10 ms·
Apple is about to make Hide My Email useless
- mortenjorck 4mo ago> Long story short: now both Sign in with Apple and Hide My Email aliases are going to be issued on the @private.icloud.com subdomain. This makes it much easier to ban all aliases without affecting non-relay mailboxes on iCloud mail. Could someone clarify why having Sign in with Apple and Hide My Email on the same domain would make a blanket ban easier rather than harder? What am I missing?
- BoorishBears 4mo agoI guess their thought process is, both alias and non-alias accounts use @icloud.com You were always able to reserve a normal icloud email address just like you would a GMail account, so banning all icloud email addresses would be banning non-alias Apple customers That being said, I'm not convinced anyone who wanted to ban aliases couldn't have already. The alias emails look weird enough I'm guessing you could ban them with few false positives.
- SXX 4mo ago> The alias emails look weird enough I'm guessing you could ban them with few false positives. While this is true not all of them been weird. Some can be just word + number + word without dots or underscores. Also blanket banning whole domains is just much easier and already done for temporary emails. No false positives.
- BoorishBears 4mo agoThe point of the article is previously banning Apple's temp domain would create many false positives (all the normal Apple registered emails that chose @icloud.com during setup)
- w10-1 4mo agoBefore, the emails were "me@icloud.com", the default for all apple users. There was no way to distinguish normal emails from generated private emails. Now, they will be "blah@private.icloud.com", so it will be easy to ban the generated/private email that reduces the ability to associate logins across services. Unclear why Apple would shoot themselves in this way; I hope it's not Ternus complying with anti-privacy.
- utilize1808 4mo agomaybe to avoid getting their legitimate email servers banned by other servers since they host (i.e. being exploited) a growing number of spam accounts.
- SXX 4mo agoYou cant send mail from Hide My Email aliases. They are only work one way.
- nielsbot 4mo agoYou can send from Hide My Email addresses: https://support.apple.com/guide/icloud/use-hide-my-email-in-mail-mmca4d729d79/icloud#mm2ee7ee328e https://support.apple.com/guide/icloud/use-hide-my-email-in-... I think I've also seen this in Mail.app but that's not shown on this page.
- SXX 4mo agoWow my bad I wasnt aware its possible. I remember someone in HN comments complaining about it being one way only back in 2024. UPD: apperently this supposedly only work if someone message you first. So you still cant spam from aliases.
- nielsbot 4mo agoOk thanks. Directions are misleading then.
- gobip 4mo agoApple was generating (something)@icloud.com whenever you used that service. Now, it will use (something)@private.icloud.com instead. So you can ban this subdomain instantly, knowing people will be "hiding" with this service by default. It's like blocking anondaddy, simplelogin etc but not protonmail.
- giancarlostoro 4mo agoIf your website will block me out because I used a privacy friendly email, I want nothing to do with your website.
- vinni2 4mo agoUnfortunately sometimes we are at some specific provider’s mercy for whatever reason like lack of appropriate alternatives.
- MoonWalk 4mo agoCOUGHredditCOUGH
- SV_BubbleTime 4mo agoIDK I’ve appreciated Reddit killing off good features like old version, putting a time-lock banner on mobile while logged out, trying to block VPNs when logged out, etc. I want that company devalued and bought by Verizon or AOL to die a Yahoo death. What is insane to me is how few people realize their stock has a higher P/E than nVidia… and it isn’t because of some bullshit minor AI data deals. It’s a youth-forward narrative machine, and everyone knows it.
- SXX 4mo agoRedReader still works. For now.
- deleted 4mo ago[deleted]
- pjerem 4mo agoFWIW, old.reddit.com is still there and working
- giantrobot 4mo agoShh, don't remind them.
- nerdjon 4mo agoI would bet that doing so would be a pretty quick way to have your app pulled. They already require that you use Sign in with Apple, I would think that it working fully is also a requirement?
- layer8 4mo agoHide My Email isn’t particularly related to apps. You can use it on any web form that asks for your email address, or as the sender of any email message you send using Apple Mail.
- nozzlegear 4mo agoYou can use Hide My Email on any website though, whereas Sign In with Apple is limited to just those websites and apps that support it. Sign In with Apple isn't nearly as popular on the web, so it's a lot easier to just ban "@private.icloud.com" from your web service there.
- deleted 4mo ago[deleted]
- deleted 4mo ago[deleted]
- deleted 4mo ago[deleted]
- pseudalopex 4mo ago> They already require that you use Sign in with Apple, I would think that it working fully is also a requirement? They require apps offer a service which meets their privacy requirements if they use any 3rd party or social login service.[1] And apps could block private.icloud.com for email and not Sign in with Apple. [1] https://9to5mac.com/2024/01/27/sign-in-with-apple-rules-app-store/ https://9to5mac.com/2024/01/27/sign-in-with-apple-rules-app-...
- jawiggins 4mo ago> If you use iCloud+ and Hide My Email, there is still time to generate more aliases on @icloud.com as the change has not yet landed and the rate limit for creating aliases is at least 30 per hour. Part of the reason to use Hide My Email was that it made keeping myself private hassle-free. Making a system to pre-generate values and then catalog them for later use is quite the hassle.
- SXX 4mo agoYep, but I still generated some for myself just in case and fellow hackers can do the same if they want to. iCloud+ was the best $1 / month custom domain email and email alias service with 100GB of E2EE cloud drive. Obviously it will be sad to see it enshittified for seemingly no reason.
- reaperducer 4mo ago[flagged]
- SXX 4mo agoYou could've at least checked my profile... Problem is that using of own domain is creating huge privacy and cybersecurity risk since you can track all the person profiles across all the databases ever leaked. Its nice as vanity item, but it's better not to use same domain across banks, online forums and porn sites. ;-)
- chucksmash 4mo ago1. Create a domain like myquickanonemailaccount.com. 2. Use the domain exclusively for hosting your own mail, but create a fake account creation page that just temporarily doesn't work. 3. As an added bonus, should you one day get a subpoena for information about one of your site user's online activities, you've got like a 24 hour head start on fleeing the country.
- choilive 4mo agoThere are no true scotsman
- risyachka 4mo agoShameless plug - I created a chrome extension that allows to create unique email addresses that forward to your real inbox. It uses Cloudflare email routing, simplifies creating/labeling of new addresses and keeping track of them. Always 1 click away. The addresses are pre-allocated and recycled when deleted so creating a new one is faster that with Apple's hide my mail. https://github.com/webmonch/hide-my-mail-cloudflare https://github.com/webmonch/hide-my-mail-cloudflare
- rafram 4mo agoDoesn't owning the domain kind of defeat the point?
- drnick1 4mo agoNot really, at least if you register the domain anonymously. You get unlimited emails, and I assign one to each website or registration.
- SXX 4mo agoWith cloudflare you can also just setup catch-all and be done wirh it. I personally doing catch-all already, but problem is that using your own domain for website registration basically gives everyone unique id to eaaily connect all the information that ever been leaked for your accounts and something always gets leaked. Not a very good idea for privacy.
- risyachka 4mo agoThe biggest upside for me of having separate labelled mailboxes is I can use one, delete it later and never receive mail from it again.
- SXX 4mo agoMy email addresses been public for years and spam was never a big issue. But yeah it mostly opposite problem I would say - spam filters eat usefull stuff sometimes. Just today I found one more job related email in spam, but its from public mailbox damn. Privacy is kind a bigger issue and having aliases on icloud is just much more convinient than having 10 accounts.
- wxw 4mo agoI pay for Fastmail just for masked email and its integration with 1Password.
- darknoon 4mo agoI frequently run into scenarios where it won't let me generate the email within 1password on a website, and I have to go to Fastmail and then manually do it. Is this something you have bene able to work around?
- mthoms 4mo agoSame problem here. I sure wish 1Password + Fastmail would let you generate them within the 1Password app without requiring a browser sign-up page in the middle.
- wxw 4mo agoUnfortunately not really. I scripted something to hit Fastmail’s API + 1Password API to generate emails and make accounts in these scenarios. But it’s still annoying.
- doctorpangloss 4mo agoemail isn't really a decentralized system at all. Google, Microsoft and Amazon own e-mail delivery. Perhaps Google ads customers complained that they could not correlated private @icloud addresses, and we are now witnessing the consequences. What Apple got in exchange from Google, I don't know, I'm sure it is related to their Siri deal.
- rafram 4mo ago[citation badly needed]
- SXX 4mo agoCome on. Most likely this is just a result of some manager pushing for "improvement": "Why we have two different privacy email alias systems? Lets make unified one, save on maintenace and I get promotion". And might be there just no one remain as owner of feature to explain them why its bad idea.
- Razengan 4mo agoOh fuck. I love Hide My Email and it's been the best feature about iCloud ever since it came out. It's actually useful compared to Gmail's useless "yourrealaddress+alais" that gives away your actual email anyway, and it helped me catch quite a few spammers/data sellers. Hide My Email addresses already have a peculiar format that others could guess, and some do block those, and there's no reason to add a blatant "private." tag. This is a win for privacy-intruders, not users, just like Apple's iCloud Keychain API that has allowed Facebook, TikTok etc. to secretly track users across multiple devices and device reinstalls for years.
- jjice 4mo agoFWIW it's not a gmail thing for privacy, but rather just part of the email spec. RFC 5233 talks about it. https://www.rfc-editor.org/info/rfc5233/ https://www.rfc-editor.org/info/rfc5233/
- 9dev 4mo agoDid the RFC editor get a makeover recently? It looks familiar, but also kinda… polished. Neat.
- autoexec 4mo agoWhen looking at a document I think it's all distracting/annoying. I still prefer plain text https://www.rfc-editor.org/rfc/rfc5233.txt https://www.rfc-editor.org/rfc/rfc5233.txt
- technothrasher 4mo agoIt all dates back to the Andrew Messaging System at CMU, developed in the 1980's. Originally the format was "<username>+<keyword>+<args>@example.net" where the mail server would interpret the keyword and arguments to route the message in whatever unique way that keyword would dictate (e.g. bob+dist+~/mailinglist@example.net would read the file mailinglist in Bob's home directory and deliver the email to addresses listed in it). If the keyword was not recognized, it would just deliver normally. So bob@example.net and bob+alias@example.net were equivalent, and could be used to filter after the fact if desired.
- Cider9986 4mo agoDetermined sites could already easily do this. Just detect the patterns used. I agree it's a useless change though. heave_balks_0g@icloud.com It shouldn't matter for the sign in with apple because sites are already expressly supporting that. Email aliasing is hard because you want privacy from a herd of users, but then you're locked into that ecosystem versus a domain you control has no herd, but the upside is no lock-in.
- tehwebguy 4mo ago> Determined sites could already easily do this They already DO do it, I don't know how they're currently determining it
- keane 4mo agoI think the NYT might be one detecting them which is funny because their editorial staff have promoted the use of aliases.
- SXX 4mo agoNot all aliases it generated look like this, some look like these: viods01crew@icloud.com methyl.brick1h@icloud.com In any case fact that some services banned alies is not the reason to make them completely useless instead of making them better. Apple is one of few companies that ia able to push for this with market share.
- deleted 4mo ago[deleted]
- frollogaston 4mo agoMaybe they've started seeing sites ban @icloud.com addresses
- msdz 4mo agoWhich has more market pull: Some web site or Apple?
- frollogaston 4mo agoiCloud email isn't very popular. I always have to spell it out verbally if someone asks, and sometimes they end up emailing @gmail.com anyway.
- Barbing 4mo agoAlmost surprised it lasted this long but quite disappointing
- jamesreadsnews 4mo agoI guess the new subdomain address implies a paid iCloud user, not a free mail freeloader, and that could be a positive thing.
- getcrunk 4mo agoOkay but banning private relay emails would also mean your site is blocking Apple sign in?
- 9dev 4mo agoThat was always opt-in from the sites, and many never bothered - me included, because I refuse to pay Apple $99 per year for the privilege to offer easier authentication to their users.
- elcombato 4mo agoThe rate limit seems to be 20/hour and not 30/hour as mentioned in the article.
- righthand 4mo agoEmailfake.com Fastmail also has wonderful random email functionality you can link up to your Bitwarden client or use the Fastmail API.
- vslira 4mo agoWhere do I sign to show my opposition to this change? Hide My Email has been essential to keep my digital life protected from abusive mail lists and frankly one of the features that make me associate icloud with a premium service
- deleted 4mo ago[deleted]
- KiDD 4mo agoI guess I don't understand the concern... what does it matter if a different domain is used for Sign in with Apple and Hide My Email?
- chatmasta 4mo agoRight now it’s the same @icloud.com domain as normal personal emails. Now all auto-generated emails will use a separate domain name, so sites can block emails with that domain, without worrying about blocking people’s main personal email.
- 9dev 4mo agoBecause many sites check the domain part of your email address against a blocklist, which contains entries like trashmail.com to prevent users from signing up with ad-hoc throwaway accounts. They don't want that, because they'd like to get a proper lead they can either track, sell, or reach out to. Now Hide My Email allowed you to do just that: Create an account with an email that wasn't tied to your identity, and that you could just decommission if you didn't need it anymore. Sites had no way to detect these either, because all of the randomly generated addresses Apple provided you with just ended in @icloud.com, which is also used by tons of regular accounts - so if you blocked this domain, you'd invariably preclude millions of people from your service. But by separating the domains, sites can simply add private.icloud.com to their trash mail blocklist, preventing the use of Hide My Email, while regular @iCloud.com addresses will continue to work. It makes the entire service useless at once.
- k1next 4mo agoFor me personally, Hide My Email is binding me to the Apple ecosystem more than iMessage (but I'm European).
- Barbing 4mo agoIt’s unsettling, you’re either an iCloud customer for life or hundreds of logins could break.
- weberer 4mo agoNothing breaks when you switch. You just can't create more private icloud addresses. I recently switched back to Android and can still use my old icloud logins.
- SXX 4mo agoBut what happen if you stop paying $1 / month?
- Barbing 4mo agoThanks, undocumented? Meanwhile reddit’s answer: > In what universe if you stop paying for a service you can still access the resources of that service? Basic common knowledge. But on MacRumors: “Update: So I let my iCloud+ account expire. When this happens you lose access to managing ALL your Hide My Email emails. Yet you can't even see what the Hide My Email addresses are any longer. But, people can still send emails to those emails. However, you apparently cannot reply to the emails with the Hide My Email address. This is troubling...” https://forums.macrumors.com/threads/what-happens-to-hide-my-email-emails-if-you-cancel-icloud.2373055/ https://forums.macrumors.com/threads/what-happens-to-hide-my...
- kylehotchkiss 4mo agoDid Hide My Email addresses cause problems for deliverability for actual emails/users on iCloud?
- deleted 4mo ago[deleted]
- smth-smth-ai 4mo agosimplelogin from Proton works great, can recommend; for Uber I generate uber.random-word@simplelogin.com, for Slack slack.random-word etc to easily see who leaked my email
- jonotime 4mo agoPro tip for doing something like this without apple. Buy or get a cheap domain name. Create a subdomain on it and have it catch and forward all messages to you when sent to that sub. For example: nytimes@mailsub.example.com -> jono@gmail anything-else@mailsub.example.com -> jono@gmail You dont even need to materialize aliases at all.
- switz 4mo agoI do this. The awkward thing is when I am in person or on the phone and have to explain that my customer email address is [their_business_name]@my_weird_domain.tld But the people usually just nod along. The other downside is that it's forward-in only, wish I could proxy responses without setting up a whole new inbox (and outbox).
- snark42 4mo agoYou can proxy responses with a ton of e-mail clients, even Gmail supports it once you verify you can get a message sent to that address.
- shoo_pl 4mo agoNot really, this only works for other emails hosted by Gmail (including Workspaces) or if you supply SMPT that will send those emails. If you use simple email forwarding from your DNS provider, you don't have SMPT server to give to gmail:/
- phi0 4mo agoGoogle will happily send from smtp.gmail.com, after verifying that you own that email. You won’t get DKIM, but Google’s reputation is enough to make the mail land in people’s inboxes.
- chuckadams 4mo agoThey act as if I discovered fire when I give them a plussed address.
- trollbridge 4mo agoIn the flip side, someone who blocks private.iCloud.com will block the ability to do SSO with Apple, thereby cutting themselves off from Apple’s ecosystem.
- mdasen 4mo agoNot really. You could allow private.icloud.com only if they're using Apple's SSO. If someone tries to create an account not using Apple's SSO, then you don't allow private.icloud.com email addresses.
- abujazar 4mo agoAlmost all of my iCloud relayed addresses are already @privaterelay.appleid.com, and they've been working perfectly. So I don't expect this to change any time soon.
- catgirlinspace 4mo agoThat domain is only used for Sign in with Apple.
- teekert 4mo agoI use Proton aliases everywhere...Well not everywhere, there are indeed quite some places that don't accept a passmail.net address... So I can imagine this becoming a useless feature, at least on some sites. Btw I only use these aliases for sites where I don't mind loosing the login, otherwise it would the mother of all lock-ins... Would have been nice if I could opt for aliases on my own (secondary?) domain... At least then I could still move them (using wildcards or some exported list).
- sxg 4mo agoYou can create custom aliases on your own domain. I do this for every log in and am migrating old emails to my custom domain aliases.
- deleted 4mo ago[deleted]
- deleted 4mo ago[deleted]
- Mindwipe 4mo agoUrgh, that's a huge downgrade. What a shame.
- frollogaston 4mo ago"Useless" is a leap. The kind of site that would block private relay emails is the kind that was already getting my burner anyway. The private relay is for sites I want to hear from, but also want a failsafe in case they're hacked later.
- deepfriedbits 4mo agoExactly. No reasonable business will ban emails from this subdomain.
- throwuxiytayq 4mo agoThankfully, we live in an unprecedented time of reasonable businesses lead by reasonable people. Close one. Nice save.
- frollogaston 4mo agoThe unreasonable ones get my burner, so whatever
- throwuxiytayq 4mo agoYes, and Apple's "burner e-mail" service is about to become ineffective.
- stormed 4mo agoI wonder if the existing hidden emails I already have in iCloud will be changed over too. If that's not the case, I'm just going to use one of the 50 throwaway addresses I already have.
- pseudalopex 4mo agoThe announcement the article linked said Existing addresses on the legacy domains will continue to work and forward mail to users without interruption.
- stormed 4mo agoGuess I missed that part, my mistake
- nate 4mo ago[flagged]
- nozzlegear 4mo agoMy dog thinks it's because we're running low on milkbones, but my cats aren't convinced.
- nate 4mo agoah. techcrunch must have alluded to you not having milkbones https://techcrunch.com/2026/06/16/apple-plans-to-change-its-hide-my-email-privacy-feature-that-could-make-it-less-effective/ https://techcrunch.com/2026/06/16/apple-plans-to-change-its-...
- pseudalopex 4mo agoThe TechCrunch article said Apple turned over the real account information. And the older article said this was in response to a request. Not a warrant. Hide My Email hid nothing from the Trump administration in this case.
- ziml77 4mo agoFastmail still generates theirs with @fastmail.com. And 1Password has an integration with them to quickly generate an address when creating a new account somewhere.
- nate 4mo agoI guess I'll go back to mailinator. That thing has 100s of aliases by the way for some that don't use that yet. Great service. Not guaranteed private really so don't depend on it for that. (Though if you use a strong has for a hash@mailinator.com address, is it pretty secure for "email purposes"?)
- outlore 4mo agoI highly recommend either SimpleLogin or Fastmail aliases. The latter are superior because they can be used to reply directly to any received email without needing to set up reverse aliases. When you own your own domain, the switching cost between providers is small. You can make a dedicated domain just for aliases Both SimpleLogin and Fastmail have excellent integration with password managers as well
- danpalmer 4mo agoHide My Email is fundamentally broken in two major ways: 1. Services those emails are used with cannot unilaterally send email to them. They must pre-register how they will send email to them, which breaks services with third-party relationships such as online retail with payment processors or shipping companies. Users don't like not receiving shipping notifications, and users don't like not seeing invoices or at worst missing bills and going into debt because the payment processor can't contact them. 2. Users signing up for services struggle to re-use accounts. If the account is identified by email, as most are, figuring out the private email used when you signed up on your iPhone, when you later try to sign in on the web, basically impossible for your average user. Users end up with mulitple accounts, likely one on their real email anyway, and it's a support nightmare for both the user and the service provider. Does this increase user privacy? Yes. Does it increase user control? Sure I guess. But it does so at the cost of basic UX and service expectations, and likely makes the overall experience and control worse for users in many cases. So why is this change being made? My take is that it's so that it's easier for services to exclude Hide My Email sign-ups. That way the bad UX is gone, and the service provider looks like the bad guy rather than Apple.
- deleted 4mo ago[deleted]
- vanchor3 4mo ago> Services those emails are used with cannot unilaterally send email to them. They must pre-register how they will send email to them, which breaks services with third-party relationships such as online retail with payment processors or shipping companies. You're talking about "Sign in with Apple" email addresses here, not Hide My Email. Anyone can send to Hide My Email addresses.
- wpm 4mo agoIf you have iCloud Keychain enabled you don't have to "remember" a sign-in at all. Flip a toggle, say "Yes" when Safari offers to remember the new password you generated for the fake email you generated in a drop down menu, and you're a FaceID/TouchID away from auth. My 80 year old uncle can manage this. I have been a happy Hide My Email user for years. This is simply not a problem, and even for normies it's no more a problem than "can't remember password at all".
- huey77 4mo agoThis is a big downer for me, I have started using Hide My Email religiously.
- sharts 4mo agoJust use fastmail
- rogual 4mo agoI have a cron script which configures a today-only email address in Postfix. Mail sent to t20260617@foon.uk will reach me, but only for today. So, any time I'm giving away my email address against my will, which is most of the time, they get to spam me for exactly one day.
- WesSouza 4mo agoIt is limited to around 600 addresses, it’s already useless.
- SXX 4mo agoWell, 600 is probably more websites than most people ever use in a decade.
- dostick 4mo agoHow is that different from “privaterelay.apple” that has been used?
- daft_pink 4mo agoThis is so dumb. They randomly generate them anyways it’s not like they are likely to collide with other users. They should allow you to use your own domain for private relay but it doesn’t let them build a moat so they wont
- deleted 4mo ago[deleted]