Apple decides undermining its own email privacy feature was a bad idea after all

CHUTTERSNAP / Unsplash Apple is walking back a technical change that could have had real privacy implications. The company's Hide My Email feature, included with iCloud+, is useful because websites can't tell whether they're looking at a user's real email address or a random one generated to protect their identity. A (thankfully) now-abandoned plan would have allowed companies to immediately know that they were dealing with a masked address, making the feature essentially useless. In June, Apple said it would move new Hide My Email addresses to @private.icloud.com, rather than the standard @icloud.com. Had that gone through, many websites could (and, let's be honest, would) have used that information to block addresses from that domain during signup. After all, an email address that companies can tie to a specific user is much more valuable than one that they can't. Apple announced its walk-back in a developer note on its website (via TechCrunch) on Monday. The company didn't explain its rationale, but Daring Fireball's John Gruber reported that employees on the Hide My Email team had "strong objections" to the scrapped change. (As did users on Reddit.) Perhaps a bigger question than why Apple changed its mind is why it ever planned the change in the first place. One segment of Apple's email-relay system will still use the new @private.icloud.com domain: new Sign in with Apple addresses will move there later this year. However, that doesn't create any privacy issues since websites already know that you're, well, signing in with Apple. Earlier this year, Apple patched a bug in Hide My Email that made it possible to view the real email address the feature was masking. Apple had reportedly been aware of the exploit for at least a year, but only patched it after 404 Media's story about it gained traction.