Apple Fixes Hide My Email Vulnerability After 404 Media Coverage

Post by tjames7000 » Thu, Jul 23, 2026, 8:14 PM UTC

js2 wrote: post #21

> Now Apple says it has been fixed, we can add that, in simple terms, it required sending a target Hide My Email user a message that got rejected as spam. Frustratingly vague. I was unable to reproduce when the original article was posted. I did not test exhaustively, but I was able to get HME to reject messages in various ways (mostly by sending oversize messages) and none disclosed my real address because they were…

Post by SAI_Peregrinus » Thu, Jul 23, 2026, 8:53 PM UTC

argee wrote: post #19

WorldMaker wrote: post #17

Earlier quoted context omitted.

I've seen this kind of thing fail in so many ways just as a user with a custom domain. Someone adds my real email (the custom domain) to a Google invite and my primary Google Account uses its own email (a Gmail account) that is in no way my primary email address and Google gets confused and won't let me access the thing sent to my real email because I'm trying to access it from my Google Account. (Plus additional var…

I've already had to add code to "normalize" addresses with dots and plusses. That should've been my first sign to move to a different design.