404 Media: Vulnerability in iCloud’s ‘Hide My Email’ Reveals Peoples’ Real Email Addresses
A vulnerability in Apple's Hide My Email feature can reveal users' real email addresses, according to a report from 404 Media. The security firm EasyOptOuts discovered the flaw and reported it to Apple over a year ago, but it remains unpatched. In tests, 100% of hidden email addresses were exploitable.
Background
Apple's "Hide My Email" is an iCloud+ privacy feature that lets users generate random, disposable email addresses that forward to their real inbox — so they can sign up for services without revealing their actual email. This article reports that a vulnerability (not yet patched as of publication) allows an attacker to reverse that forwarding and discover the real email address behind any hidden one. The flaw was reported to Apple over a year ago by the co-founder of EasyOptOuts, a data-removal service. The article also notes that Apple recently announced it is merging the domain names used for "Hide My Email" and "Sign in with Apple" (a related single-sign-on feature), though it's unclear if that change is connected to this bug.