Something called “Hide My Email” should actually do this.
Apple is revisiting a technical change that could have had real implications on privacy. The company’s Hide My Email feature, included with iCloud+, is useful because websites can’t tell whether they’re looking at a user’s real email address or a random one generated to protect their identity. A (thankfully) now-abandoned plan would have let businesses know immediately that they were dealing with a hidden address, rendering the feature essentially useless.
In June, Apple announced that it would move new Hide My Email addresses to @private.icloud.com, rather than the standard @icloud.com. If this had been the case, many websites could have (and, let’s be honest, would have) used this information to block addresses from that domain during registration. After all, an email address that businesses can associate with a specific user is much more valuable than one that they can’t.
Apple announced its return in a developer note on its website (via TechCrunch) on Monday. The company did not explain its reasons, but Bold FireballJohn Gruber of , reported that employees of the Hide My Email team had “strong objections” to the abandoned change. (As do Reddit users.) Perhaps a more important question than why Apple changed its mind is why it planned the change in the first place.
A segment of Apple’s email relay system will still use the new domain @private.icloud.com: the new connection with Apple addresses will be moved there later this year. However, this does not create any privacy concerns since websites already know that you are signing in with Apple.
Earlier this year, Apple fixed a bug in Hide My Email that allowed the feature to show the real email address hidden by the feature. Apple reportedly knew about the exploit for at least a year, but only fixed it afterward 404 MediaThe story about this gained traction.
