Hide My Email

EasyOptOuts says it reported two Hide My Email flaws to Apple in June 2025 that let a third party turn an alias back into your real iCloud address. Apple has twice claimed a fix; researchers say it was still broken as of June 30, 2026.

The firm won't publish the mechanism until it's patched, so the thread reverse-engineers it (a bounced oversized attachment is one guess), while an email engineer says Apple doesn't seem to know or care how its own mail systems behave.

Both Sign in with Apple and Hide My Email aliases are moving to @private.icloud.com. One regex now separates relay addresses from real iCloud mail, and a site can reject all of them in a single rule.

The author's escape hatch: generate spare @icloud.com aliases now, before the change lands, at a rate limit of at least 30 per hour.

The catch surfaced in the thread: ban the new domain and you also break the Apple sign-in button you were told to add.