 and macOS Big Sur, Safari made these verification requests directly from the user's device to Google or Tencent servers.

Because of how standard internet communication works, any direct request to a server reveals the sender's IP address. This created a significant privacy loophole:

  • Location Tracking: An IP address can be used to determine a user's approximate geographical location.
  • User Profiling: By logging the IP address alongside the requested hash prefixes over time, the Safe Browsing provider could theoretically build a profile of a user's browsing activity and correlate it with other data they hold on that IP address.

How Apple's Proxy Solves the Problem

To eliminate this privacy risk, Apple placed its own proxy server between the Safari browser and the Safe Browsing provider. This creates a "blind" relay system where no single entity has access to all the data:

  1. The Request: When Safari needs to verify a website's safety, it sends the encrypted Safe Browsing lookup request to Apple's proxy server instead of going directly to Google or Tencent.
  2. Stripping the IP: Apple's proxy server receives the request, strips away the user's IP address, and replaces it with the proxy server's own IP address.
  3. Forwarding: Apple forwards the anonymized lookup request to the Safe Browsing provider.
  4. The Result: Google or Tencent processes the safety check and returns the result through the proxy back to the user.

Through this method, Apple knows the user's IP address but cannot see the contents of the Safe Browsing lookup. Conversely, the Safe Browsing provider sees the lookup request but only sees Apple's IP address, making it impossible to tie the request back to an individual user.

Reducing Data Sharing with Competitors

Beyond the immediate technical benefit to the user, introducing this proxy aligns with Apple's broader privacy-by-design philosophy. Google and Tencent are massive data-driven companies that rely heavily on user metrics and advertising. By blinding these providers to Safari users' IP addresses, Apple closed a passive data-collection channel, ensuring that basic browser security does not come at the cost of feeding metadata to third-party networks.