Apple is about to make Hide My Email useless(arseniyshestakov.com) |
Apple is about to make Hide My Email useless(arseniyshestakov.com) |
The addresses are pre-allocated and recycled when deleted so creating a new one is faster that with Apple's hide my mail.
I personally doing catch-all already, but problem is that using your own domain for website registration basically gives everyone unique id to eaaily connect all the information that ever been leaked for your accounts and something always gets leaked.
Not a very good idea for privacy.
And might be there just no one remain as owner of feature to explain them why its bad idea.
It's actually useful compared to Gmail's useless "yourrealaddress+alais" that gives away your actual email anyway, and it helped me catch quite a few spammers/data sellers.
Hide My Email addresses already have a peculiar format that others could guess, and some do block those, and there's no reason to add a blatant "private." tag.
This is a win for privacy-intruders, not users, just like Apple's iCloud Keychain API that has allowed Facebook, TikTok etc. to secretly track users across multiple devices and device reinstalls for years.
But yeah it mostly opposite problem I would say - spam filters eat usefull stuff sometimes. Just today I found one more job related email in spam, but its from public mailbox damn.
Privacy is kind a bigger issue and having aliases on icloud is just much more convinient than having 10 accounts.
Part of the reason to use Hide My Email was that it made keeping myself private hassle-free. Making a system to pre-generate values and then catalog them for later use is quite the hassle.
iCloud+ was the best $1 / month custom domain email and email alias service with 100GB of E2EE cloud drive.
Obviously it will be sad to see it enshittified for seemingly no reason.
No other parking available anywhere near in 30 mins walking distance. (paid or free)
I had to download a 3rd party app that asked me to register. This app isn’t by the Italian government, it’s affiliated though.
So in that situation, I want nothing to do with your website or app, because I wouldn’t able to park.
As of about six months ago, AT&T's web site would not accept email addresses without a three-character TLD. I had to get a customer service person on the phone to manually change my address.
Nothing of it solves privacy though.
Of course this is industry-dependent (I'm in payments processing) and not every business should have this posture, but being able to distinguish between users who are going out of their way to be anonymous and users who aren't is a useful signal.
When an organization invariably leaks my email and I start receiving spam to it, I generate a new one, update my email on record, deactivate the old one, and the spam stops.
It's not a fake e-mail, it's a legitimate e-mail that you can send e-mail to and the user will receive, which has to be created by a paying iCloud user and not an anonymous rando off the internet.
I'd be interested to know what downsides, if any, you see for a website to accept a private e-mail address like this. Do you have a legitimate complaint about these sorts of e-mails? Again, given that private relay isn't an 'anonymous e-mail service' (it's still tied to your iCloud account so spam, etc. shouldn't be any more of an issue) but merely an 'anonymous to the person you're giving the e-mail to' service.
If your actual complaint is 'if you insist on giving me an e-mail that you can revoke unilaterally making me unable to contact you against your wishes, and which cannot be associated with other user data from other sources to build a profile of you, then you're not worth having as a customer' then that's a separate complaint - and one that means I want nothing to do with your website.
Private emails regularly lead to awful customer service interactions because people cannot tell us the email they used to register. Fastmail at least is off the beaten path enough that people probably can understand. Apple, especially using sign in with Apple, is horrid. And not just people unable to tell us the email; they then create multiple accounts; try to sign in on web and use their actual email and then have 2 accounts and flip shit that their stuff is gone; etc. Oh, and regularly blame us for their confusion.
nytimes@mailsub.example.com -> jono@gmail
anything-else@mailsub.example.com -> jono@gmail
You dont even need to materialize aliases at all.
Btw I only use these aliases for sites where I don't mind loosing the login, otherwise it would the mother of all lock-ins... Would have been nice if I could opt for aliases on my own (secondary?) domain... At least then I could still move them (using wildcards or some exported list).
Could someone clarify why having Sign in with Apple and Hide My Email on the same domain would make a blanket ban easier rather than harder? What am I missing?
heave_balks_0g@icloud.com
It shouldn't matter for the sign in with apple because sites are already expressly supporting that.
Email aliasing is hard because you want privacy from a herd of users, but then you're locked into that ecosystem versus a domain you control has no herd, but the upside is no lock-in.
viods01crew@icloud.com
methyl.brick1h@icloud.com
Apple is one of few companies that ia able to push for this with market share.
Now Hide My Email allowed you to do just that: Create an account with an email that wasn't tied to your identity, and that you could just decommission if you didn't need it anymore. Sites had no way to detect these either, because all of the randomly generated addresses Apple provided you with just ended in @icloud.com, which is also used by tons of regular accounts - so if you blocked this domain, you'd invariably preclude millions of people from your service.
But by separating the domains, sites can simply add private.icloud.com to their trash mail blocklist, preventing the use of Hide My Email, while regular @iCloud.com addresses will continue to work. It makes the entire service useless at once.
A good example of a throwaway email that is now useless because of these blocks is mailinator.com. Originally, you could just make up a random email on the spot like gregsrightfoot@mailinator.com, visit mailinator.com, and get the needed signup verification email. These services autodeleted messages and required no signup so they were a black hole for spam. However websites eventually got wise that their spam wasn’t being seen and started blocking the domain. Mailinator came up with alternative domains and there was a brief back and forth before the throwaway email domains all ended up being blocked.
I sure wish 1Password + Fastmail would let you generate them within the 1Password app without requiring a browser sign-up page in the middle.
They already require that you use Sign in with Apple, I would think that it working fully is also a requirement?
Fastmail also has wonderful random email functionality you can link up to your Bitwarden client or use the Fastmail API.
Also, another downside is that you will loose privacy by using your own domain.
And the lack of privacy makes targeted scam/phishing more likely, and targeted scam is the one we are most susceptible to.
All in all, I am not saying this is bad idea, in fact I am doing it myself, just pointing out this is not so black and white.
Using iCloud solves those problems, but puts you at risk of getting your account banned and loosing access to those emails, so there is that.
Probably best way to deal with it is to get dedicated email domain with a bunch of your friends, and hook it up with something like SimpleLogin. But that's gets complicated quickly ;)
If you are worried about privacy, get a domain just for this. Use domain privacy and dont host other things there.
Yes, some sites whitelist domains or dont allow subdomains. For those I'll use another account - or a firefox alias or something. But 9 out of 10 work fine.
I am not a fan of alias services since materializing names takes discipline. How many do you make? Maybe there is a limit of 50. When do you share them across services? My guess is many people just create 2 or 3 aliases they use for everything - which defeats the purpose. Sure, it masks your personal address, but once one gets compromised, you find it basically served as your personal address anyway.
I also dont really keep track of most of the names I use. Since most are one time things that I would never use again, like to sign a waiver or something. But I mostly stick to '{domain}@' for the names. So my nytimes account would just be nytimes@, which is predictable when I need to recover it. I used to use addy.io for this, but it was not as good since it had account limits and I had to manually manage every alias. Much easier for me to just create a mail filter to sinkhole an old name. Of course I have never really needed to do this anyway.
However be warned some surprisingly large websites don't support subdomains, for example eBay will silently send user@sub.domain.tld to user@domain.tld and you'll only figure it out by looking at your server logs for rejected mail.
In those cases I have to specifically alias that username@domain.tld to the subdomain.
With this new Apple privacy subdomain maybe eBay will finally fix this.
But the people usually just nod along.
The other downside is that it's forward-in only, wish I could proxy responses without setting up a whole new inbox (and outbox).
I had one small business aggressively threaten me that they fully owned their business name and I wasn't allowed to use it in my email address.
My solution was to keep my wonderful aliases and dump them. If a business is concerned but nice about it I'll offer an alternative such as plumber@
> The other downside is that it's forward-in only, wish I could proxy responses without setting up a whole new inbox (and outbox).
If you have your own domain most mail providers don't care what username@ you use on your sent mail so you shouldn't need any additional mailboxes (especially if they already offer inbound catch all)
I also use the ReplayAsOriginalRecipientUp [1] extension in Thunderbird which takes the recipient address and puts it as the sender for ongoing communication.
[1]: https://addons.thunderbird.net/en-US/thunderbird/addon/reply...
I was once on the phone with german insurance provider and they dictateted me email to send documents to: kundenbetreuung@passportcard.de
I dont speak German so it was both tough and funny EuroTrip-like moment.
Yes its really email they use.
But to the point of forward-in-only -- I use the fastmail web client and iOS client. Both of these respond using the Masked Email address if you choose to respond to an email. In fact I can choose any of my masked email addressed as I am composing mail to initial communication from that address.
In short, "it just works". I really can't say enough good things about Fastmail!
But keep good records!!
It gets really awkward when you’re trying to recover an account and can’t remember what custom email you used.
Now, they will be "blah@private.icloud.com", so it will be easy to ban the generated/private email that reduces the ability to associate logins across services.
Unclear why Apple would shoot themselves in this way; I hope it's not Ternus complying with anti-privacy.
I've been in the ecosystem long enough to have .iCloud.com, .me, .mobileme.com, iTunes.com, and probably one or two more addresses all assigned by various Apple services over the years before they started unifying the systems.
They all work, and independently of one another.
I wonder if all the domains will be migrated, and how namespace collisions will be handled.
It's like blocking anondaddy, simplelogin etc but not protonmail.
You were always able to reserve a normal icloud email address just like you would a GMail account, so banning all icloud email addresses would be banning non-alias Apple customers
That being said, I'm not convinced anyone who wanted to ban aliases couldn't have already. The alias emails look weird enough I'm guessing you could ban them with few false positives.
While this is true not all of them been weird. Some can be just word + number + word without dots or underscores.
Also blanket banning whole domains is just much easier and already done for temporary emails. No false positives.
It's so hard to build anything big and durable because they've created these steep gradients.
- the apps almost always allow you to remotely increase your stay - the apps almost always allow you to pay by the exact minute instead of by the quarter/half an hour
I'm running a business where I need to know who you are, because my platform can be used defraud other people. If you're trying to hide who you are from our very first interaction, that's a massive red flag.
If you can trivially create hundreds of these emails, and fill in the rest of the required info with bought/stolen/generated PII, now I have a vector for mass fraud. Requiring you to use a recognized non-anonymized provider doesn't stop you, but it sure does slow you down. (It's not this simple of course, but all security works in layers)
If these terms are not acceptable to you, then great! Don't use the website, there's no need to be salty because that's what you said you wanted. Isn't it?
I don't mind either, because the number of legitimate users who are bothered by this restriction is infinitesimal compared to the number of fraudsters who would take advantage if it wasn't in place. It can be difficult to comprehend the scale of platform fraud unless you've worked in this area, many days fraudulent signups outnumber legitimate ones.
That random online shop you order something from once? The IT forum that only shows external links for signed-in users? The whacky new AI tool you want to try out? The startup "sign up for updates" newsletter box? None of these offer Sign in with Apple. For all of them Hide My Email avoids having to disclose your real email address. This is broken now.
I haven't had that, but before I switched to Hide My Email I've had many businesses ask if I was an employee of the business - many people don't intuit the difference between john@bank.com and bank@john.com.
> Existing addresses on the legacy domains will continue to work and forward mail to users without interruption.
We've had to ask you many times to stop breaking the site guidelines. If you keep doing it, we'll end up having to ban you. I don't want to ban you, so please fix this. It shouldn't be hard to make your substantive points without being an asshole.
Problem is that using of own domain is creating huge privacy and cybersecurity risk since you can track all the person profiles across all the databases ever leaked.
Its nice as vanity item, but it's better not to use same domain across banks, online forums and porn sites. ;-)
2. Use the domain exclusively for hosting your own mail, but create a fake account creation page that just temporarily doesn't work.
3. As an added bonus, should you one day get a subpoena for information about one of your site user's online activities, you've got like a 24 hour head start on fleeing the country.
They were literally trained not to value their privacy. The first generation of ipad kids now have driver's licenses.
I'm curious (and not trolling by asking) what a solution might be since email has been used as a unique account identifier for so long it is hard for my brain to think of another option at the moment.
> If your website will block me out because I used a privacy friendly email, I want nothing to do with your website.
I want that company devalued and bought by Verizon or AOL to die a Yahoo death.
What is insane to me is how few people realize their stock has a higher P/E than nVidia… and it isn’t because of some bullshit minor AI data deals. It’s a youth-forward narrative machine, and everyone knows it.
If the future's your oyster for what happens to Reddit, why stop there? If it's bought by somebody, that implies that Spez gets an amount of money that is greater than $0.00. Ideally, we avoid such a grim and unjust outcome. We want it to be made effectively worthless so he goes broke.
But I have only had maybe 3 services ever reject my domain, and those were because the domain contains a number.
I have never encountered one.