Apple Finally Fixes Hide My Email Vulnerability After a Year

404 Media says Apple has fixed a vulnerability in Hide My Email that would allow anyone to find your real email address after knowing about the issue for over a year.

Reportedly, Apple deployed the fix on July 3.

Hide My Email is an email aliasing service that Apple offers as part of their iCloud+ cloud storage offerings. For $0.99, iCloud+ users can get the service and have near-unlimited @icloud.com email address aliases, making them unlikely to be blocked since they're using a highly popular email domain and providing an easy way to keep your real email hidden.

However, 404 Media broke the story back on July 1 that your real email address that's supposed to be hidden could be discovered by anyone.

They didn't reveal the details of the exploit, but Tyler Murphy, co-founder of EasyOptOuts and the security researcher who reported it to them had already reported it to Apple over a year ago, said it still hadn't been fixed yet at the time:

We reported the issue and replication instructions to Apple over a year ago. We don't know why it hasn't been fixed, but we don't feel comfortable waiting any longer. Hide My Email users deserve to know that it may be possible for attackers to discover their hidden email addresses.

Apple also was planning to change newly-generated Hide My Email addresses to use the domain @private.icloud.com instead of @icloud.com, making them significantly easier for services to block, although as of the writing of this article, newly-generated Hide My Email addresses still use the @icloud.com domain.

Now that the issue is fixed, in a statement to 404 Media, Tyler Murphy and Ben Weiner revealed some more details about how the exploit works:

For many major email hosts, the leak was triggered simply by an email being automatically rejected as spam, even if it was a legitimate message. Such emails probably didn't make it to your inbox, so you can’t review your spam folder to learn whether you were affected.

Apple is currently facing a class-action lawsuit over the reported vulnerability. Apple is being accused of misleading its customers about the privacy of Hide My Email.

If you use Hide My Email, you might want to generate new email aliases for the services you use since your real email may have been leaked in logs before the fix was rolled out.