Apple’s “Hide My Email” Doesn’t

In 2021, Apple introduced a feature called “Hide My Email” for subscribers of its iCloud+ premium plans. The purpose of this opt-in feature, as the name implies, is to hide your true email address from others, usually websites or apps that must have one on file to establish an account or service. Apple creates a nonsensical email address that you can provide to anyone, and then acts as a middleman forwarding emails sent to that address to your true email account. To you, the user, it appears seamless as everything lands in your inbox like normal, but now with a much easier way to sever ties with that company if desired as they never know your actual email address. But now a researcher has come forward with a stupidly simple way to uncover the true account behind a masked Hide My Email address: just send it a large attachment. Apple’s service forwards the large email to your account, which bounces back an error to the original sender, revealing your actual email address. The source blog is behind a paywall, but multiple other sites point out that Apple has known about this issue for at least a year and still hasn’t fixed it. I don’t personally use this feature, but I wouldn’t be surprised if we hear about a class action lawsuit in the not-too-distant future.