Apple Hide My Email Vulnerability Exposes Real Email Addresses

[QuantumPulse]

I love how the 404 article is paywalled. 😂

 

[Robert.Walter]

Me too, I am using unique HideMyEmail addresses for all websites and logins, 407 by now. I only wish you could see the actual "label" (e.g. website name) on top of Apple Mail email view instead of just "To: Hide My Email"

I’ve wished for this enhancement too. It’s just logical and helpful.

 

[Unregistered 4U]

I love how the 404 article is paywalled. 😂

It wasn’t initially. BUT, now you know why they’re reporting it. 🙂 BETTER SUBSCRIBE TO US IF YOU WANNA KNOW! We deserve at LEAST your email address and DON’T give us a fake one! We’ll figure out what it is. We’re sure of it.

But, give us a hint, ok? We’ll give you a hint on how the security exploit that Apple won’t patch works. We found out what their real email address was by a method that rhymes with Grey Gold Bus.

 

[MikB]

I’ve noticed that if the HME address is forwarding to a custom domain (one hosted with iCloud+, in my case), that domain (after the @ symbol) is visible in the header of emails sent. So if the custom domain is your actual name, it would be visible to the recipient.

I imagine this is expected behavior. Which is why I’ve set HME to forward to an alias iCloud address rather than my custom domain.

The interesting part is not the X-Icloud-Hme header, that you might be talking about and is not present at delivery. Looking at sent email messages (it sounded as if that was what you were doing) is not as interesting as analysing delivered messages that have gone through the SMTP process and sits in a mailbox.
There you're likely to find the Return-Path header, which could be your full associated email address. It's there mainly for bounce reasons, as already have been discussed, and preventing fake senders.

What one could expect is Apple using the HME-address for this. Or they're not hiding your email from any semi-skilled marketers.