Apple's Hide My Email Leaks Real Addresses

Apple's Hide My Email feature can expose the real address behind it, according to a writeup on EasyOptOuts that reached 278 points on Hacker News. The feature exists so people can sign up for accounts without handing over a real inbox. A bug that reveals the address erases that guarantee for anyone who trusted the relay to hold.

The writeup describes how the anonymized address maps back to the real one. Hide My Email is marketed as a privacy layer, so a leak here breaks its central promise, not some minor edge case.

I build products that lean on other people's infrastructure for privacy claims too. This is a reminder that those claims are only as solid as the code behind them. If an app tells users it never sees their real email, that promise runs through whatever relay sits behind it. Inherit the relay, inherit its bugs. Don't put that promise in your threat model as guaranteed.

My bet is this isn't unique to Apple. Any relay that maps an alias back to a real address for delivery has the same class of bug somewhere, found or not. The writeup only reached this many people because of its run on Hacker News. The bug itself was probably sitting there long before 278 points made it visible.