A security researcher claims to have discovered a bug in Apple’s Hide My Email feature that allows users’ real email addresses to be unmasked, potentially undermining the privacy tool entirely.
The vulnerability was reported by 404 Media, which says it tested and verified the bug. Researcher Tyler Murphy says he alerted Apple to the problem more than a year ago, but the company has yet to fix it. Murphy told 404 Media that all attempts to exploit the bug have succeeded. “We don’t know the full scope of the issue, but in our limited tests with volunteers, 100% of Hide My Email addresses were exploitable,” he said.
Specific technical details of the vulnerability have not been publicly disclosed to prevent exploitation. Murphy is the co-founder of EasyOptOuts, a paid data-removal service that removes personal information from data broker websites. He warned that “publicly accessible people-search sites make it easy to link an email address to other personal details, so people relying on Hide My Email for safety may be at risk.”
Hide My Email is an Apple privacy feature that generates disposable email addresses to shield a user’s real address when signing up for services or communicating online. The bug, if left unpatched, could render that protection ineffective.
This is not the first time Apple’s privacy features have come under scrutiny. In 2022, the company was sued after reports that iPhone apps continued sending analytics data to Apple even when the iPhone Analytics privacy setting was turned on. In 2023, researchers found that a tool meant to anonymize users’ Wi-Fi connections by randomizing MAC addresses was instead exposing real MAC addresses.
TechCrunch reached out to Apple for comment but had not received a response at the time of publication.
Source: TechCrunch