Researcher Alleges Apple’s Hide My Email Feature Contains Bug That Reveals Actual Email Addresses
Apple’s Hide My Email feature is designed to enhance user privacy by generating temporary email addresses that mask individuals’ real identities online. However, recent findings suggest that a flaw in this functionality may expose users’ actual email addresses.
This vulnerability was flagged by 404 Media, which confirmed its existence through testing. Researcher Tyler Murphy, who discovered the issue, indicated that he informed Apple over a year ago, but it remains unresolved. According to Murphy, attempts to exploit the flaw have consistently been successful.
“The full extent of the concern is unknown, but during our limited trials, every instance of Hide My Email addresses proved to be vulnerable,” Murphy explained. The specifics of the flaw have not been publicly shared to prevent potential misuse.
Murphy, who co-founded EasyOptOuts—a paid service that helps remove personal data from broker sites—mentioned that “publicly available people-search platforms make it easy to link email addresses to other private information, putting those using Hide My Email for security at risk.”
TechCrunch has reached out to Apple for clarification and will provide updates if a response is received.
In the realm of technology, effective privacy tools can be rare, and even those that exist may have flaws. Apple has faced criticism regarding privacy issues in the past.
For instance, the company was involved in a lawsuit in 2022 after it was revealed that iPhone applications continued to transmit analytics data to Apple, despite users having enabled the privacy setting meant to prevent this.
In a separate incident in 2023, researchers deemed another of Apple’s privacy features nearly “ineffective.” This feature was intended to protect mobile users’ Wi-Fi connections by providing randomized MAC addresses, only to expose users’ real MAC addresses instead.
Given that Apple has built a substantial part of its image around user privacy, it is crucial for the company to swiftly address the detected issue with its Hide My Email feature. Strengthening its privacy commitments could significantly benefit its reputation.
