A newly identified flaw can link real email addresses to anonymous ones.
Apple’s Hide My Email feature, designed to protect user privacy, may not be as secure as intended. This function, available to iCloud+ users, allows individuals to generate a disposable email address, helping them avoid unsolicited emails and maintain privacy from data trackers. However, a report from a media outlet has indicated that a flaw exists which enables hackers to link the real email addresses of users to their generated anonymous ones.
Attempts to contact Apple for a statement on the matter have been made, and updates will be provided if a response is received.
The issue was initially identified by the team at EasyOptOuts. According to their CEO, Tyler Murphy, they contacted Apple about this problem and its replicability over a year ago. Though they had some exchanges with Apple, which acknowledged the issue and promised to investigate, Murphy and a reporter were able to demonstrate the vulnerability during their investigation. Details on the method exploited have not been released to mitigate risks to users.
“The reason for the delay in resolving this matter is unclear, but we believe users of Hide My Email should be informed about the potential for their hidden addresses to be revealed,” Murphy stated. He further mentioned, “While the full extent of the issue remains unclear, our limited testing with participants showed a 100 percent success rate in exploiting Hide My Email addresses.”
