Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple 'Hide My Email' vulnerability reveals peoples' real email addresses

easyoptouts.com

Post reply on HN
Print view View original

61–70 of 105 posts

Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses

#61

Post by jijijijij »

mike-cardwell wrote: post #17

That timeline was exactly my experience with Apple here - https://www.grepular.com/Apples_Protect_Mail_Activity_Doesnt... They don't seem to know or care what is going on with their own email systems.

I am starting to think all these "privacy" features merely exist as excuse for getting people to hand off their mails to Apple. Clearly the all do not deliver on the intended functionality, but the proxy/relay routing happens to some extent anyway. How convenient. If you were a company promising its users all the privacy, but secretly not giving a fuck beyond collecting user traffic and meta data, wouldn't you expect the state of things to look exactly like that? I mean, how could you explain this any other way, considering the size of Apple and the relative ease of developing such features reliably? Apple is hardly breaking ground here.

Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses

#62

Post by VladVladikoff »

alexpc201 wrote: post #49

I guess the vulnerability should work as follows (I haven't tried it), you send an email with a very large attachment to a "hide my email" address, the server that receives it (private.icloud.com) forwards it to the email server registered in iCloud which, being the very large attachment, sends a response email (from the real address) with the rejected email message. It's the first thing I would try.

Yeah it’s a good guess. I was also thinking there might be some header leaks. Or possibly if you return server busy on the first attempt or something like this, some sort of edge case the developers overlooked.

Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses

#63

Post by saagarjha »

WA wrote: post #37
saagarjha wrote: post #34

Earlier quoted context omitted.

I’m still mildly annoyed every email I send using Mail has my IP embedded in it

Source? I don't think this is true. Doesn't seem to be the case for me. Maybe your email provider attaches your IP address?

Seems like this is a Gmail thing: https://ylukem.com/blog/apple-mail-leaks-your-ip-address

Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses

#64

Post by grayhatter »

saagarjha wrote: post #34
mike-cardwell wrote: post #17

That timeline was exactly my experience with Apple here - https://www.grepular.com/Apples_Protect_Mail_Activity_Doesnt... They don't seem to know or care what is going on with their own email systems.

I’m still mildly annoyed every email I send using Mail has my IP embedded in it

Why? Something real, or just nonspecific vibes?

Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses

#65

Post by frollogaston »

saagarjha wrote: post #63
WA wrote: post #37

Earlier quoted context omitted.

Source? I don't think this is true. Doesn't seem to be the case for me. Maybe your email provider attaches your IP address?

Seems like this is a Gmail thing: https://ylukem.com/blog/apple-mail-leaks-your-ip-address

Yes, was able to repro just now

Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses

#66

Post by js2 »

alexpc201 wrote: post #49

I guess the vulnerability should work as follows (I haven't tried it), you send an email with a very large attachment to a "hide my email" address, the server that receives it (private.icloud.com) forwards it to the email server registered in iCloud which, being the very large attachment, sends a response email (from the real address) with the rejected email message. It's the first thing I would try.

Apple rewrites the From address of before forwarding so that replies go back through its SMTP servers. Those SMTP servers should rewrite the reply not to leak information.

Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses

#67

Post by lapcat »

saagarjha wrote: post #63
WA wrote: post #37

Earlier quoted context omitted.

Source? I don't think this is true. Doesn't seem to be the case for me. Maybe your email provider attaches your IP address?

Seems like this is a Gmail thing: https://ylukem.com/blog/apple-mail-leaks-your-ip-address

It's not a Gmail thing:

> The reason why my IP address is visible is because Apple Mail sends emails with SMTP.

Unless you use a proxy, your IP address is visible to an SMTP server, just like it's visible to an HTTP server when you use a web browser. This is not specific to Apple Mail or to Gmail.

Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses

#69

Post by Barbing »

jijijijij wrote: post #43
impish9208 wrote: post #38

Earlier quoted context omitted.

> You send an email to the HME address, reply, and then the real mail gets disclosed in the mail source. Does the initial sender matter? Like if it’s the HME address that sends first and receives the reply? I have around 180 of these addresses.

> then the real mail gets disclosed in the mail source. It's not just in the source, I totally overlooked the fact the real email address is shown as sender. Lol. > Does the initial sender matter? Like if it’s the HME address that sends first and receives the reply? I have around 180 of these addresses. Appears so. Here is exactly what I did: 1. Created the HME through mail, sending to other email service address (OM…

Did #1 on macOS Mail.app, but #4 on iOS Mail client like you.

#5., real address not disclosed at OMA for me.

(now that I see the reddit thread) is this potentially Yahoo/Sonic-only?

Post reply on HN