39 ms·
iCloud+ Hide My Email addresses will remain on icloud.com
- prism56 23d agoGood! Was there ever a compelling reason why they went for this switch initially?
- floam 23d agoYes, to fully fix a certain class of bug on their infra.
- culi 23d agoDo you know any more about it or have a link where I can read more?
- gruez 23d agohttps://news.ycombinator.com/item?id=48559935 https://news.ycombinator.com/item?id=48559935 If you dig more you could find the bug, but AFAIK it was that if you sent a large attachment, the bounce email would contain your real address.
- floam 23d agoI’ll try to add more later, but it is believed that multiple times, a bug in some random API has allowed for the “hidden” Apple account to be revealed because they resolve hide my emails to the original internally. Using a separate namespace would be the universal fix. A mitigation for the cause of https://www.404media.co/apple-hide-my-email-vulnerability-reveals-peoples-real-email-addresses/ https://www.404media.co/apple-hide-my-email-vulnerability-re...
- nvme0n1p1 23d agoThis doesn't follow. The bounce message used to (effectively) say, > abc@icloud.com forwards to real@gmail.com If they switched the new domain and did nothing else, it would say: > abc@privaterelay.appleid.com forwards to real@gmail.com That's no better. Fixing that privacy leak is unrelated to whatever the destination domain is.
- amazingamazing 23d agoGood. What else can really be said? Only way for it to work and not be trivially blocked is to mix with legit emails.
- jambalaya8 23d agoA lot of places also don't really like icloud addresses in general. This is one of Apple's better offerings though.
- floam 23d agoGood. This would have made blocking them trivial.
- mococa 23d agoThat was a stupid idea (the prev one)
- joshuat 23d agoI'm glad they listened - I use this feature extensively and would like to continue to
- postalcoder 23d agoI've noticed a chilling new trend of apple listening to the community.
- nate 23d agoAnyone have a theory why this even made it to this point? the switch was such obviously a bad idea. just corporate weirdness that no one there bothered to raise their hand and be like "uh, are we really doing this?" or was there a story here that anyone knows about?
- super256 23d agoMaybe hidemyemail allows easily creating many accounts on a site. And some big site didn't like it. The "Sign-up via Apple" button and creating an iCloud email yourself have a slightly higher barrier than creating a new throwaway hidemyemail email (1 API call w/o captcha/phone verification or whatever). We might find out later this year if some site starts blocking @icloud.com but keeps allowing @private.icloud.com.
- pests 23d agoIt does, and I know a friend of a friend who uses them for Walmart accounts to bot pokemon drops. Those and office aliases.
- jofzar 23d agoIt's email reputation, it the always the answer with this kind of stuff. My guess is that the bounce rate got too high and bot farms were using iCloud addresses like this.
- Marsymars 23d agoThe bounce rate of what, exactly? Because the bounce rate of Hide My Email addresses being deliverable is going to rise over time, by design. Whenever I start getting spam at an address that's been leaked, I deactivate it. I've done the same with my oldest gmail account, but the work required there is notably higher.
- deleted 23d ago[deleted]
- hollow-moe 23d agoUsing icloud.com domain for legit and hidden adresses is such a typical Apple strategy of holding their own users and "others" (ie. other web services, other users etc) hostage simultaneously. But at least here it is actually a good reason that works for the user.
- dilyevsky 23d agohow is the user being held hostage? you can redirect hide my email addresses to any domain
- travoc 23d agoMarketing turds can't just block registrations from all of @icloud.com.
- dymk 23d agoThat doesn’t explain how the user is held “hostage” by Apple
- HeavenFox 23d agoHostage may be a bad analogy. More like a game of chicken. Imagine you are a regular @icloud.com email user. Apple is basically saying "I dare you to block all @icloud.com email and lose all these customers"
- bobthepanda 23d agoyou could say the same thing about AWS or Cloudflare hosting anybody and everybody. Spain actually started blocking a bunch of their IP blocks during football matches due to a poorly thought out legal decision.
- inigyou 23d agoSo the website is being "held hostage", not the user.
- trueno 23d agothank god -.-
- xaviervn 23d agoI don't understand how this changes anything. IIRC, the complaints were about Apple making the Hide My Email addresses different than regular ones. They're now saying the new domain will be private.icloud.com. Isn't it just as targetable?
- NobodyNada 23d agoIt's talking about two different services: > Sign in with Apple addresses, previously issued on privaterelay.appleid.com, will be issued on private.icloud.com. > iCloud+ Hide My Email addresses will remain on icloud.com.
- LoganDark 23d agoSign in with Apple is Apple's SSO, like Sign in with Google. Services have to support this one explicitly, and it already had a special subdomain, so the specific subdomain is simply changing. Hide My Email is the manually generated ones, for websites that accept an arbitrary email address. This is the one where it's valuable for the relays to be identical to genuine iCloud addresses, otherwise websites could try to block it and force you to use a more revealing email address, undermining privacy.
- NotThatFast 23d agoOne of the best things about it. Also being able to add several emails per custom domain for free. Whole thing is 99c a month. Makes Gmail seem like a joke in comparison. Until you get an email from an iCloud address on Gmail and see it go right to spam haha. Suddenly Gmail is cheap again
- Quothling 23d agoMaybe it's because I live in a country where e-mai isn't really used that much for personal communication, but wouldn't this mainly be a gmail issue? If mails I wanted ended up in the spam folder I'd not use gmail. I mean, I pay for protonmail, so I wouldn't use gmail to begin with, but if mails I wanted ended up in my protonmail spamfolder and I couldn't do anything about it, then I'd switch away from protonmail.
- NotThatFast 23d agoYou are 100% correct and yet the masses still prefer it. World’s a twisted place! I would guess the average Gmail user doesn’t know that it reports virtually all iCloud as Spam - believing instead that it’s genuinely being filtered by quality engineering at Google.
- DrewADesign 23d agoIf you’re talking about people with the technical sophistication to consider software services based on their technical merits, then sure. Your average user couldn’t even tell you the first thing about which non-content-based criteria might inform a spam score… or have even heard of a spam score. So they will absolutely not blame Gmail if another provider’s email gets spam flagged… they’d probably just think “why don’t they just get a Gmail account,” à la iMessage users/green texts.
- wafflemaker 23d agoBest thing to do with Gmail spam is to make an auto filter to mark all spam as not spam. Took me only one missed dentist appointment several years ago to get that idea. Now I'm just getting profits. No other spam since I'm using email aliases.
- giwook 23d agoCan someone explain the backstory behind this? I'm reading some of the comments here and I feel like I'm missing something here.
- dannyw 23d agoFor the "hide my email" feature, Apple currently and has always used "@icloud.com". This masks you amongst all iCloud users. They were planning to change it to a custom domain, which would allow sites to easily filter out and reject "Hide my email" users based on the email. They have now reverted their plans to change this, meaning "hide my email" is still "@icloud.com".
- nailer 23d agoI suspect many people actually feel better about Apple owning this fuckup and reversing it than they would have Apple hadn't fucked up in the first place.
- frabcus 23d agoExcept the post says it will be @private.icloud.com Whereas people's Apple emails are often at @icloud.com So I don't think it masks you amongst all iCloud users. I'm confused how this is much better!
- leshenka 23d agoThe post says that "Sign in with Apple" will issue emails on @private.icloud.com but "Hide my email" will continue issuing addresses on @icloud.com These are two separate services. The problem was with the latter not the former. If the service decides to block @private.icloud.com they might as well remove Apple's sign in button.
- philip1209 23d agoI wish I could set up "Sign in with Apple" on a blog without paying $99/yr for a developer license.
- chanux 23d agoIs your audience very Apple heavy?
- pasc1878 23d agoWhy do you want this. Is it a benefit to you? If it is why should you not pay for that benefit? Nothing is free.
- sunaookami 23d agoSince when did we start accepting that paying for providing OAuth sign-in for other companies is good?
- inigyou 23d agoI wish you had to pay for all of them. We'd see a lot less of them.
- Jleagle 23d agoYou say nothing is free, but Amazon, Discord, Dropbox, Facebook, GitHub, Google, Instagram, Microsoft, Paypal, Reddit, Slack, Steam, TikTok, Twitter etc all offer it for free. Plus, it's not for the dev, it's for the users of the website.
- khalic 23d agoAnd they all sell your data
- fugigigjfn 23d ago[flagged]
- etaioinshrdlu 23d agoI'm a bit confused - when i see these signups, they look like this to me: rtwnj6tj7@privaterelay.appleid.com
- anon7000 23d agoI think the post is very explicit. First sentence: > Starting later this year, new Sign in with Apple addresses, previously issued on privaterelay.appleid.com, will be issued on private.icloud.com. Existing addresses on privaterelay.appleid.com will continue to work and forward mail to users without interruption.
- jshier 23d agoThat's the Sign in with Apple domain, not the Hide My Email domain. HME is remaining at icloud.com instead of moving to private.icloud.com as well. From the linked article: > After further consideration and reviewing community feedback, iCloud+ Hide My Email addresses will remain on icloud.com.
- drdexebtjl 23d agoHow many sign ups you have with an @icloud.com address? A lot of those are Hide My Email aliases that, by design, you can’t tell apart from real human addresses.
- scosman 23d agoit will still be on "private.icloud.com". Just as filterable...
- internet2000 23d agoIt won't. The news here is that it won't.
- deleted 23d ago[deleted]
- ninkendo 23d agoprivate.icloud.com (née privaterelay.appleid.com) is the address for “Sign In With Apple”, which is an oauth-style service that sites opt into to let you use your Apple ID to sign in. Sites offering this as a signup option are already aware it gives users an option to use a private anonymized email address. The toplevel “Hide My Email” iCloud feature is a different thing, can be done independently of a SIWA flow (you can just go into settings and make more addresses, all it needs is a name and a notes field) and uses @icloud.com in order to make your anonymized email address look indistinguishable from other iCloud users. The former is “filterable”, yes, but it’s moot because you only get those if you offer Sign In With Apple in the first place, and if you want real emails, you would already know to just… not do that. The latter is very much not filterable. The confusing thing though, is that when a user uses Sign In With Apple, they are offered two options: “share my email” which gives the site your real address, and “hide my email” which gives an @private.appleid.com address. But this “hide my email” option is a totally different thing from the separate “hide my email” service, which lets you make arbitrarily many @icloud.com private aliases to forward to your real address. Critically, the latter toplevel Hide My Email feature works with sites that don’t use Sign In With Apple. It’s just stupidly unfortunate that Apple calls both of these features “hide my email.”
- _ks3e 23d agoNot arbitrarily many aliases - there's a limit of (as of two or three weeks ago) 768.
- wijayaerick 23d agoiCloud Hide My Email sharing the same domain with normal email (icloud.com) is the reason why I use iCloud over other email alias services like simplelogin and addy.
- kqp 23d agoThis is a huge selling point. Private email relays often get blocked, the only lasting solution is to put them on the same domain as, and in the same format as, a significant number of non-private email addresses. As far as I’m aware the only other provider doing this is Fastmail. Comments about lock-in aren’t wrong, but it has to be this way. You can make arbitrary email addresses at your own domain, but anybody who feels like it can trivially automatically detect that those are all you. Personally I use unique at own domain only where I’m identifying myself anyway, like my bank, and Fastmail masked email where I’m not. For most things it’s not actually that terrible to accept a small risk that they’re offline for a day between your being booted without warning and you changing your email address with them.
- glenngillen 23d agoTotally agree with unique at own domain isn't actually privacy. It wouldn't take much of a paper trail to work out the details. I continue to use it everywhere for a few reasons: - if someone emails me acting all friendly like we've had some previous relationship but it's sent to linked@mydomain or github@mydomain I know they've just scraped my contact details and it's spam - similarly, if a vendor leaks or sells my data and I start receiving marketing from somewhere I don't expect it's easier to trace the source of the leak (and in some cases just blackhole that entire email address) - I already use a password manager and have different passwords on every site, but having a different email address too raises the barrier further for someone trying to script an automated attack based off some other pwned data set.
- kqp 23d agoI agree with all of this. I’d add that it’s useful for sorting and searching. Things like keyword matching, from address, and from domain aren’t as consistent as you’d hope, but companies do need to actually email the address they were given, so you can use it to reliably identify emails from them.
- jiveturkey 23d agoBut all 3 of those use cases, plus privacy, can be addressed with word.salad@bigdomain.com. So you may as well get the privacy bit in there.
- DarmokTanagra 23d agoI use hide my email and single use credit card numbers all the time, its a fantastic system combined with some basic email forwarding rules. Yes, vendor lock in sucks, but I have $20k worth of apple hardware already so that ship has sailed and overall Im pretty happy with it.
- _zoltan_ 23d agosingle use card tied to you, or via some privacy frontend? if the latter, care to share your experience?
- DarmokTanagra 23d agomany cards offer virtual card numbers, robinhood card offers name anonymization. been a user for a couple years now and no complaints
- _zoltan_ 23d agorobinhood is not available here in Switzerland unfortunately.
- rsync 23d agoA reminder: Neither visa nor MasterCard networks have the ability to verify cardholder name. Everyone behaves as if they do, but your name cannot be verified. Which is to say, all of these cards have name anonymization, not just robinhood.
- DarmokTanagra 23d agoI was unaware of that, is address also unverifiable?
- rsync 22d agoYes, address is verifiable.
- tingletech 23d agothis opens some crazy "apple developer" dialog on my mac rather than a web page. I had to crank up chrome to read it. And it makes no sense, I have no clue what a sign on with apple address is. I guess I'm glad my hide my email addresses won't change because that would be a PITA.
- ezfe 23d agoYou have the developer app installed. It does seem to be deep linking wrong. Sign in with Apple email addresses are email addresses for the Sign in with Apple button.
- aucisson_masque 23d agoApple had been on a steady path of bad decisions since a few years, I'm glad to see they reverted at least on this one. Now if they could completely remove liquid glass...
- bni 23d agoAs I user of this service I like this. However filtering for these hide my e-mail addresses is quite easy if you are motivated to do it, they have a recognizable pattern.
- Keirmot 23d agoThey do, but then your net can get false positives. Even if unlikely, someone can have the email potent-tomatoq4@icloud.com
- Vinnl 23d agoI wonder if the initial reason to move them to a separate domain, was because they started to see providers blackholing icloud.com anyway, thus also hurting non-aliased emails? If so, will be interesting to see if that will get worse.
- SXX 23d agoOh I glad there is still someone at Apple who understood its insanity. If only they made it generate a bit more sensible alias names. UPD: I obviously mean alias addresses template make most of them too easy to recognize.
- merlindru 23d agoCan't the aliases be renamed? --- Just checked, they can. Phew. If the forwarding alias was detectable/always used the same schema, that'd also make them borderline useless, just like the `privaterelay` subdomain
- SXX 23d agoWhat do you mean renamed? Alias address certainly are not changeable. You can randomize next one from 2-3 options, but most of them still follow pattern that is easy to recognize. PS: I guess its just misunderstsnding and I really meant addresses themself are not human-like enough.
- simongr3dal 23d agoBut the private relay domain is only used when you sign up through “Sign in with Apple”? A thing you have to support if your iOS app already supports sign up with other third party authentication providers.
- glub 22d agoYeah, I don't really get the excitement. The pattern in which these aliases are generated might as well just end with private.icloud.com. Is breest-tas.7n@icloud.com really that hard to detect as hide my email?
- ozereray1 23d agoIt is reassuring to see Apple maintaining this domain consistency. Changing it would have broken a lot of automated routing rules for those of us relying on it for privacy.
- rubyfan 23d agoNow if they would only figure out how to Hide My Phone Number then these feature would actually impact privacy.
- sanjay_dev 23d ago[dead]
- Mindwipe 23d agoGood. Thank you for listening, iCloud team.
- mococa 23d agoIf you pay for iCloud + a domain, you can have ${anything}@${yourdomain}. Works like a charm. For example, I can have hn@mydomain.com for hn only mails, if they share my mail address, I'll know.
- glub 22d agoYou also make yourself extremely identifiable. It takes only one leak to know that all emails on mydomain.com across the web are delduca.
- sukiankarim13 22d agosukiankarim13@icloud.com
- 1vuio0pswjnm7 22d ago01 Jul 2026 10:19:45 UTC | Apple 'Hide My Email' vulnerability reveals peoples' real email addresses | https://www.404media.co/apple-hide-my-email-vulnerability-reveals-peoples-real-email-addresses/ https://www.404media.co/apple-hide-my-email-vulnerability-re... | https://news.ycombinator.com/item?id=48744606 https://news.ycombinator.com/item?id=48744606 02 Jul 2026 03:47:04 UTC | Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses | https://www.404media.co/apple-hide-my-email-vulnerability-reveals-peoples-real-email-addresses/ https://www.404media.co/apple-hide-my-email-vulnerability-re... | https://news.ycombinator.com/item?id=48756295 https://news.ycombinator.com/item?id=48756295 03 Jul 2026 22:56:51 UTC | Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses | https://www.404media.co/apple-hide-my-email-vulnerability-reveals-peoples-real-email-addresses/ https://www.404media.co/apple-hide-my-email-vulnerability-re... | https://news.ycombinator.com/item?id=48780999 https://news.ycombinator.com/item?id=48780999 04 Jul 2026 17:01:39 UTC | Security Roundup: Apple's Hide My Email Service Fails to Hide Your Email | https://www.wired.com/story/security-roundup-apples-hide-my-email-service-fails-to-hide-your-email/ https://www.wired.com/story/security-roundup-apples-hide-my-... | https://news.ycombinator.com/item?id=48786928 https://news.ycombinator.com/item?id=48786928 04 Jul 2026 18:54:24 UTC | Apple Hide My Email Reveals the Users Real Email | https://www.404media.co/apple-hide-my-email-vulnerability-reveals-peoples-real-email-addresses/ https://www.404media.co/apple-hide-my-email-vulnerability-re... | https://news.ycombinator.com/item?id=48787842 https://news.ycombinator.com/item?id=48787842 05 Jul 2026 06:26:38 UTC | Security Roundup: Apple's Hide My Email Service Fails to Hide Your Email | https://www.wired.com/story/security-roundup-apples-hide-my-email-service-fails-to-hide-your-email/ https://www.wired.com/story/security-roundup-apples-hide-my-... | https://news.ycombinator.com/item?id=48791735 https://news.ycombinator.com/item?id=48791735 07 Jul 2026 02:16:06 UTC | Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses | https://www.404media.co/apple-hide-my-email-vulnerability-reveals-peoples-real-email-addresses/ https://www.404media.co/apple-hide-my-email-vulnerability-re... | https://news.ycombinator.com/item?id=48812946 https://news.ycombinator.com/item?id=48812946 12 Jul 2026 01:05:37 UTC | Apple Hide My Email bug, possibly related to disclosure vulnerability | https://lapcatsoftware.com/articles/2026/7/2.html https://lapcatsoftware.com/articles/2026/7/2.html | https://news.ycombinator.com/item?id=48877353 https://news.ycombinator.com/item?id=48877353 Recommended reading: 19 Aug 2026 15:22:13 UTC | Alvarez vs. Apple, Inc. (N.D. Cal., July 15, 2026) [pdf] | https://ia803202.us.archive.org/25/items/gov.uscourts.cand.474371/gov.uscourts.cand.474371.1.0.pdf https://ia803202.us.archive.org/25/items/gov.uscourts.cand.4... | https://news.ycombinator.com/item?id=49362811 https://news.ycombinator.com/item?id=49362811 21 Jul 2026 15:31:41 UTC | Apple Fixes Hide My Email Vulnerability After 404 Media Coverage | https://www.404media.co/apple-fixes-hide-my-email-vulnerability-after-404-media-coverage/ https://www.404media.co/apple-fixes-hide-my-email-vulnerabil... | https://news.ycombinator.com/item?id=48993637 https://news.ycombinator.com/item?id=48993637 23 Jul 2026 20:11:07 UTC | How Apple's Hide My Email exploit worked and why you're still at risk | https://easyoptouts.com/guides/apple-hide-my-email-was-leaking-email-addresses https://easyoptouts.com/guides/apple-hide-my-email-was-leaki... | https://news.ycombinator.com/item?id=49027365 https://news.ycombinator.com/item?id=49027365 24 Aug 2026 20:24:44 UTC | Apple Won't Change Hide My Email Domain After Backlash | https://www.macrumors.com/2026/08/24/apple-hide-my-email-domain/ https://www.macrumors.com/2026/08/24/apple-hide-my-email-dom... | https://news.ycombinator.com/item?id=49425379 https://news.ycombinator.com/item?id=49425379
- srevenant 22d agoDon't mix use cases. Privacy is different from uniquely identifying senders. The reason for random email addresses is YOU finally can identify each vendor uniquely by the email they send you stuff. It isn't about anonymizing, it's about identifying them. I've been doing it for 30+ years on my own domains.
- dundercoder 22d agoThis is exactly what I use it for.