A vulnerability in Apple’s “Hide My Email” tool lets almost anyone discover a person’s real email address that is supposed to be hidden by the feature, and Apple has failed to fix it for more than a year, according to a security researcher and 404 Media’s own tests.
404 Media is not revealing the exact details of the vulnerability because it can still be exploited as of Monday, when 404 Media verified the issue with one of our own hidden email addresses.
Hide My Email, part of Apple’s iCloud+ subscription, generates random @icloud.com addresses that forward to your real inbox—letting you sign up for services without revealing your actual email address. I seldom use Hide My Email because my email address is already all over the Internet, but this seems like a “you had one job” situation. It’s a particularly bad look for Apple to have ignored this reported vulnerability for over a year, and I suspect the company will fix it soon due to all the negative press now that it’s public. In other (possibly related?) Hide My Email news, TechCrunch recently reported that Apple plans to change the generated email addresses to the @private.icloud.com domain, which would make it trivial for apps and websites to identify and block Hide My Email addresses.
I was going to ask a question about using hide my email. When Comcast emptied my Inbox, some of my email went into the Spam folder. One of them was a company I want to receive email from, but the only way to contact them is to sign up for their newsletter again. I did that using my only email address. Apparently, that isn’t going to work. So I thought about making up a “hide my email” email. Since it will go into my only Comcast Inbox, would that work?
I agree that my email address is easily found (and I do not use Hide My Email). However, I do add “+uniqueID” to my email address username for most new business contacts. (For example, if my real email address is myname@domain.com, I would use myname+uniqueID@domain.com when registering with the business. Of course, I use a different uniqueID for each business.) This has three advantages.
Sites that use my email address as my loginID get a loginID that is different from my basic email address. If my loginID at one site is compromised, it cannot be used at a different site. [Edit. I believe this would solve @janesprando’s issue.]
If I receive emails concerning more than one account from a business, it lets me tell which account the email concerns.
If the business shares my email with some other business, I can tell where the second business got my address. (Well, not always. The second business could share the address with a third business, and so on.)
Question. Can I use a Hide My Email address when registering at a business web site? In other words, can Hide My Email addresses be associated with specific web sites so that a Hide My Email address could serve the same functions as my +uniqueID scheme? Thanks.
This is probably not as effective as it once was, since almost everyone knows you can strip out the plus and everything after to get the real email address.
If you own your own email domain, as I do, you can usually add email alias addresses ad infinitum without additional cost. Anytime I need a throwaway address, I can just create a new address@mydomain.com. My email host is set to route all unknown email addresses on my domain to a specific mailbox, so I don’t even have to create a specific alias. I can strip it out if I need to with either a client-side filter or by creating an alias that’s automatically rejected by the server.
I quibble that “almost everyone knows” but acknowledge that the wrong people do know. However, your comment doesn’t address either of my first two advantages, which (I believe) remain, and the third advantage has been useful twice this year.
Yes, that’s the main goal of the feature, and the site theoretically cannot get yoru real email address from it. You can also disable the Hide My Email address if you wish.
Personally, I just have too many accounts to bother identifying them separately or hiding the address in any way. It’s just not worth the effort.
I thought I could create my own hide-my-email address, but when I touch “+Create new address”, it supplies the choice and I can’t seem to change it I am on and iPad Air 5 running 18.7.7. So how do add the address I want to create?
Some email providers offer an alias-creation feature that simplifies the process. Usually the number of allowed aliases is limited depending on the level of service and its respective cost. (I have been looking for a new email provider with the feature because after 10 years certain issues with Runbox.com have become too problematic for me.)
Coincidentally, a few days ago I got an email from IVPN.net (IMO the most ethical personal VPN service that I know of. . . Cue the jokes about that being a very low bar) informing me that my discounted legacy account is eligible to use its Mailx Beta Launch - Audited, Open-Source Email Aliasing Service. New accounts will get the option after beta testing is completed. Mailx beta launch - Audited, open-source email aliasing service
For over 20 years my “online biz” email address using my domain remained spam-free. But then I got pwned, with the count presently at 8 times. Amazingly, my personal email account which I created at the same time has never been pwned and it receives no spam.
This vulnerability notwithstanding, I have found the Hide My Email feature of iCloud+ to be indispensable. I have (as of now) over 250 different Hide My addresses, each one mapped to a different account or service. When one of them gets “frisky” with its address, I can simply hit the “Deactivate” button (deep in in “Settings” or “System Settings…”, depending on the OS) and it is gone – and I know the culprit. Moreover, it gives me some immunity against a data breach (since the address are throw-away).
Bottom line: I am a huge fan of Hide My Email and recommend it to anyone who pays for iCloud services.
Sure now it’s good for your current ones already created as an-alias@icloud.com, but the issue remains in the near future of the icloud.com domain becoming private.icloud.com for future aliases – thus providers being able to filter them out.
Don’t believe you can do that with Apple’s “Hide my email” feature. They propose an address that they know is unique so they can route mail to that address to you and no one else. If you supplied your own choice, it may not be unique.
To what end? How many companies will say “you aren’t allowed to use this e-mail address in order to pay us money for what we’re selling”? And will expend engineering R&D hours to implement the policy? And be forced to perpetually play catch-up as Apple and others change domains to get around these blocks?
Even the dumbest marketing department would realize that this policy would cost a lot of money for no purpose other than to send customers to the competition.
We’ll see what happens in the future, but I don’t think very many companies will be that dumb.
I’d certainly be inclined to just not bother with a website that prevented me using a valid, private email address. That said, as a Fastmail customer, I can use their similar service, but Apple does make it convenient.