{"id":69735,"date":"2026-07-01T19:04:32","date_gmt":"2026-07-01T17:04:32","guid":{"rendered":"https:\/\/www.apfelpatient.de\/?p=69735"},"modified":"2026-07-01T19:05:45","modified_gmt":"2026-07-01T17:05:45","slug":"hide-email-address-security-vulnerability","status":"publish","type":"post","link":"https:\/\/www.apfelpatient.de\/en\/news\/e-mail-adresse-verbergen-sicherheitsluecke","title":{"rendered":"Hiding email addresses: Security vulnerability exposes real addresses"},"content":{"rendered":"

A feature designed to protect your real email address is apparently doing the opposite. A bug in Apple's "Hide Email Address" allows almost anyone to reveal the hidden address behind an alias \u2013 and Apple has left the problem unresolved for over a year.<\/strong><\/p>\n\n\n\n

\"Hide My Email\" is a feature of the paid iCloud+ subscription that generates random alias addresses <\/a>and forwards messages to the actual mailbox. The feature is primarily intended for sign-ups and contact with third-party providers \u2013 it is meant to shield the real address from spam, data leaks, and unwanted identification. It is precisely this protection promise that has now started to wobble: security researchers have demonstrated a vulnerability that allows the real address behind such an alias to be determined. What is particularly explosive is not just the flaw itself, but the way it has been handled \u2013 because Apple was informed about it more than a year ago.<\/p>\n\n\n\n

What the gap allows<\/h2>\n\n\n\n

At its core, this vulnerability undermines the very purpose of the function: instead of remaining anonymous, the underlying real address can be revealed. The severity of the problem is demonstrated by its extent \u2013 in tests with volunteers, all tested alias addresses proved vulnerable, i.e., 100 percent.<\/p>\n\n\n\n

The technical details of the vulnerability are being deliberately withheld because it remains actively exploitable. The problem was independently verified this week using an address generated by the feature. The fact that a privacy feature can be circumvented in this way is all the more serious because many users rely on it precisely because of this promise (via 404Media<\/a>).<\/p>\n\n\n\n

A year without a solution<\/h2>\n\n\n\n

The vulnerability was discovered and responsibly reported by security researcher Tyler Murphy, co-founder of the EasyOptOuts service. He informed Apple in June 2025, including instructions on how to reproduce the problem. Apple acknowledged receipt a month later and stated that it was investigating the matter.<\/p>\n\n\n\n

The process then dragged on for months. In March 2026, Apple informed the researcher that they had fixed the reported problem with a recent system change - but the vulnerability was still open. Murphy provided further information, whereupon Apple again stated that they were still investigating. In May, the pattern repeated itself: Apple asked that the vulnerability not be made public until the investigation was complete. Murphy's suggestion to temporarily suspend the creation of new alias addresses to limit the risk to customers apparently went unheeded. At the end of May, Apple finally announced that they intended to fix the problem with a security update expected in the coming weeks.<\/p>\n\n\n\n

After more than a year without a fix, the researcher decided against further delay. According to him, users deserved to know that attackers might be able to determine their normally hidden addresses.<\/p>\n\n\n\n

Why this is sensitive for those affected<\/h2>\n\n\n\n

The real danger lies less in the revealed email address itself than in what can be deduced from it. Numerous freely accessible personal databases allow an email address to be linked to further personal details. Anyone who relies on \"hiding their email address\" for security reasons - for example, to protect their identity - could be more exposed than they realize.<\/p>\n\n\n\n

This feature is rightly considered one of the most effective methods for protecting your real email address in everyday<\/a> use by using a separate, disposable address for each service. This very trust is called into question by the vulnerability. To make matters worse, Apple recently migrated the alias addresses to a separate domain called \"private.icloud.com\" - a move that unintentionally makes it easier for platforms to selectively block iCloud aliases.<\/p>\n\n\n\n

A data privacy feature under pressure<\/h2>\n\n\n\n

This case hits Apple where it hurts, as data privacy has been a key selling point for the company for years. Leaving a feature designed to deliver on this promise vulnerable for over a year hardly aligns with this claim. Until the announced security update is released and demonstrably closes the vulnerability, the situation remains unsatisfactory for everyone who relies on the "hide email address" protection. Whether the promised fix will hold this time remains to be seen \u2013 after all, Apple had already announced a fix once before, but the problem wasn't actually resolved. (Image: Apple)<\/p>\n\n\n\n