-
Researchers say a flaw in Apple’s Hide My Email feature can expose users’ real email addresses.
-
Security researcher Tyler Murphy claims he reported the issue over a year ago, but Apple has not fixed it.
-
The vulnerability could put privacy-conscious users at risk by linking anonymous email addresses to personal information.
Apple’s Hide My Email feature may not protect users as well as many believe. New findings suggest a flaw allows attackers to uncover the real email addresses behind disposable ones.
The privacy feature lets users create random email addresses when signing up for websites or apps. Those temporary addresses forward messages to a user’s real inbox without revealing the actual email.
Protection could fail thanks to a bug, security research says
Security researcher Tyler Murphy claims the protection fails because of a bug. According to a report by 404 Media, the flaw can expose the genuine email address linked to a Hide My Email alias. Murphy said he informed Apple about the vulnerability more than a year ago. Despite the report, he claims the company has not addressed the issue.
According to Murphy, every test conducted so far has successfully exposed the hidden email address. He said his limited testing showed every Hide My Email address proved vulnerable to the attack. Researchers have withheld technical details to prevent criminals from abusing the flaw.
Researcher says privacy risks could extend beyond Email
Murphy co-founded EasyOptOuts, a paid service that removes personal information from data broker websites. He warned that exposing a real email address creates broader privacy risks.
According to Murphy, publicly available people-search websites can connect an email address with other personal details. He added that users, depending on Hide My Email for personal safety, could face serious risks if attackers uncover their identities.
The researchers chose not to disclose technical information publicly. They believe releasing those details now could help attackers exploit the weakness before Apple issues a fix.
TechCrunch contacted Apple for comment regarding the reported vulnerability. The company had not responded when the report was published. Apple introduced Hide My Email as part of its growing privacy tools. The feature became popular among users wanting extra protection from spam, tracking, and identity exposure.
Many people also use the feature when registering for unfamiliar websites. Others rely on it to separate online accounts from their primary email addresses. If attackers bypass that protection, users could lose one of the feature’s biggest privacy benefits.
Apple faces fresh questions over privacy promises
In 2022, users sued the company after reports claimed iPhone applications continued sending analytics information to Apple. The lawsuit alleged this happened even after users disabled the iPhone Analytics privacy setting. Another privacy concern surfaced in 2023.
Researchers claimed Apple’s Wi-Fi privacy feature failed to hide users’ actual MAC addresses. The tool should have randomized those identifiers to improve anonymity. Instead, researchers argued it exposed the genuine hardware address, making users easier to track.
Those earlier incidents raised questions about whether Apple’s privacy protections consistently perform as advertised. Apple has built much of its brand around protecting customer privacy. That reputation makes the latest claims especially significant.
The company has faced similar scrutiny over notification privacy. Apple recently fixed an iPhone bug that exposed Signal messages via notifications, raising further questions about the reliability of its privacy features.
Murphy’s findings have not become public because researchers want to limit abuse. Still, the reported flaw could affect users who trust Hide My Email to protect their identities online. Apple has not confirmed the issue or announced a timeline for a fix. Until then, privacy-conscious users may need extra caution when relying solely on disposable email addresses.
The findings also remind users that privacy tools reduce risk, but they cannot always guarantee complete anonymity. Staying informed about newly discovered vulnerabilities remains one of the best ways to protect personal information online.
