Apple’s ‘Hide My Email’ feature is a convenient privacy tool that uses disposable addresses to conceal a user’s real email address, ensuring online anonymity. Unfortunately, new research suggests that a bug in the feature exposes users’ real email addresses.
Media reported a bug, 404, and said it tested and verified that the vulnerability exists. Tyler Murphy, the researcher who discovered the bug, said he warned Apple about the problem a year ago, but it’s unclear why the company hasn’t resolved it yet. All attempts to exploit the bug have been successful, Murphy said.
“We don’t know the full scope of the issue, but in our limited tests with volunteers, 100% of Hide My Email Addresses were exploitable,” Murphy told the outlet. The company has not publicly disclosed details of the vulnerability, fearing that someone might exploit it.
Murphy is the co-founder of EasyOptOuts, which offers a paid data-removal service that removes your information from data broker sites. He told 404 Media that “publicly accessible people-search sites make it easy to link email addresses to other personal details, so people relying on Hide My Email for security could be at risk.”
TechCrunch has reached out to Apple for more information and will update this story if it responds.
When it comes to the world of tech, privacy tools are difficult to find and unfortunately, even when they exist, they don’t always work. Apple has also faced accusations of this kind in the past.
For example, the company was sued in 2022; it was reported that iPhone apps continued to send analytics data to Apple even when the iPhone Analytics privacy setting was turned on.
Similarly, in 2023, researchers found another of Apple’s privacy features to be effectively “useless.” The research claimed that a tool that was supposed to anonymise mobile users’ Wi-Fi connections by providing a random MAC address (an easily trackable identifier) was exposing users’ real MAC addresses.
Apple has built a giant part of its reputation and branding on user privacy, so hopefully it’ll manage to address the obvious Hide My Email bug with some urgency. If it can better keep its privacy promises, that would be a good thing.
