A vulnerability in Apple's Hide My Email service can reportedly expose users' real email addresses linked to anonymous accounts. The flaw undermines the feature's core privacy promise.
Apple's Hide My Email, a privacy feature bundled with iCloud+ subscriptions, generates unique email addresses to shield users' primary inboxes from trackers and unwanted contacts. Security researchers have discovered a vulnerability that can connect these anonymous addresses back to real email accounts.
The flaw reportedly allows an attacker to link masked email addresses to their corresponding real addresses through the service's infrastructure. This directly contradicts Apple's privacy assurances and defeats the purpose of using the feature.
Hide My Email launched in 2021 as part of Apple's broader privacy push. The feature generates random aliases that forward messages to users' actual inboxes, allowing them to maintain anonymity while signing up for services or communicating online.
Apple has not publicly acknowledged the vulnerability or released a statement addressing the findings. The company has a history of patching security flaws, but the timeline for fixing this particular issue remains unclear.
The discovery raises questions about the robustness of Apple's privacy tools. While the company markets itself as privacy-focused—particularly in contrast to competitors—flaws like this demonstrate that announced features do not always deliver the promised protection.
Users relying on Hide My Email for privacy-sensitive activities may want to reassess their approach until Apple addresses the vulnerability. The incident also highlights the importance of independent security research in validating privacy claims made by major tech companies.
Apple has not provided details on how many users might be affected or when a fix will be available.
A new browser fingerprinting vector has emerged in Chromium 148, where the Math.tanh function produces different results across operating systems. This discrepancy can be exploited to identify a user's underlying OS without explicit permission.
Kaseya is hosting a webinar on strengthening MSP resilience through SaaS backups and business continuity strategies. The session focuses on how recovery capabilities prove critical when security defenses are breached.
A new variant of RedHook Android malware abuses Wireless ADB (Android Wireless Debugging) to gain shell-level privileges without requiring a computer connection. This represents a significant escalation in the malware's capabilities.
Fraudsters are creating convincing counterfeit news articles impersonating major publishers like the Guardian to direct social media users to bogus investment sites. The fake stories feature fabricated celebrity endorsements and financial narratives designed to establish credibility.