A new report reveals a vulnerability in Apple's Hide My Email feature, which could potentially expose users' true email addresses despite their attempts to keep them private.
The vulnerability, discovered by Tyler Murphy last year, has yet to be fixed by Apple, despite multiple reports and updates on the issue. Murphy initially reported the problem to Apple, but was told a month later that an update had provided a fix. However, he was still able to expose the vulnerability after the supposed patch and provided Apple with more details.
Hide My Email is a feature of iCloud+ that allows users to create and use an anonymous email address when signing up for online accounts. This feature is meant to provide users with a level of privacy by hiding their actual email address from online services. However, the recently discovered vulnerability raises questions about the effectiveness of Hide My Email in protecting users' private information.
Standard security practice typically advises against disclosing findings until after the vulnerability has been fixed. However, in this case, Murphy went public with the information after a year of inaction from Apple, in an effort to pressure the company to address the issue.
Users should be aware that the vulnerability may still pose a risk to their private information, and may want to consider alternative methods of protecting their email addresses until the issue is resolved. One possible solution is to create a separate email account at a free online email service for non-critical logins.
A recent change to Hide My Email, where the email address created uses @private.icloud.com instead of @icloud.com, may also provide some level of protection against the vulnerability. However, Apple has stated that this change will be implemented later this summer.
