Using iCloud+ Hide My Email may expose your privacy

twitter.com

23 points·aofeisheng··5 comments

So just don't use a custom domain for now?

Can you post full (redacted) headers?

The original message has been deleted. Isn't the information in the screenshot enough to make my point? What specific information do you want.

I’d like to know the context this information is being shown in. Isn’t hide my email receive only? Who would be seeing this header except the person in control of the alias? Can anyone untrusted see it?

As it stands, this looks like an incoming message which has been assigned a thread ID on your domain for _your_ reference, rather than any information going outward

> Isn’t hide my email receive only?

No, there're two ways to send messages from Hide My Email addresses: 1. reply to an incoming message; 2. select "Hide My Email" option when composing a new message via any of Apple's mail apps.

> Who would be seeing this header except the person in control of the alias? Can anyone untrusted see it?

Any recipient can see it, the screenshot is from one of my Gmail mailboxes.

> As it stands, this looks like an incoming message which has been assigned a thread ID on your domain for _your_ reference, rather than any information going outward

It was an outgoing message from my Custom Email Domain address to one of my Gmail addresses using the Hide My Email feature, which was supposed to *hide* my Custom Email Domain address.

Reply on news.ycombinator.com