Hacker News Reader

Comment by fsuts | Hacker News Reader

I think you should formally write to Apple and give notice of 30 days to contact you or you will reveal it.

Send it to the USA media and regulator too

I've been going back and forth with Apple about it for a year. We don't feel comfortable releasing the exploit details even though they're being slow. We think enough people rely on Hide My Email for personal safety that it would be irresponsible.

> We think enough people rely on Hide My Email for personal safety that it would be irresponsible.

I am guessing you haven't tried that excuse on the users your witholding is leaving exposed.

We're hoping that by notifying people that there's a vulnerability, people can stop using Hide My Email if it matters to them. I don't think that disclosing the exploit method will get Apple to fix it faster at this point.

The problem there is users cannot evaluate if it matters to them whilst all information needed to do so is being witheld.

If having your personal email exposed would be a matter of personal safety or similar, then stop using it. If you're just using it for junk mail or to get a free trial then keep using it.

Yes, but a mitigation suggestion like "keep using it, except don't do X specific sequence" (for example, send to a Yahoo address via the Reply button, or whatever the case may be) could be helpful as well, since it seems that bad actors (and/or good actors spilling the beans) will figure it out sooner than later anyway.

Its the only reason I even pay the $1 a month icloud plan, so might as well cancel it if its gonna be eternally broken.

Hopefully nobody in the criminal underworld has figured it out on their own.

Do you believe the mitigation would be difficult to engineer? If, say somebody else, publicly disclosed the unmasking technique how long would you guess it would take Apple to implement a verifiable fix?

Reply on news.ycombinator.com