Apple's Hide My Email feature may be exposing real addresses, researcher says
A privacy tool under scrutiny
Apple’s Hide My Email feature is designed to shield users’ real addresses behind disposable aliases, but new research suggests the system may be failing at that basic job. According to reporting from 404 Media, a bug in the feature can expose a user’s actual email address, undermining the privacy promise behind one of Apple’s better-known security tools.
Tyler Murphy, the researcher who found the issue, said he alerted Apple to the problem more than a year ago. He told 404 Media that it was unclear why the company had not yet fixed it, and said every attempt to exploit the bug in limited testing was successful.
“We don’t know the full scope of the issue, but in our limited tests with volunteers, 100% of Hide My Email addresses were exploitable,” Murphy told the outlet.
How the bug could matter
Murphy, who co-founded the data-removal service EasyOptOuts, said publicly accessible people-search sites can make it easy to connect an email address to other personal information. In that context, he warned, users who rely on Hide My Email for safety could be put at risk.
The vulnerability has not been publicly disclosed in detail, apparently to reduce the chance that it is abused. 404 Media said it tested and verified that the bug exists.
TechCrunch said it reached out to Apple for comment and would update if the company responds.
The report adds to a recurring problem for Apple, which has built much of its brand around privacy. The company was sued in 2022 after reports that iPhone apps continued sending analytics data to Apple even when the iPhone Analytics setting was enabled. In 2023, researchers said another privacy feature — randomized MAC addresses meant to anonymize Wi-Fi connections — was effectively exposing users’ real MAC addresses.
For Apple, the latest report raises the same uncomfortable question as the earlier ones: whether its privacy tools are living up to the promise that helped define them.
Sources: