Overview of the Hide My Email Vulnerability
Apple’s Hide My Email feature, designed to protect user privacy by generating disposable email addresses, is reportedly suffering from a bug that exposes users’ real email addresses. This discovery was made by researcher Tyler Murphy, who claims to have alerted Apple to the issue over a year ago without receiving a fix. According to Murphy, all attempts to exploit the bug have been successful, raising serious concerns about the reliability of this privacy tool.
The Bug and Its Discovery
Researcher’s Findings and Warning
Tyler Murphy, co-founder of the paid data-removal service EasyOptOuts, found the vulnerability and verified it through limited tests. He told the outlet that 100% of Hide My Email addresses tested were exploitable, though the full scope of the issue remains unknown. The exact details of the vulnerability have not been publicly disclosed to prevent exploitation.
Apple’s Response (or Lack Thereof)
TechCrunch reached out to Apple for comment on the bug but has yet to receive a response. The company’s silence adds to concerns about its commitment to addressing privacy flaws in a timely manner.
Implications for User Privacy
Murphy highlighted that publicly accessible people-search sites make it easy to link an email address to other personal details, so users relying on Hide My Email for safety may be at risk. The bug undermines the feature’s core purpose of providing online anonymity, potentially exposing users to data broker aggregation and other privacy invasions.
Apple’s Track Record on Privacy Promises
Past Privacy Issues
Apple has faced similar criticisms before. In 2022, the company was sued after reports indicated that iPhone apps continued to send analytics data to Apple even when the iPhone Analytics privacy setting was turned off. In 2023, researchers found another privacy feature—designed to anonymize Wi-Fi connections via randomized MAC addresses—was exposing real MAC addresses instead.
These incidents, combined with the current Hide My Email bug, call into question Apple’s reputation as a champion of user privacy. The company has built much of its branding around privacy, so resolving this issue expediently is crucial for maintaining user trust.