[deleted]
Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
71–80 of 105 posts
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#72Earlier quoted context omitted.
Seems like this is a Gmail thing: https://ylukem.com/blog/apple-mail-leaks-your-ip-address
It's not a Gmail thing: > The reason why my IP address is visible is because Apple Mail sends emails with SMTP. Unless you use a proxy, your IP address is visible to an SMTP server, just like it's visible to an HTTP server when you use a web browser. This is not specific to Apple Mail or to Gmail.
Yeah but I think Gmail seems to actually just keep that header rather than nuking it. To be fair I don't entirely know what I would do to fix it since (like the post) this seems like there aren't many good options here.
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#73Earlier quoted context omitted.
It's not a Gmail thing: > The reason why my IP address is visible is because Apple Mail sends emails with SMTP. Unless you use a proxy, your IP address is visible to an SMTP server, just like it's visible to an HTTP server when you use a web browser. This is not specific to Apple Mail or to Gmail.
Yeah but I think Gmail seems to actually just keep that header rather than nuking it. To be fair I don't entirely know what I would do to fix it since (like the post) this seems like there aren't many good options here.
> I think Gmail seems to actually just keep that header rather than nuking it.
I think that's common among email providers.
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#74Earlier quoted context omitted.
Is this from iOS? I just tested from MacOS, and the only IPs were for the transit and auth servers. I'm not actually doubting it. saagarjha knows his stuff. I just don't see it, so maybe I'm holding it wrong.
Same, I remember it being in the headers long ago but don't see it now. macOS Tahoe, Mail.app client, iCloud email sending to itself or to my Gmail, both set up in default ways, IPv6 disabled
From what I see above, it looks like the trick is to send from Mail.app to an account read by a different app (maybe just Gmail?).
I would need to test with my hosting Webmail client, so maybe tomorrow.
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#75I think you should formally write to Apple and give notice of 30 days to contact you or you will reveal it. Send it to the USA media and regulator too
I've been going back and forth with Apple about it for a year. We don't feel comfortable releasing the exploit details even though they're being slow. We think enough people rely on Hide My Email for personal safety that it would be irresponsible.
Hopefully nobody in the criminal underworld has figured it out on their own.
Do you believe the mitigation would be difficult to engineer? If, say somebody else, publicly disclosed the unmasking technique how long would you guess it would take Apple to implement a verifiable fix?
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#76That timeline was exactly my experience with Apple here - https://www.grepular.com/Apples_Protect_Mail_Activity_Doesnt... They don't seem to know or care what is going on with their own email systems.
I’m still mildly annoyed every email I send using Mail has my IP embedded in it
This is your email provider doing this. I use Fastmail. Fastmail does not log the IP of the sender when you use its SMTP servers.
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#77Earlier quoted context omitted.
Seems like this is a Gmail thing: https://ylukem.com/blog/apple-mail-leaks-your-ip-address
It's not a Gmail thing: > The reason why my IP address is visible is because Apple Mail sends emails with SMTP. Unless you use a proxy, your IP address is visible to an SMTP server, just like it's visible to an HTTP server when you use a web browser. This is not specific to Apple Mail or to Gmail.
[deleted]
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#78Earlier quoted context omitted.
It's not a Gmail thing: > The reason why my IP address is visible is because Apple Mail sends emails with SMTP. Unless you use a proxy, your IP address is visible to an SMTP server, just like it's visible to an HTTP server when you use a web browser. This is not specific to Apple Mail or to Gmail.
Yeah but I think Gmail seems to actually just keep that header rather than nuking it. To be fair I don't entirely know what I would do to fix it since (like the post) this seems like there aren't many good options here.
Gmail's SMTP servers are what's adding the received header with your IP address, not Apple Mail.
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#79We put up a timeline of the disclosure here: https://easyoptouts.com/guides/apple-hide-my-email-is-leakin...
Can you please clarify whether this is only an issue if I reply to an email sent to one of my HME addresses or whether you can unmask any HME address w/o needing a reply from the recipient.
Can you also clarify whether it matters what the forwarding address is? e.g. whether my HME addresses forward to an icloud.com address (e.g. js2@icloud.com) or say a personal domain associated with my Apple ID (e.g. js2@example.org).
Re: Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
#80Earlier quoted context omitted.
At least in Gmail, downloading content (e.g. images) is disabled by default for suspicious emails. There is no way for the sender to know if it’s monitored unless this is disabled by explicit user action.
This freaked me out the first time I used Mail. It rendered a PDF about buying bitcoin on PayPal (I don't have PayPal). Looked at the same email in Gmail and Thunderbird, it's just a PDF attachment, no message, and the sender was different. No wonder people are falling for those scams, Mail makes it easy for them. Now if only I had a better client on my phone (never buying an iPhone again)
What made you prefer Mail to Gmail, given you don’t seem satisfied with Apple’s Mail app?