This is a huge selling point. Private email relays often get blocked, the only lasting solution is to put them on the same domain as, and in the same format as, a significant number of non-private email addresses. As far as I’m aware the only other provider doing this is Fastmail.
Comments about lock-in aren’t wrong, but it has to be this way. You can make arbitrary email addresses at your own domain, but anybody who feels like it can trivially automatically detect that those are all you.
Personally I use unique at own domain only where I’m identifying myself anyway, like my bank, and Fastmail masked email where I’m not. For most things it’s not actually that terrible to accept a small risk that they’re offline for a day between your being booted without warning and you changing your email address with them.
Totally agree with unique at own domain isn't actually privacy. It wouldn't take much of a paper trail to work out the details.
I continue to use it everywhere for a few reasons:
- if someone emails me acting all friendly like we've had some previous relationship but it's sent to linked@mydomain or github@mydomain I know they've just scraped my contact details and it's spam
- similarly, if a vendor leaks or sells my data and I start receiving marketing from somewhere I don't expect it's easier to trace the source of the leak (and in some cases just blackhole that entire email address)
- I already use a password manager and have different passwords on every site, but having a different email address too raises the barrier further for someone trying to script an automated attack based off some other pwned data set.
> - similarly, if a vendor leaks or sells my data and I start receiving marketing from somewhere I don't expect it's easier to trace the source of the leak (and in some cases just blackhole that entire email address)
This is exactly why I do it, it's eye opening to see exactly which companies leaked your address. As a result of being able to blackhole the leaked addresses I no longer get any spam, the Dvorak dream.
I actually caught a company outright selling my address to AWS of all places, I didn't even know Amazon purchased mailing lists.
AWS were crafty because they didn't directly sell a service, they only offered "resources" for "business leaders" because they knew nothing about what I might need.
Explore the AWS [REDACTED] where business leaders can access eBooks, guides, and customer stories to find practical advice on building or improving upon a data strategy. Learn how you can leverage data as a strategic asset, make better decisions with insights from data, and innovate faster.
I use my gmail address for everything and I don't really get spam (except from services I've subscribed to legitimately but haven't bothered to configure to not send promotional mail).
I never really get promotional mail from 3rd parties at all.
Gmail filters are very good. But if someone with the same name as you starts using your e-mail address for everything because they don't understand or care about needing to see the e-mails they receive then there's very little you can do to stop it other than unsubbing from lists they sign up for (where possible).
I've been getting someone else's e-mail traffic for about 5 years now, on two separate Gmail accounts, and while occasionally hilarious, it is somewhat scary to see how much I can know about their lives from the type of e-mails they get. I have replied to inform some of the senders about the situation with the suggestion that they could tell the other person involved to use a new e-mail address, but it is still happening. You'd think that they would need to see some of the important work-related mail they receive yet they are apparently utterly oblivious.
I occasionally also get similar mail to my own domain through a catch-all filter.
It's quite funny how little some people understand about what an e-mail address is, or how it's supposed to be used, even today.
> very little you can do to stop it other than unsubbing from lists they sign up for (where possible)
It certainly felt that way when someone was giving my GMail out to the cashier at the hardware store where I got no end of digital receipts which I couldn't unsubscribe from because they're providing the email address to the cashier each time. As they were receipts from a large verified brand Google treated them with the highest priority.
I've been in a similar situation for almost a decade now. There's an elderly woman who's email address is one character away on the keyboard from my own, and I often get emails meant for her. I tried for years to respond to inform them that they are using the incorrect email address, to no avail. At this point I've started to go in and disable/cancel anything that is signed up for with my email address and have to aggressively filter spam.
Got it years ago when Gmail was still in beta. My friend sent me an invite and yes I was actually excited to get invited to use the new 'Google Mail'. 1GB mailbox? Wow cool! How times change. The address is mostly dormant but still required for certain services/accounts so I can't just delete it. Probably better to squat it anyway, all things considered.
I agree with all of this. I’d add that it’s useful for sorting and searching. Things like keyword matching, from address, and from domain aren’t as consistent as you’d hope, but companies do need to actually email the address they were given, so you can use it to reliably identify emails from them.
True, but it requires setting up a mailbox at bigdomain.com for every use case. With your own domain you can just setup a catchall mainbox like catchemall@yourdomain.com and don’t even need to remember any mailbox@bigdomain.com name. Just use github@ and it will be automatically be catched by your catchall.
So any mail to anyrandomstring@yourdomain.com is actually received? Sounds like something that works great when only you do it, but might quickly be abused if it catches on?
Going back on topic, Apple offers mail hosting for custom domain, along with the optional “one mailbox, infinite aliases” feature we’re discussing right now. I’ve been using it for a while now and no bot spam. No spam at all actually.
> along with the optional “one mailbox, infinite aliases” feature we’re discussing right now.
They’re not exactly the same thing. Aliases are alternate addresses (under one domain) you set up yourself, while a catch-all just accepts any address in the domain as valid. While iCloud Mail does allow catch-all¹, aliases are capped at a maximum of three².
Surprisingly not. I have catch-all emails on several of my domains, and rarely get common name spam. I've blacklisted less than a dozen names on my domains in over 20 years.
I guess it varies then. When I did it (probably 15 or 20 years ago mind) I unleashed a torrent of spam so voluminous that I had to write scripts to clean it up my inbox after I turned it off again.
A friend of mine does the same. Catch-all, and buying expired domains he thinks funny or related to projects and customers he previously worked with. On multiple occasions he has received emails that truly where never meant for him, not spam but actual emails.
So far I think he's returned at least two domains to their previous owners, because letting them laps was a mistake.
It never happened to me - I use a catch all and almost never got emails like this. Why would bots try to guess emails on random domains when there are billions of known emails to send spam to.
This past weekend, I finally have purchased my own domain and was contemplating using it for email.
I had thought about a catch all, but was worried about bots. What is the best option?
Do you create addresses such as:
eyeball@customdomain.com (for the eye doctor)
tooth@customdomain.com (for the dentist)
bank@customdomain.com
realfirstname@
reddit@
...
...
I would like the ability that if I am in a situation that someone says "give me your email for..." and I would like the ability to just hand them something that is disposable. Would I just stand up say 10 addresses like:
random1, random2, random3... then delete them at some point in the future?
I really like Cloud's Hide My Email, but have been looking for alternatives since I am not sure where Apple is heading post Tim Cook.
I use Migadu to host my email, and they have a really cool wildcard-style system where I can basically define a regex string, and any email address matching that string goes to my main email.
In my case, I use a specific set of numbers just before the @ as the matching string (let’s say, “45”), so email to firstname45@domain works, or doctor45@domain, or library45@domain all get delivered. Since the spammers don’t know this, I don’t get any spam. But I still have the benefit of being able to make up arbitrary emails on the spot for any purpose.
For things I know ahead of time I'm going to need to give someone an email for (e.g. the dentist), I'll pre-make that address and have it ready for when they ask for it. For one-offs / unprepared asks for my email I usually just give them my 'main' initials@personaldomain.com e-mail just for the simplicity... Fastmail does let you use *@personaldomain.com to forward to your main address, but for the rare circumstance in which you need to reply to one of those emails, you do need to configure it in the settings.
Thanks. I really don't use email that often; I might get 20 emails a month, and those are just notifications versus actual actionable communications that require a response.
I have been looking at Fastmail, along with Purelymail ($10/year), which seems to have similar features.
I configured about a dozen domains to have MX records for the mailinator disposable inbox service for about a decade for free as a gift and the domains were toxic for any other email use case for years afterwards… they were so abused you couldn’t even sign up for most web services with any email associated by the time I stopped renewing them… there are still GitHub lists of disposable email addresses that list to blacklist those domains (and many other), so, I agree. If the big providers don’t offer disposable email addresses there is no good option.
So assuming that I wanted a domain, which would be worthless on any mailing listing and pretty much any service, only good for regular emails, then letting them sit a mailinator aliases for a year or so is a good option?
Sadly mailinator and similar services aren't really working anymore.
No - if you did that, you're likely to end up with an email address which many services will treat as suspicious or reject entirely, both for incoming and outbound mail. And you'll still get spam.
The reason it's toxic is because the Venn diagram between disposable email addresses and email addresses used for CSAM is a circle: If you accept disposable email and allow users to upload anything, you will have CSAM.
Whereas a Fastmail masked email or iCloud relay is still in the backend tied to your real account and identity which means it provides privacy generally for you but is traceable enough that it is unappealing for predators.
> You can make arbitrary email addresses at your own domain, but anybody who feels like it can trivially automatically detect that those are all you.
You assume that the domain is used by one person or what?
Also, the point of these is typically to prevent spam. Noone is going to spend a fraction of a cent or second to try and figure out who is behind the adress.
Yep I have a few @firefox.com addresses from the inital launch of Firefox Relay. Come in handy for some of the more stubborn sites that block private addresses.
Using icloud.com domain for legit and hidden adresses is such a typical Apple strategy of holding their own users and "others" (ie. other web services, other users etc) hostage simultaneously. But at least here it is actually a good reason that works for the user.
Seriously, Apple is "big tech," but they are the only one that appears to give a crap about privacy at all. And really, they put a lot of money and effort into it.
We need to give kudos when they are due.
Apple's Private Cloud Compute should have won some kind of Nobel Privacy Prize, which for some reason does not yet exist.
They still don't let me install uBlock origin + noscript. Whitelisting per-domain and per-site what can run Javascript does more for my privacy than anything else, and I can do that with firefox on linux and android, but on iOS I'm not allowed to install firefox.
There's obviously no real technical limitation since if you live in the EU you can sideload an alternative browser in theory (though apple has made it unrealistic in practice since they're ignoring the spirit of the law and instead doing their darndest to resist giving users even a whit of freedom).
They also don’t allow you to install Windows executables. They do allow you to run adblockers designed for Safari, like Wipr, and there are any number of noscript-alikes, like StopTheScript. I’m not saying that to be snarky, but to say that different platforms have different ways of doing things.
And Firefox is in the iOS App Store. I know what you meant to say, and that it’s not the same as Firefox on Android, but it’s wrong to say you’re not allowed to install Firefox.
Since Apple specifically disallows using other web engines on the App Store, I have bad news for you : Firefox on the App Store is just a reskinned safari and as such, a lot of features cannot be implemented because they depend on the web rendering engine.
I also can't use Safari because I want my tabs and bookmarks to sync between my desktop machine (linux) and my phone (iOS), and Safari is the only major browser which can't do that.
Not to mention Safari is just an inferior browser which seems possibly designed to hold back Progressive Web Apps so that everyone has to make app-store apps and tithe a percent of all profits to apple.
In this day and age, privacy is luxury, so that's what they sell.
I don't think there are any ethical motivations for them (or any other large corporation - none of them have morals so they cannot act morally). It's just that there's a market niche, so it will be filled by someone.
Many systems out there have specific exceptions from their VPN policy for iCloud emails and iCloud private relay. Places that would immediately block fastmail because of its alias feature will not block iCloud because too many people use it. Market share is real power. You can ban 0.1% of your customers, you can't ban 30% of your customers.
Sure, but technically proficient users often have other things they want to spend their time on, outside of exercising technical proficiency on every single thing.
Heck, I don’t even do my own oil changes anymore despite it being easy. Life gets busy, you know?
The person you're replying to is saying "Sites I use block all VPNs besides Apple's subscription service VPN" - I'm not sure they're not blocking it just because they fervently believe in Apple's privacy commitments and engineering :)
Only pointing this out because I love Apple's privacy story and don't want your reply to be misconstrued as sarcasm, and thus the reason why it enjoys a singular exemption is because its ineffective.
I’ve never been under the impression that privacy relay is anything like a true VPN. I mostly thought it stopped BS that happens on public WiFi and public sniffing. It’s meant to protect you only until you get to a major carriers infrastructure.
The design is supposed to be better than a true VPN, because neither Apple nor the exit node (Akamai, Cloudflare, Fastly) are supposed to know both who you are and what you’re doing. Of course, Apple pays them for this service, so they could exchange info.
They don't block it because of the publicity it would generate. Social factors matter.
"We blocked people for using special hacker privacy tools. Stop using the special tools if you want service." versus "we blocked people for using the most popular kind of end device. Buy a second, really obscure brand of device if you want service."
(In the US, that is. Outside the US, Android devices are more popular but Apple still has the plurality because there's only one of it)
Private Relay also works because it's on by default for everyone paying for iCloud (including everyone just on the 0.99/month tier for photo backup) - so Apple can use it across their apps (e.g. loading images in Apple Mail) and it doesn't let you single out privacy conscious users!
The user is held hostage as much as the platforms because it's used as "currency" to force other sites to do things they may not want to, i.e. create accounts using private emails, and the platforms are held hostage by these same users expecting to be able to create accounts using their legit or private icloud emails. It looks like some kind of "who will break first", is there a service big enough to be able to block all icloud emails and it'd be a sufficient inconvenience to force apple to rethink how private email works ?
Hostage may be a bad analogy. More like a game of chicken. Imagine you are a regular @icloud.com email user. Apple is basically saying "I dare you to block all @icloud.com email and lose all these customers"
you could say the same thing about AWS or Cloudflare hosting anybody and everybody. Spain actually started blocking a bunch of their IP blocks during football matches due to a poorly thought out legal decision.
I think the other answers are misinterpreting your question. A user is held "hostage" because unlike fastmail where the format is word.salad@yourdomain; if you ever wanted to ditch iCloud completely, you'd have to go through every single account you used it for and update the email. As someone who has shed his gmail account I can tell you it's not easy to update email address on every site you've ever used it on. The issue people are raising is that apple doesn't let you use your own domain, and generate random emails at that domain. Not my complaint, but I can see the perspective.
Yes you can do word.salad@yourdomain with fastmail but that ius no different to other mail providers.
What the above comments re fastmail is about their masked email service this gives addresses like <random>@fastmail.com so this is the same lockin as Apple with the same benefits of noone is going to block that domain.
You say nothing is free, but Amazon, Discord, Dropbox, Facebook, GitHub, Google, Instagram, Microsoft, Paypal, Reddit, Slack, Steam, TikTok, Twitter etc all offer it for free.
Plus, it's not for the dev, it's for the users of the website.
>When you use Sign in with Apple on Safari, Apple sees when you sign in to a website so that Apple can authenticate your sign in, but Apple does not retain a history of what websites you sign in to or when you use Sign in with Apple.
Lying would make money. Apple likes money. Apple has a lot of money. Many other companies that were in positions similar to Apple have been caught lying. The reason for that was money.
It’s so tiring to hear people repeat this automatically without even thinking. It’s true in thumb cases, but in many other cases, the data is more valuable to them to keep private or use for other purposes, or it’s value when the sold is not enough to warrant inclusion in the privacy policies.
You’re adding nothing to the discussion and you should delete your comment
Best thing to do with Gmail spam is to make an auto filter to mark all spam as not spam.
Took me only one missed dentist appointment several years ago to get that idea. Now I'm just getting profits. No other spam since I'm using email aliases.
Unfortunately you can only do that for yourself, your recipients almost certainly aren't doing the same. It doesn't address the "gmail deliverability" issue.
Maybe it's because I live in a country where e-mai isn't really used that much for personal communication, but wouldn't this mainly be a gmail issue? If mails I wanted ended up in the spam folder I'd not use gmail. I mean, I pay for protonmail, so I wouldn't use gmail to begin with, but if mails I wanted ended up in my protonmail spamfolder and I couldn't do anything about it, then I'd switch away from protonmail.
You are 100% correct and yet the masses still prefer it.
World’s a twisted place!
I would guess the average Gmail user doesn’t know that it reports virtually all iCloud as Spam - believing instead that it’s genuinely being filtered by quality engineering at Google.
If you’re talking about people with the technical sophistication to consider software services based on their technical merits, then sure. Your average user couldn’t even tell you the first thing about which non-content-based criteria might inform a spam score… or have even heard of a spam score. So they will absolutely not blame Gmail if another provider’s email gets spam flagged… they’d probably just think “why don’t they just get a Gmail account,” à la iMessage users/green texts.
I suspect many people actually feel better about Apple owning this fuckup and reversing it than they would have Apple hadn't fucked up in the first place.
The post says that "Sign in with Apple" will issue emails on @private.icloud.com but "Hide my email" will continue issuing addresses on @icloud.com
These are two separate services. The problem was with the latter not the former. If the service decides to block @private.icloud.com they might as well remove Apple's sign in button.
Just checked, they can. Phew. If the forwarding alias was detectable/always used the same schema, that'd also make them borderline useless, just like the `privaterelay` subdomain
What do you mean renamed? Alias address certainly are not changeable. You can randomize next one from 2-3 options, but most of them still follow pattern that is easy to recognize.
PS: I guess its just misunderstsnding and I really meant addresses themself are not human-like enough.
But the private relay domain is only used when you sign up through “Sign in with Apple”? A thing you have to support if your iOS app already supports sign up with other third party authentication providers.
iCloud Hide My Email sharing the same domain with normal email (icloud.com) is the reason why I use iCloud over other email alias services like simplelogin and addy.
Anyone have a theory why this even made it to this point? the switch was such obviously a bad idea. just corporate weirdness that no one there bothered to raise their hand and be like "uh, are we really doing this?" or was there a story here that anyone knows about?
Because the bounce rate of Hide My Email addresses being deliverable is going to rise over time, by design.
Whenever I start getting spam at an address that's been leaked, I deactivate it. I've done the same with my oldest gmail account, but the work required there is notably higher.
If they were moved to plain old icloud.com, I could absolutely see a bunch of companies starting to filter out all icloud.com email addresses to avoid private relay. Either just because they’re jerks or from bounce issues.
Keeping it on a subdomain fixes that problem, to some degree. If the user is named ffjvhtu57325cjdjvg501a2@icloud.com no one is going to think that’s a real address. It’s very obviously a private one. So it’s not like they were “camouflaged.“
It’s a little odd they’re switching the subdomain though.
> If they were moved to plain old icloud.com, I could absolutely see a bunch of companies starting to filter out all icloud.com email addresses to avoid private relay.
I couldn't. "Uses Apple products" is one of the more reliable signals of willingness and ability to spend money on stuff online.
Hide My Email addresses are not just a random string at icloud.com. They use plausibly-human names, probably generated by a language model. There’s no easy-to-check pattern.
They’re not switching the subdomain. They’re keeping it the same. That’s the news.
They’re switching the subdomain for the “Sign in with Apple” sign ups, which is not the same service.
> Hide My Email addresses are not just a random string at icloud.com. They use plausibly-human names, probably generated by a language model.
why would random selection from sets of predefined strings and joining them using a "." need any LLM involvement? Oh you need to check if it already taken... maybe for that? I'd use a database though...
These days some people would even generate GUIDs with some language model, I guess...
Like for my usage there are no bounce issues with the ~400 legitimate providers that I have Hide My Email addresses from. The only ones with bounce issues are the spammers who've acquired leaked addresses that I've deactivated.
If you merely deactivate your email address rather than closing your account or changing your notification settings or whatever, then the next time a legitimate service goes to send you a legitimate email that you asked for, it will bounce. In some sense this "shouldn't matter", as in a purely P2P system the only people who would notice are the sender and Apple -- and Apple knows what is going on, so should not penalize senders the way, say, Google would if they see you sending a ton of email to their domains and they all bounce -- but people tend to use services to help send email and centrally pool their reputation (such as mailchimp) and so these services themselves then watch the bounce rate of their individual customers and either charge them more or ban their access due to the bounce rate increase.
Is Apple really stupid enough that they BOUNCE emails after you deactivate, rather than just silent discard? What's the point of bouncing unwanted emails these days? It's not like these bounces go to humans who go "Oh, gee! This address must not work. Allow me to go and figure out how to contact him!" It's just a stream of full-on spam with completely fake return addresses, and crap from email campaign software.
Maybe hidemyemail allows easily creating many accounts on a site. And some big site didn't like it.
The "Sign-up via Apple" button and creating an iCloud email yourself have a slightly higher barrier than creating a new throwaway hidemyemail email (1 API call w/o captcha/phone verification or whatever).
We might find out later this year if some site starts blocking @icloud.com but keeps allowing @private.icloud.com.
Whoever operates the smtp servers for icloud.com complained loudly enough that their job was too hard because of all the traffic, but not loudly enough for someone smart enough to hear about it, until it was announced to the public.
Hmm it’s almost as if people are paying good money for iCloud+ or something. They aren’t google and shouldn’t be retiring their services as if they’re giving them away for free
While I applaud this specific change, Apple has been known to stick to their guns and I used to believe they were almost always in the right for doing so because it led to better outcomes. So my take is that it's chilling because Apple has so lost their way that they can't figure out these obviously stupid directions internally before making a fool of themselves to the public (and I agree with that take).
private.icloud.com (née privaterelay.appleid.com) is the address for “Sign In With Apple”, which is an oauth-style service that sites opt into to let you use your Apple ID to sign in. Sites offering this as a signup option are already aware it gives users an option to use a private anonymized email address.
The toplevel “Hide My Email” iCloud feature is a different thing, can be done independently of a SIWA flow (you can just go into settings and make more addresses, all it needs is a name and a notes field) and uses @icloud.com in order to make your anonymized email address look indistinguishable from other iCloud users.
The former is “filterable”, yes, but it’s moot because you only get those if you offer Sign In With Apple in the first place, and if you want real emails, you would already know to just… not do that.
The latter is very much not filterable.
The confusing thing though, is that when a user uses Sign In With Apple, they are offered two options: “share my email” which gives the site your real address, and “hide my email” which gives an @private.appleid.com address. But this “hide my email” option is a totally different thing from the separate “hide my email” service, which lets you make arbitrarily many @icloud.com private aliases to forward to your real address. Critically, the latter toplevel Hide My Email feature works with sites that don’t use Sign In With Apple. It’s just stupidly unfortunate that Apple calls both of these features “hide my email.”
Agree with the comment largely; though: Apple does have a policy where apps need to use SIWA if other oauth providers are present (Google) [0]. So sites do "opt in" to this, but are forced by apple to use SIWA if they're using any other provider.
Others have addressed the validity of your comment, but I’d like to discuss another aspect. Even if it is filter, I think most people would not want to filter. Apple makes it very easy to use private relay and many people that buy Apple products do use private relay. Even if you know, it’s a private relay email address, surely you want a user who buys expensive technology products to use your website in almost all circumstances.
I wonder if the initial reason to move them to a separate domain, was because they started to see providers blackholing icloud.com anyway, thus also hurting non-aliased emails?
If so, will be interesting to see if that will get worse.
I think the post is very explicit. First sentence:
> Starting later this year, new Sign in with Apple addresses, previously issued on privaterelay.appleid.com, will be issued on private.icloud.com. Existing addresses on privaterelay.appleid.com will continue to work and forward mail to users without interruption.
That's the Sign in with Apple domain, not the Hide My Email domain. HME is remaining at icloud.com instead of moving to private.icloud.com as well. From the linked article:
> After further consideration and reviewing community feedback, iCloud+ Hide My Email addresses will remain on icloud.com.
Sign in with Apple is Apple's SSO, like Sign in with Google. Services have to support this one explicitly, and it already had a special subdomain, so the specific subdomain is simply changing.
Hide My Email is the manually generated ones, for websites that accept an arbitrary email address. This is the one where it's valuable for the relays to be identical to genuine iCloud addresses, otherwise websites could try to block it and force you to use a more revealing email address, undermining privacy.
this opens some crazy "apple developer" dialog on my mac rather than a web page. I had to crank up chrome to read it. And it makes no sense, I have no clue what a sign on with apple address is. I guess I'm glad my hide my email addresses won't change because that would be a PITA.
I’ll try to add more later, but it is believed that multiple times, a bug in some random API has allowed for the “hidden” Apple account to be revealed because they resolve hide my emails to the original internally. Using a separate namespace would be the universal fix.
It is reassuring to see Apple maintaining this domain consistency. Changing it would have broken a lot of automated routing rules for those of us relying on it for privacy.
Comments about lock-in aren’t wrong, but it has to be this way. You can make arbitrary email addresses at your own domain, but anybody who feels like it can trivially automatically detect that those are all you.
Personally I use unique at own domain only where I’m identifying myself anyway, like my bank, and Fastmail masked email where I’m not. For most things it’s not actually that terrible to accept a small risk that they’re offline for a day between your being booted without warning and you changing your email address with them.
I continue to use it everywhere for a few reasons:
- if someone emails me acting all friendly like we've had some previous relationship but it's sent to linked@mydomain or github@mydomain I know they've just scraped my contact details and it's spam
- similarly, if a vendor leaks or sells my data and I start receiving marketing from somewhere I don't expect it's easier to trace the source of the leak (and in some cases just blackhole that entire email address)
- I already use a password manager and have different passwords on every site, but having a different email address too raises the barrier further for someone trying to script an automated attack based off some other pwned data set.
This is exactly why I do it, it's eye opening to see exactly which companies leaked your address. As a result of being able to blackhole the leaked addresses I no longer get any spam, the Dvorak dream.
I actually caught a company outright selling my address to AWS of all places, I didn't even know Amazon purchased mailing lists.
AWS were crafty because they didn't directly sell a service, they only offered "resources" for "business leaders" because they knew nothing about what I might need.
Explore the AWS [REDACTED] where business leaders can access eBooks, guides, and customer stories to find practical advice on building or improving upon a data strategy. Learn how you can leverage data as a strategic asset, make better decisions with insights from data, and innovate faster.
I use my gmail address for everything and I don't really get spam (except from services I've subscribed to legitimately but haven't bothered to configure to not send promotional mail).
I never really get promotional mail from 3rd parties at all.
Is this just gmail filters being very good?
Even the simplest bayesian filter will score better than gmail.
But might gmail junk filters be the best junk mail filters for nefarious proprietary reasons, possibly?
I've been getting someone else's e-mail traffic for about 5 years now, on two separate Gmail accounts, and while occasionally hilarious, it is somewhat scary to see how much I can know about their lives from the type of e-mails they get. I have replied to inform some of the senders about the situation with the suggestion that they could tell the other person involved to use a new e-mail address, but it is still happening. You'd think that they would need to see some of the important work-related mail they receive yet they are apparently utterly oblivious.
I occasionally also get similar mail to my own domain through a catch-all filter.
It's quite funny how little some people understand about what an e-mail address is, or how it's supposed to be used, even today.
It certainly felt that way when someone was giving my GMail out to the cashier at the hardware store where I got no end of digital receipts which I couldn't unsubscribe from because they're providing the email address to the cashier each time. As they were receipts from a large verified brand Google treated them with the highest priority.
Much better to maintain an explicit list of names you're currently allowing.
They’re not exactly the same thing. Aliases are alternate addresses (under one domain) you set up yourself, while a catch-all just accepts any address in the domain as valid. While iCloud Mail does allow catch-all¹, aliases are capped at a maximum of three².
¹ https://support.apple.com/en-gb/guide/icloud/mm9e3ee0680f/ic...
² https://support.apple.com/en-gb/guide/icloud/mm074af79454/ic...
So far I think he's returned at least two domains to their previous owners, because letting them laps was a mistake.
I had thought about a catch all, but was worried about bots. What is the best option?
Do you create addresses such as:
I would like the ability that if I am in a situation that someone says "give me your email for..." and I would like the ability to just hand them something that is disposable. Would I just stand up say 10 addresses like:random1, random2, random3... then delete them at some point in the future?
I really like Cloud's Hide My Email, but have been looking for alternatives since I am not sure where Apple is heading post Tim Cook.
Migadu has been on my radar also, and at $19/yr it is worth giving it a try.
Fastmail is probably the best $60/year I spend
I have been looking at Fastmail, along with Purelymail ($10/year), which seems to have similar features.
Sadly mailinator and similar services aren't really working anymore.
Whereas a Fastmail masked email or iCloud relay is still in the backend tied to your real account and identity which means it provides privacy generally for you but is traceable enough that it is unappealing for predators.
You assume that the domain is used by one person or what?
Also, the point of these is typically to prevent spam. Noone is going to spend a fraction of a cent or second to try and figure out who is behind the adress.
Yes. It's not a guarantee but you can identify several strong signals that suggest that.
> point is to prevent spam
also yes
Same thoughts. I'm annoyed with the number of services that blocks alias domains.
At least I don't see services attempting to block @icloud.com domains.
We need to give kudos when they are due.
Apple's Private Cloud Compute should have won some kind of Nobel Privacy Prize, which for some reason does not yet exist.
There's obviously no real technical limitation since if you live in the EU you can sideload an alternative browser in theory (though apple has made it unrealistic in practice since they're ignoring the spirit of the law and instead doing their darndest to resist giving users even a whit of freedom).
And Firefox is in the iOS App Store. I know what you meant to say, and that it’s not the same as Firefox on Android, but it’s wrong to say you’re not allowed to install Firefox.
Also Brave supports per site JavaScript blocking on iOS.
So there’s more privacy tools available than you think/assume.
https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...
I also can't use Safari because I want my tabs and bookmarks to sync between my desktop machine (linux) and my phone (iOS), and Safari is the only major browser which can't do that.
Not to mention Safari is just an inferior browser which seems possibly designed to hold back Progressive Web Apps so that everyone has to make app-store apps and tithe a percent of all profits to apple.
In this day and age, privacy is luxury, so that's what they sell.
I don't think there are any ethical motivations for them (or any other large corporation - none of them have morals so they cannot act morally). It's just that there's a market niche, so it will be filled by someone.
Heck, I don’t even do my own oil changes anymore despite it being easy. Life gets busy, you know?
Apple sells hardware, Google is an ad company.
Superbowl ads, TV ads, radio ads, print ads, billboard ads, public transit ads, youtube ads, podcast ads, search ads, e-mail ads, social media ads, in-app ads, in-store ads, sports team sponsorship, individual athlete sponsorship, stadium naming, product placement ads, elevator ads, cinema ads, bathroom ads.
And Coca-Cola doesn't increase their advertising budget just because someone finds a new place to slap ads on - they just re-allocate their spending.
Sure, Google and Facebook make a good chunk of money from ads. But it's a very, very competitive business.
if any, Apple user are the most expensive ads money industry willing to pay for
they advertise that they do. that is not the same as doing
Apple literally wanted to scan all your photos and automatically report you to law enforcement if a fuzzy hash happened to match an opaque database.
Only pointing this out because I love Apple's privacy story and don't want your reply to be misconstrued as sarcasm, and thus the reason why it enjoys a singular exemption is because its ineffective.
It is not a VPN only in the technical approach.
"We blocked people for using special hacker privacy tools. Stop using the special tools if you want service." versus "we blocked people for using the most popular kind of end device. Buy a second, really obscure brand of device if you want service."
(In the US, that is. Outside the US, Android devices are more popular but Apple still has the plurality because there's only one of it)
Its only upside was a fact that it was actual VPN for all the apps while AFAIK private relay limited to Safari.
What the above comments re fastmail is about their masked email service this gives addresses like <random>@fastmail.com so this is the same lockin as Apple with the same benefits of noone is going to block that domain.
If you want to degoogle, you still have to go to each site and change your staticuser@gmail.com individually.
Most users already do not use custom domains if that's the catch.
Is it a benefit to you? If it is why should you not pay for that benefit?
Nothing is free.
Plus, it's not for the dev, it's for the users of the website.
https://www.apple.com/legal/privacy/data/en/sign-in-with-app...
>When you use Sign in with Apple on Safari, Apple sees when you sign in to a website so that Apple can authenticate your sign in, but Apple does not retain a history of what websites you sign in to or when you use Sign in with Apple.
You’re adding nothing to the discussion and you should delete your comment
No leaked email address, no need for anyone to store password, people using iCloud instead of Gmail.
What they're asking, for it to cost zero, sounds perfectly reasonable here.
Whole thing is 99c a month. Makes Gmail seem like a joke in comparison.
Until you get an email from an iCloud address on Gmail and see it go right to spam haha. Suddenly Gmail is cheap again
Took me only one missed dentist appointment several years ago to get that idea. Now I'm just getting profits. No other spam since I'm using email aliases.
World’s a twisted place!
I would guess the average Gmail user doesn’t know that it reports virtually all iCloud as Spam - believing instead that it’s genuinely being filtered by quality engineering at Google.
Yes, vendor lock in sucks, but I have $20k worth of apple hardware already so that ship has sailed and overall Im pretty happy with it.
been a user for a couple years now and no complaints
Neither visa nor MasterCard networks have the ability to verify cardholder name.
Everyone behaves as if they do, but your name cannot be verified.
Which is to say, all of these cards have name anonymization, not just robinhood.
But I haven't tried this, so ymmv.
https://en.wikipedia.org/wiki/Address_verification_service#:...
Vendors like Stripe may do more than Visa/MC though.
They were planning to change it to a custom domain, which would allow sites to easily filter out and reject "Hide my email" users based on the email.
They have now reverted their plans to change this, meaning "hide my email" is still "@icloud.com".
Whereas people's Apple emails are often at @icloud.com
So I don't think it masks you amongst all iCloud users. I'm confused how this is much better!
These are two separate services. The problem was with the latter not the former. If the service decides to block @private.icloud.com they might as well remove Apple's sign in button.
UPD: I obviously mean alias addresses template make most of them too easy to recognize.
---
Just checked, they can. Phew. If the forwarding alias was detectable/always used the same schema, that'd also make them borderline useless, just like the `privaterelay` subdomain
PS: I guess its just misunderstsnding and I really meant addresses themself are not human-like enough.
Now if they could completely remove liquid glass...
The reason for random email addresses is YOU finally can identify each vendor uniquely by the email they send you stuff.
It isn't about anonymizing, it's about identifying them.
I've been doing it for 30+ years on my own domains.
For example, I can have hn@mydomain.com for hn only mails, if they share my mail address, I'll know.
My guess is that the bounce rate got too high and bot farms were using iCloud addresses like this.
Because the bounce rate of Hide My Email addresses being deliverable is going to rise over time, by design.
Whenever I start getting spam at an address that's been leaked, I deactivate it. I've done the same with my oldest gmail account, but the work required there is notably higher.
Keeping it on a subdomain fixes that problem, to some degree. If the user is named ffjvhtu57325cjdjvg501a2@icloud.com no one is going to think that’s a real address. It’s very obviously a private one. So it’s not like they were “camouflaged.“
It’s a little odd they’re switching the subdomain though.
I couldn't. "Uses Apple products" is one of the more reliable signals of willingness and ability to spend money on stuff online.
They are not changing the subdomain. There isn’t one. The announcement is they are leaving it as-is.
The email addresses for sign-in with Apple do use the @private.iCloud.com subdomain, but again, that’s not a change.
They’re not switching the subdomain. They’re keeping it the same. That’s the news.
They’re switching the subdomain for the “Sign in with Apple” sign ups, which is not the same service.
why would random selection from sets of predefined strings and joining them using a "." need any LLM involvement? Oh you need to check if it already taken... maybe for that? I'd use a database though...
These days some people would even generate GUIDs with some language model, I guess...
The generated words agree in grammatical gender and plural forms, so by definition it’s a language model.
Like for my usage there are no bounce issues with the ~400 legitimate providers that I have Hide My Email addresses from. The only ones with bounce issues are the spammers who've acquired leaked addresses that I've deactivated.
The "Sign-up via Apple" button and creating an iCloud email yourself have a slightly higher barrier than creating a new throwaway hidemyemail email (1 API call w/o captcha/phone verification or whatever).
We might find out later this year if some site starts blocking @icloud.com but keeps allowing @private.icloud.com.
The toplevel “Hide My Email” iCloud feature is a different thing, can be done independently of a SIWA flow (you can just go into settings and make more addresses, all it needs is a name and a notes field) and uses @icloud.com in order to make your anonymized email address look indistinguishable from other iCloud users.
The former is “filterable”, yes, but it’s moot because you only get those if you offer Sign In With Apple in the first place, and if you want real emails, you would already know to just… not do that.
The latter is very much not filterable.
The confusing thing though, is that when a user uses Sign In With Apple, they are offered two options: “share my email” which gives the site your real address, and “hide my email” which gives an @private.appleid.com address. But this “hide my email” option is a totally different thing from the separate “hide my email” service, which lets you make arbitrarily many @icloud.com private aliases to forward to your real address. Critically, the latter toplevel Hide My Email feature works with sites that don’t use Sign In With Apple. It’s just stupidly unfortunate that Apple calls both of these features “hide my email.”
[0]: https://developer.apple.com/app-store/review/guidelines/#sig...
However filtering for these hide my e-mail addresses is quite easy if you are motivated to do it, they have a recognizable pattern.
If so, will be interesting to see if that will get worse.
rtwnj6tj7@privaterelay.appleid.com
> Starting later this year, new Sign in with Apple addresses, previously issued on privaterelay.appleid.com, will be issued on private.icloud.com. Existing addresses on privaterelay.appleid.com will continue to work and forward mail to users without interruption.
> After further consideration and reviewing community feedback, iCloud+ Hide My Email addresses will remain on icloud.com.
A lot of those are Hide My Email aliases that, by design, you can’t tell apart from real human addresses.
They're now saying the new domain will be private.icloud.com. Isn't it just as targetable?
> Sign in with Apple addresses, previously issued on privaterelay.appleid.com, will be issued on private.icloud.com.
> iCloud+ Hide My Email addresses will remain on icloud.com.
Hide My Email is the manually generated ones, for websites that accept an arbitrary email address. This is the one where it's valuable for the relays to be identical to genuine iCloud addresses, otherwise websites could try to block it and force you to use a more revealing email address, undermining privacy.
Sign in with Apple email addresses are email addresses for the Sign in with Apple button.
A mitigation for the cause of https://www.404media.co/apple-hide-my-email-vulnerability-re...
> abc@icloud.com forwards to real@gmail.com
If they switched the new domain and did nothing else, it would say:
> abc@privaterelay.appleid.com forwards to real@gmail.com
That's no better. Fixing that privacy leak is unrelated to whatever the destination domain is.
If you dig more you could find the bug, but AFAIK it was that if you sent a large attachment, the bounce email would contain your real address.
02 Jul 2026 03:47:04 UTC | Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses | https://www.404media.co/apple-hide-my-email-vulnerability-re... | https://news.ycombinator.com/item?id=48756295
03 Jul 2026 22:56:51 UTC | Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses | https://www.404media.co/apple-hide-my-email-vulnerability-re... | https://news.ycombinator.com/item?id=48780999
04 Jul 2026 17:01:39 UTC | Security Roundup: Apple's Hide My Email Service Fails to Hide Your Email | https://www.wired.com/story/security-roundup-apples-hide-my-... | https://news.ycombinator.com/item?id=48786928
04 Jul 2026 18:54:24 UTC | Apple Hide My Email Reveals the Users Real Email | https://www.404media.co/apple-hide-my-email-vulnerability-re... | https://news.ycombinator.com/item?id=48787842
05 Jul 2026 06:26:38 UTC | Security Roundup: Apple's Hide My Email Service Fails to Hide Your Email | https://www.wired.com/story/security-roundup-apples-hide-my-... | https://news.ycombinator.com/item?id=48791735
07 Jul 2026 02:16:06 UTC | Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses | https://www.404media.co/apple-hide-my-email-vulnerability-re... | https://news.ycombinator.com/item?id=48812946
12 Jul 2026 01:05:37 UTC | Apple Hide My Email bug, possibly related to disclosure vulnerability | https://lapcatsoftware.com/articles/2026/7/2.html | https://news.ycombinator.com/item?id=48877353
Recommended reading:
19 Aug 2026 15:22:13 UTC | Alvarez vs. Apple, Inc. (N.D. Cal., July 15, 2026) [pdf] | https://ia803202.us.archive.org/25/items/gov.uscourts.cand.4... | https://news.ycombinator.com/item?id=49362811
21 Jul 2026 15:31:41 UTC | Apple Fixes Hide My Email Vulnerability After 404 Media Coverage | https://www.404media.co/apple-fixes-hide-my-email-vulnerabil... | https://news.ycombinator.com/item?id=48993637
23 Jul 2026 20:11:07 UTC | How Apple's Hide My Email exploit worked and why you're still at risk | https://easyoptouts.com/guides/apple-hide-my-email-was-leaki... | https://news.ycombinator.com/item?id=49027365
24 Aug 2026 20:24:44 UTC | Apple Won't Change Hide My Email Domain After Backlash | https://www.macrumors.com/2026/08/24/apple-hide-my-email-dom... | https://news.ycombinator.com/item?id=49425379