Apple's Hide My Email vulnerability reportedly exposes users' real email addresses
A newly disclosed privacy vulnerability in Apple's Hide My Email feature can reportedly allow an attacker to uncover the real email address behind a generated alias. According to the researcher who found the bug, it was responsibly disclosed to Apple more than a year ago but remains unpatched, and independent testing has verified the issue.
10 replies
This is a good write up. Thanks for sharing. I use “hide my email” sometimes and it’s important to know that it’s possible to find the real address behind it.
I use DuckDuckGo’s email hiding service. I have had sites reject signing up with a @duck.com email address. So services will definitely move to block Apple’s new subdomain only for aliased email addresses.
Same. Duck.com is blocked for a lot of sites. Many block it
Just get a cheap domain and configure a catch-all redirect. Obviously not a solution viable for normies, but should be easy for many Lemmy users.
Almost every website will accept a custom email domain
It depends on the domain. I intentionally have a bizarre .party domain I use as a shibboleth to see if a company is worth using. If they don’t have a way to use my .party email, I assume they are lazily run and based their decisions either on outdated nonsense or are a gross data mining operation I should avoid anyway.
At least my .club domain worked for everything except deepseek so far
Penguin.club.xxx.net.bing
addy.io offers a free tier if you're looking for an alias provider/alternative.
Wanted to use it but couldn't sign up bc it didnt know my domain. They sent an automatic email to which I should reply to, but I never got a confirmation. Yes, I replied with the same address I've signed up with. That was, however, months ago so I should give it another try.
I don't use if with my own domain so I can't speak for success with that. I've used them for a long time for my occasional alias needs, before they renamed from anonaddy iirc.