News for hackers. Stuff that matters.
Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real... by saagarjha on Wednesday July 01, 2026 @06:37PM (#48754067)
Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real... by lapcat on Wednesday July 01, 2026 @06:53PM (#48754199)
It's not a Gmail thing:

> The reason why my IP address is visible is because Apple Mail sends emails with SMTP.

Unless you use a proxy, your IP address is visible to an SMTP server, just like it's visible to an HTTP server when you use a web browser. This is not specific to Apple Mail or to Gmail.

Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real... by saagarjha on Wednesday July 01, 2026 @08:24PM (#48754864)
Yeah but I think Gmail seems to actually just keep that header rather than nuking it. To be fair I don't entirely know what I would do to fix it since (like the post) this seems like there aren't many good options here.
Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real... by js2 on Wednesday July 01, 2026 @10:10PM (#48755593)
Gmail's SMTP servers are what's adding the received header with your IP address, not Apple Mail.
Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real... by lapcat on Wednesday July 01, 2026 @08:58PM (#48755062)
> I think Gmail seems to actually just keep that header rather than nuking it.

I think that's common among email providers.

Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real... by frollogaston on Wednesday July 01, 2026 @06:45PM (#48754120)
Yes, was able to repro just now
Re:Apple 'Hide My Email' Vulnerability Reveals Peoples' Real... by AnonC on Wednesday July 01, 2026 @11:47PM (#48756294)
I clearly remember many years ago that this wasn’t the case with Gmail, when looking for the source IP address in a case involving harassment of a person. I could only get Gmail’s own IP address in the headers from the multiple emails I examined at that time.

Nevertheless, as js2 said in another comment, it’s your mail provider (in this case Gmail) deciding whether to include the sender’s IP address or not.