4 ms·

Apple Fixes Hide My Email Vulnerability After 404 Media Coverage

134 points by arto 3mo ago

lapcat 3mo ago
> Apple told 404 Media it deployed a patch for the issue on July 3, which the company says has fully resolved the issue. > Now Apple says it has been fixed, we can add that, in simple terms, it required sending a target Hide My Email user a message that got rejected as spam. I would note that Mac Mail app (I haven't tested iOS Mail) still has an Apple Account email address disclosure vulnerability, though this requires the user to reply to a maliciously crafted email. The vulnerability affects all users of Mail app, even if they don't use Hide My Email! https://lapcatsoftware.com/articles/2026/7/9.html https://lapcatsoftware.com/articles/2026/7/9.html
- philipwhiuk 3mo ago
  > The vulnerability affects all users of Mail app, even if they don't use Hide My Email! If they don't use "Hide My Email" trivially replying discloses their email?
  - deleted 3mo ago
    [deleted]
  - layer8 3mo ago
    It will disclose your Apple account address even when you received the email on a different account in the Mail app.
argee 3mo ago
I have a question I wasn’t sure how to ask HN that is tangentially related to this. I’m the developer of an app where people can add other users to their workspaces, via email. The way this currently works is that your email gets added to the workspace and then when you log in with that email, you get access. Now, this of course fails with “hide my email”. What’s the appropriate/standard way to handle this? Should I be using urls with invite codes instead of associating the email itself with access? I’m a little hesitant to do that since the code would have to persist in session and the business logic would have to occur on the login portal, since the mobile/desktop apps don’t share web cookies. Is deep linking the answer?
- Rumudiez 3mo ago
  email addresses are not good primary or foreign keys, so yes you should be using IDs of one form or another. this shouldn't affect your authentication scheme (cookies vs bearer tokens or what have you), just authorization. if you've muddied the two, you'll have some debt to resolve and this issue could just be a valuable tip-off to that
  - HawtAds 3mo ago
    I think OP is referring to the initial sign up based on an invite link, not the database storage itself. It depends whether you want to check the invite code against the invitee's email. It very much depends on the application. For most use cases, just verifying the code is fine and accept any email addresses that posses it. Essentially ask yourself this, if you change the UI a bit and allow any user to sign up with any email, and the workspace joining is done via a code they enter after login, is that acceptable for your product design and security posture.
    - Rumudiez 3mo ago
      okay, I have that use case as well and it is driven by an invite code. it works well for new sign-ups and existing users, and you can even just let the user copy the link and send it themselves if they're on discord or something else. no email required for pseudonymous sharing, bonus feature to send an email invite if it is given
- layer8 3mo ago
  In general it's bad practice for a user to expose someone else's email address to an application provider without consent (email providers being the one necessary exeception, of course), therefore I would abandon that approach in any case. You could implement read-only access to a workspace via a generated link (containing a UUID or similar), like e.g. a Dropbox link. You would store the link IDs with the workspace, and you can implement (user-configurable) link expiration and such. Since links are shareable, these wouldn't be personalized to the recipient. A recipient who wants more than read-only access would still have to create an account with you and ask the workspace owner for write access.
a9ex 3mo ago
So how did the vulnerability work exactly?
- culi 3mo ago
  https://archive.ph/O4pKL https://archive.ph/O4pKL
  - j79 3mo ago
    Looks like that was the original article, which didn't have much details about how the exploit worked. > 404 Media is not revealing the exact details of the vulnerability because it can still be exploited as of Monday, when 404 Media verified the issue with one of our own hidden email addresses. However, based on the current article: > Now Apple says it has been fixed, we can add that, in simple terms, it required sending a target Hide My Email user a message that got rejected as spam. “We don't know how often hidden email addresses were leaked in email logs. For many major email hosts, the leak was triggered simply by an email being automatically rejected as spam, even if it was a legitimate message. Such emails probably didn't make it to your inbox, so you can’t review your spam folder to learn whether you were affected,” Murphy and EasyOptOut co-founder Ben Weiner said in a new statement. My guess is that if an e-mail was rejected as Spam, the response had the actual e-mail included. However, based on the next paragraph: > “The bug that caused Apple's Hide My Email to leak hidden email addresses to senders has been fixed. However, we don't think the risk to Hide My Email users has been eliminated. Because non-malicious emails could bounce, revealing your hidden email address, and because mail transfer logs are often retained, we'd assume that any hidden email address linked to a Hide My Email address created before July 7, 2026, may have been exposed and could still be in third-party logs,” they added. It seems even bounced e-mails could leak your actual e-mail.
    - nashashmi 3mo ago
      What about requesting delivery receipts? That could trigger an auto-send from the masked email service.
- tjames7000 3mo ago
satvikpendem 3mo ago
But Apple did not yet walk back that they wanted a single dedicated domain for private emails, privacy.icloud.com, such that it'd be easy for any host to block them.
- halJordan 3mo ago
  I'm honestly getting tired of us requiring big corps to do everything for us. Use the private domain. Dont have the account if they block it. End users and consumers need to bite the bullet.
  - lern_too_spel 3mo ago
    Private domains aren't really private because they can be matched across data leaks. Fine for tracking senders though.
js2 3mo ago
> Now Apple says it has been fixed, we can add that, in simple terms, it required sending a target Hide My Email user a message that got rejected as spam. Frustratingly vague. I was unable to reproduce when the original article was posted. I did not test exhaustively, but I was able to get HME to reject messages in various ways (mostly by sending oversize messages) and none disclosed my real address because they were rejected before any rewriting to the final address occurred. And in looking at messages that were delivered, I didn't see any additional SMTP servers in the path that would reject the message. The most I was able to leak was a DMARC header showing my real domain, but even that only occurred when I replied to an HME email from my real (non-icloud.com) domain. When I updated HME to use my icloud.com address, even that leak went away (but it did make it clear that HME was not sanitizing message headers). Maybe if you have HME setup to forward to a non-icloud.com domain and that domain's SMTP servers rejected the message as spam, I can see how this could occur. But if forwarding to an icloud.com address, no way this should've been able to happen in the first place. I wish they'd included a sample message including full headers to see the vulnerability in action. Where in the delivery path was the bounce being generated? I want more details.
- tjames7000 3mo ago
  We'll publish more details soon. In short, emails that triggered 550 5.7.1 or 552 5.7.0 were what we saw the most. 550 5.1.1 was also a problem in the real world, but not possible to exploit. The error message contained the meant-to-be-hidden address. We don't know whether attachment-related rejections or other rejections, e.g. for a full inbox, were a problem. Apple fixed most of the issues on July 2 or July 3, so if you were testing after that, you may have been too late. These are basically the reproduction instructions we provided with our initial report: 1. Send a spammy email to the Hide My Email address. Or send an email that doesn't strike you as spammy and hope that the email is rejected as spam anyway. 2. If the email is rejected SMTP code 550, look at the long description field and observe the real email address. 3. If the email wasn't rejected by the email server as spam, try again with a spammier email or different email. I think that once you've identified a message that's rejected as spam consistently, you can keep using it. Post-fix, we're realizing that it seems like emails forwarded via Hide My Email bounce as spam at higher rates than the same emails sent directly. Which could explain why we were getting bounces for non-spam transactional emails sent only to paying customers, and why the bounces were only happening for icloud addresses. The issue may have been more prevalent than someone might assume, given typical bounce rates.
sitzkrieg 3mo ago
apple privacy is mostly marketing proven again
- dzhiurgis 3mo ago
  Kinda. Whenever I try to use hide my email on any more of a serious service - it never registers me.
hulitu 3mo ago
> Apple Fixes ... After ... Media Coverage Like always. Apple fixes vulnerabilities _if_ and _after_ they are publicly published.
starryrbs 3mo ago
[flagged]

134 points by arto 3mo ago

> Apple told 404 Media it deployed a patch for the issue on July 3, which the company says has fully resolved the issue. > Now Apple says it has been fixed, we can add that, in simple terms, it required sending a target Hide My Email user a message that got rejected as spam. I would note that Mac Mail app (I haven't tested iOS Mail) still has an Apple Account email address disclosure vulnerability, though this requires the user to reply to a maliciously crafted email. The vulnerability affects all users of Mail app, even if they don't use Hide My Email! https://lapcatsoftware.com/articles/2026/7/9.html https://lapcatsoftware.com/articles/2026/7/9.html

philipwhiuk 3mo ago
> The vulnerability affects all users of Mail app, even if they don't use Hide My Email! If they don't use "Hide My Email" trivially replying discloses their email?
- deleted 3mo ago
  [deleted]
- layer8 3mo ago
  It will disclose your Apple account address even when you received the email on a different account in the Mail app.

argee 3mo ago

I have a question I wasn’t sure how to ask HN that is tangentially related to this. I’m the developer of an app where people can add other users to their workspaces, via email. The way this currently works is that your email gets added to the workspace and then when you log in with that email, you get access. Now, this of course fails with “hide my email”. What’s the appropriate/standard way to handle this? Should I be using urls with invite codes instead of associating the email itself with access? I’m a little hesitant to do that since the code would have to persist in session and the business logic would have to occur on the login portal, since the mobile/desktop apps don’t share web cookies. Is deep linking the answer?

Rumudiez 3mo ago
email addresses are not good primary or foreign keys, so yes you should be using IDs of one form or another. this shouldn't affect your authentication scheme (cookies vs bearer tokens or what have you), just authorization. if you've muddied the two, you'll have some debt to resolve and this issue could just be a valuable tip-off to that
- HawtAds 3mo ago
  I think OP is referring to the initial sign up based on an invite link, not the database storage itself. It depends whether you want to check the invite code against the invitee's email. It very much depends on the application. For most use cases, just verifying the code is fine and accept any email addresses that posses it. Essentially ask yourself this, if you change the UI a bit and allow any user to sign up with any email, and the workspace joining is done via a code they enter after login, is that acceptable for your product design and security posture.
  - Rumudiez 3mo ago
    okay, I have that use case as well and it is driven by an invite code. it works well for new sign-ups and existing users, and you can even just let the user copy the link and send it themselves if they're on discord or something else. no email required for pseudonymous sharing, bonus feature to send an email invite if it is given
layer8 3mo ago
In general it's bad practice for a user to expose someone else's email address to an application provider without consent (email providers being the one necessary exeception, of course), therefore I would abandon that approach in any case. You could implement read-only access to a workspace via a generated link (containing a UUID or similar), like e.g. a Dropbox link. You would store the link IDs with the workspace, and you can implement (user-configurable) link expiration and such. Since links are shareable, these wouldn't be personalized to the recipient. A recipient who wants more than read-only access would still have to create an account with you and ask the workspace owner for write access.

a9ex 3mo ago

So how did the vulnerability work exactly?

culi 3mo ago
https://archive.ph/O4pKL https://archive.ph/O4pKL
- j79 3mo ago
  Looks like that was the original article, which didn't have much details about how the exploit worked. > 404 Media is not revealing the exact details of the vulnerability because it can still be exploited as of Monday, when 404 Media verified the issue with one of our own hidden email addresses. However, based on the current article: > Now Apple says it has been fixed, we can add that, in simple terms, it required sending a target Hide My Email user a message that got rejected as spam. “We don't know how often hidden email addresses were leaked in email logs. For many major email hosts, the leak was triggered simply by an email being automatically rejected as spam, even if it was a legitimate message. Such emails probably didn't make it to your inbox, so you can’t review your spam folder to learn whether you were affected,” Murphy and EasyOptOut co-founder Ben Weiner said in a new statement. My guess is that if an e-mail was rejected as Spam, the response had the actual e-mail included. However, based on the next paragraph: > “The bug that caused Apple's Hide My Email to leak hidden email addresses to senders has been fixed. However, we don't think the risk to Hide My Email users has been eliminated. Because non-malicious emails could bounce, revealing your hidden email address, and because mail transfer logs are often retained, we'd assume that any hidden email address linked to a Hide My Email address created before July 7, 2026, may have been exposed and could still be in third-party logs,” they added. It seems even bounced e-mails could leak your actual e-mail.
  - nashashmi 3mo ago
    What about requesting delivery receipts? That could trigger an auto-send from the masked email service.
tjames7000 3mo ago

satvikpendem 3mo ago

But Apple did not yet walk back that they wanted a single dedicated domain for private emails, privacy.icloud.com, such that it'd be easy for any host to block them.

halJordan 3mo ago
I'm honestly getting tired of us requiring big corps to do everything for us. Use the private domain. Dont have the account if they block it. End users and consumers need to bite the bullet.
- lern_too_spel 3mo ago
  Private domains aren't really private because they can be matched across data leaks. Fine for tracking senders though.

js2 3mo ago

> Now Apple says it has been fixed, we can add that, in simple terms, it required sending a target Hide My Email user a message that got rejected as spam. Frustratingly vague. I was unable to reproduce when the original article was posted. I did not test exhaustively, but I was able to get HME to reject messages in various ways (mostly by sending oversize messages) and none disclosed my real address because they were rejected before any rewriting to the final address occurred. And in looking at messages that were delivered, I didn't see any additional SMTP servers in the path that would reject the message. The most I was able to leak was a DMARC header showing my real domain, but even that only occurred when I replied to an HME email from my real (non-icloud.com) domain. When I updated HME to use my icloud.com address, even that leak went away (but it did make it clear that HME was not sanitizing message headers). Maybe if you have HME setup to forward to a non-icloud.com domain and that domain's SMTP servers rejected the message as spam, I can see how this could occur. But if forwarding to an icloud.com address, no way this should've been able to happen in the first place. I wish they'd included a sample message including full headers to see the vulnerability in action. Where in the delivery path was the bounce being generated? I want more details.

tjames7000 3mo ago
We'll publish more details soon. In short, emails that triggered 550 5.7.1 or 552 5.7.0 were what we saw the most. 550 5.1.1 was also a problem in the real world, but not possible to exploit. The error message contained the meant-to-be-hidden address. We don't know whether attachment-related rejections or other rejections, e.g. for a full inbox, were a problem. Apple fixed most of the issues on July 2 or July 3, so if you were testing after that, you may have been too late. These are basically the reproduction instructions we provided with our initial report: 1. Send a spammy email to the Hide My Email address. Or send an email that doesn't strike you as spammy and hope that the email is rejected as spam anyway. 2. If the email is rejected SMTP code 550, look at the long description field and observe the real email address. 3. If the email wasn't rejected by the email server as spam, try again with a spammier email or different email. I think that once you've identified a message that's rejected as spam consistently, you can keep using it. Post-fix, we're realizing that it seems like emails forwarded via Hide My Email bounce as spam at higher rates than the same emails sent directly. Which could explain why we were getting bounces for non-spam transactional emails sent only to paying customers, and why the bounces were only happening for icloud addresses. The issue may have been more prevalent than someone might assume, given typical bounce rates.

sitzkrieg 3mo ago

apple privacy is mostly marketing proven again

dzhiurgis 3mo ago
Kinda. Whenever I try to use hide my email on any more of a serious service - it never registers me.

hulitu 3mo ago

> Apple Fixes ... After ... Media Coverage Like always. Apple fixes vulnerabilities _if_ and _after_ they are publicly published.

starryrbs 3mo ago

[flagged]