Apple makes “Hide My Email” easier to block, raising privacy concerns

Apple is rolling out a change that many fear will degrade one of its most useful privacy features. Email addresses generated by “Hide My Email” and “Sign in with Apple” will migrate to a dedicated subdomain, making it easier for services to block them entirely. Some users are scrambling to generate aliases on the old domains before the switch.

The Cupertino giant announced that, later this summer, “Hide My Email” and “Sign in with Apple” email addresses will be unified under a new separate subdomain – @private.icloud.com. It will replace the currently used @icloud.com and @privaterelay.appleid.com.

“Existing addresses on the legacy domains will continue to work and forward mail to users without interruption,” Apple said in the announcement on its developer news page.

“Hide My Email” allows users to use a randomly generated email alias instead of their real email address. Apple automatically forwards messages to the real inbox, but users can delete the alias at any time. This helps to maintain privacy when signing in for apps or services.

However, many privacy enthusiasts fear that the switch to a dedicated subdomain might have unintended consequences.

“This makes it much easier to ban all aliases without affecting non-relay mailboxes on iCloud mail,” said Arseniy Shestakov, Co-founder & CTO at Hack The Publisher.

Using the icloud.com domain for both regular iCloud accounts and email masks leaves service providers no choice but to accept all users, because there is no way to distinguish between normal emails and generated private masks.

“But now a lot of services will just refuse to accept these emails, just like what happens with free temporary mailboxes,” Shestakov warns in the blog post.

The developer hopes that Apple will reconsider its decision.

The announcement drew significant attention online, reaching over 500 points on Hacker News.

“Nerds online have pointed out that platforms that want to ban iCloud aliases can now do so by banning this new subdomain without affecting all iCloud users,” tech influencer vxdb posted on X.

While alternatives exist, Apple’s built-in features offer a hassle-free way to hide an email address with a single click.

Shestakov suggests there is still time to generate aliases on the icloud.com domain for future use, before the change comes into effect, and some users are already doing so.

“I still generated some for myself just in case, and fellow hackers can do the same if they want to,” one of the responses on Hacker News reads.

Another user suggested creating a script to automate alias creation “for the next 10 years.” However, many users also noticed that the service is rate-limited.

---

Unlock more exclusive Cybernews content on YouTube.