The Fruity Cargo Cult Apple’s over-hyped Hide My Email feature appears to have been caught sharing users’ real addresses to the internet.
Hide My Email is meant to create disposable addresses so users can keep their actual email hidden while signing up to the web’s endless parade of forms, trackers and marketing slurry. New research suggests a bug in the feature can unmask those real addresses.
The bug was reported by 404 Media, which said it had tested and verified the flaw. EasyOptOuts co-founder Tyler Murphy, who found the bug, said he warned Job’s Mob about the problem more than a year ago and was given the brush off.
Murphy said it was unclear why the shiny-toy outfit had still not fixed it. He added that every attempt to exploit the bug had worked, which is the sort of perfect score nobody wants from a privacy feature.
“We don’t know the full scope of the issue, but in our limited tests with volunteers, 100% of Hide My Email addresses were exploitable,” Murphy told the outlet.
Details of the flaw have not been made public because researchers fear it will be abused by the usual swamp creatures who regard personal data as lunch. It does not seem that Apple gave a monkey’s about that issue.
EasyOptOuts offers a paid data removal service that removes information from data broker sites. Murphy told 404 Media that “publicly accessible people-search sites make it easy to link an email address to other personal details, so people relying on Hide My Email for safety may be at risk.”
TechCrunch said it had asked Job’s Mob for more information and would update its story if the company replied, presumably after the comms department had finished polishing the privacy halo and telling its users that there was nothing to see here, move on, please.
Job’s Mob has form for this sort of thing before. The company was sued in 2022 after reports claimed iPhone apps kept sending analytics data to Job’s Mob even when the iPhone Analytics privacy setting was switched off.
In 2023, researchers found another one of Job’s Mob’s privacy features was effectively “useless.” The research claimed a tool meant to anonymise mobile users’ Wi-Fi connections with randomised MAC addresses was exposing the user’s real MAC address.
Job’s Mob has built much of its reputation and branding around user privacy, mostly by implying that everyone else in tech is rifling through your bins. The Hide My Email cock-up suggests its own privacy cupboard may contain more moths than magic.
