Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses

Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real... by xoa on Wednesday July 01, 2026 @05:47PM (#48753570)

I also just tried this as well, sending an email from a Migadu-based account to one at both Gmail and MXRoute using Mail.app under macOS 15.7.7. Neither included any private IP address info I could find in either headers or raw source. That would be a good leak to know about and as sibling comment said saagarjha definitely knows their stuff, so any tips to replicate would be appreciated.

[ Parent | on HN ]

Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real... by fckapple on Thursday July 02, 2026 @04:52AM (#48758444)

Received: from smtpclient.apple (ptr. [ip]) by smtp.gmail.com with ESMTPSA id ... for <...> (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 02 Jul 2026 ..:..:.. -0700 (PDT)

Using Mail: Version 16.0 (3864.600.51.1.1).

Sent from a Google Apps mail.

[ Parent | on HN ]

Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real... by jijijijij on Thursday July 02, 2026 @06:46AM (#48759352)

For me that IP belongs to apple, when using the iOS mail client. I presume Apple forces third party apps to use their API and then stuff like this happens. Guess that's also on google, not mitigating that issue, tho.

Have you tried a VPN? I wonder, if Apple manages to expose IP despite a VPN. They had issues with stuff like that before.

[ Parent | on HN ]

Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real... by js2 on Thursday July 02, 2026 @09:25AM (#48761239)

That Received header is inserted by smtp.gmail.com (Google), not Apple.

[ Parent | on HN ]