iCloud+ Hide My Email addresses will remain on icloud.com

Using icloud.com domain for legit and hidden adresses is such a typical Apple strategy of holding their own users and "others" (ie. other web services, other users etc) hostage simultaneously. But at least here it is actually a good reason that works for the user.

I'm glad they listened - I use this feature extensively and would like to continue to

Can someone explain the backstory behind this? I'm reading some of the comments here and I feel like I'm missing something here.

One of the best things about it. Also being able to add several emails per custom domain for free.

Whole thing is 99c a month. Makes Gmail seem like a joke in comparison.

Until you get an email from an iCloud address on Gmail and see it go right to spam haha. Suddenly Gmail is cheap again

I don't understand how this changes anything. IIRC, the complaints were about Apple making the Hide My Email addresses different than regular ones.

They're now saying the new domain will be private.icloud.com. Isn't it just as targetable?

I've noticed a chilling new trend of apple listening to the community.

Good. What else can really be said? Only way for it to work and not be trivially blocked is to mix with legit emails.

Good. This would have made blocking them trivial.

Good! Was there ever a compelling reason why they went for this switch initially?

That was a stupid idea (the prev one)

I'm glad they listened - I use this feature extensively and would like to continue to

One of the best things about it. Also being able to add several emails per custom domain for free.

Whole thing is 99c a month. Makes Gmail seem like a joke in comparison.

Until you get an email from an iCloud address on Gmail and see it go right to spam haha. Suddenly Gmail is cheap again

I've noticed a chilling new trend of apple listening to the community.

I don't understand how this changes anything. IIRC, the complaints were about Apple making the Hide My Email addresses different than regular ones.

They're now saying the new domain will be private.icloud.com. Isn't it just as targetable?

Maybe it's because I live in a country where e-mai isn't really used that much for personal communication, but wouldn't this mainly be a gmail issue? If mails I wanted ended up in the spam folder I'd not use gmail. I mean, I pay for protonmail, so I wouldn't use gmail to begin with, but if mails I wanted ended up in my protonmail spamfolder and I couldn't do anything about it, then I'd switch away from protonmail.

how is the user being held hostage? you can redirect hide my email addresses to any domain

My guess is Ternus is starting to take more and more control. Tim was pretty absent and phoning it in the past few years.

Hmm it’s almost as if people are paying good money for iCloud+ or something. They aren’t google and shouldn’t be retiring their services as if they’re giving them away for free

Anyone have a theory why this even made it to this point? the switch was such obviously a bad idea. just corporate weirdness that no one there bothered to raise their hand and be like "uh, are we really doing this?" or was there a story here that anyone knows about?

It's talking about two different services:

> Sign in with Apple addresses, previously issued on privaterelay.appleid.com, will be issued on private.icloud.com.

> iCloud+ Hide My Email addresses will remain on icloud.com.

Sign in with Apple is Apple's SSO, like Sign in with Google. Services have to support this one explicitly, and it already had a special subdomain, so the specific subdomain is simply changing.

Hide My Email is the manually generated ones, for websites that accept an arbitrary email address. This is the one where it's valuable for the relays to be identical to genuine iCloud addresses, otherwise websites could try to block it and force you to use a more revealing email address, undermining privacy.

Good. This would have made blocking them trivial.

Good. What else can really be said? Only way for it to work and not be trivially blocked is to mix with legit emails.

That was a stupid idea (the prev one)

It's talking about two different services:

> Sign in with Apple addresses, previously issued on privaterelay.appleid.com, will be issued on private.icloud.com.

> iCloud+ Hide My Email addresses will remain on icloud.com.

Sign in with Apple is Apple's SSO, like Sign in with Google. Services have to support this one explicitly, and it already had a special subdomain, so the specific subdomain is simply changing.

A lot of places also don't really like icloud addresses in general. This is one of Apple's better offerings though.

Good! Was there ever a compelling reason why they went for this switch initially?

Yes, to fully fix a certain class of bug on their infra.

It's email reputation, it the always the answer with this kind of stuff.

My guess is that the bounce rate got too high and bot farms were using iCloud addresses like this.

Maybe hidemyemail allows easily creating many accounts on a site. And some big site didn't like it.

The "Sign-up via Apple" button and creating an iCloud email yourself have a slightly higher barrier than creating a new throwaway hidemyemail email (1 API call w/o captcha/phone verification or whatever).

We might find out later this year if some site starts blocking @icloud.com but keeps allowing @private.icloud.com.

A lot of places also don't really like icloud addresses in general. This is one of Apple's better offerings though.

Yes, to fully fix a certain class of bug on their infra.

Do you know any more about it or have a link where I can read more?

It's email reputation, it the always the answer with this kind of stuff.

My guess is that the bounce rate got too high and bot farms were using iCloud addresses like this.

Maybe hidemyemail allows easily creating many accounts on a site. And some big site didn't like it.

We might find out later this year if some site starts blocking @icloud.com but keeps allowing @private.icloud.com.

The bounce rate of what, exactly?

Because the bounce rate of Hide My Email addresses being deliverable is going to rise over time, by design.

Whenever I start getting spam at an address that's been leaked, I deactivate it. I've done the same with my oldest gmail account, but the work required there is notably higher.

It does, and I know a friend of a friend who uses them for Walmart accounts to bot pokemon drops. Those and office aliases.

Do you know any more about it or have a link where I can read more?

I’ll try to add more later, but it is believed that multiple times, a bug in some random API has allowed for the “hidden” Apple account to be revealed because they resolve hide my emails to the original internally. Using a separate namespace would be the universal fix.

A mitigation for the cause of https://www.404media.co/apple-hide-my-email-vulnerability-re...

https://news.ycombinator.com/item?id=48559935

If you dig more you could find the bug, but AFAIK it was that if you sent a large attachment, the bounce email would contain your real address.

https://news.ycombinator.com/item?id=48559935

If you dig more you could find the bug, but AFAIK it was that if you sent a large attachment, the bounce email would contain your real address.

Can someone explain the backstory behind this? I'm reading some of the comments here and I feel like I'm missing something here.

For the "hide my email" feature, Apple currently and has always used "@icloud.com". This masks you amongst all iCloud users.

They were planning to change it to a custom domain, which would allow sites to easily filter out and reject "Hide my email" users based on the email.

They have now reverted their plans to change this, meaning "hide my email" is still "@icloud.com".

My guess is Ternus is starting to take more and more control. Tim was pretty absent and phoning it in the past few years.

It does, and I know a friend of a friend who uses them for Walmart accounts to bot pokemon drops. Those and office aliases.

If you’re talking about people with the technical sophistication to consider software services based on their technical merits, then sure. Your average user couldn’t even tell you the first thing about which non-content-based criteria might inform a spam score… or have even heard of a spam score. So they will absolutely not blame Gmail if another provider’s email gets spam flagged… they’d probably just think “why don’t they just get a Gmail account,” à la iMessage users/green texts.

You are 100% correct and yet the masses still prefer it.

World’s a twisted place!

I would guess the average Gmail user doesn’t know that it reports virtually all iCloud as Spam - believing instead that it’s genuinely being filtered by quality engineering at Google.

how is the user being held hostage? you can redirect hide my email addresses to any domain

Hmm it’s almost as if people are paying good money for iCloud+ or something. They aren’t google and shouldn’t be retiring their services as if they’re giving them away for free

The bounce rate of what, exactly?

Because the bounce rate of Hide My Email addresses being deliverable is going to rise over time, by design.

Whenever I start getting spam at an address that's been leaked, I deactivate it. I've done the same with my oldest gmail account, but the work required there is notably higher.

A mitigation for the cause of https://www.404media.co/apple-hide-my-email-vulnerability-re...

Marketing turds can't just block registrations from all of @icloud.com.

While I applaud this specific change, Apple has been known to stick to their guns and I used to believe they were almost always in the right for doing so because it led to better outcomes. So my take is that it's chilling because Apple has so lost their way that they can't figure out these obviously stupid directions internally before making a fool of themselves to the public (and I agree with that take).

If they were moved to plain old icloud.com, I could absolutely see a bunch of companies starting to filter out all icloud.com email addresses to avoid private relay. Either just because they’re jerks or from bounce issues.

Keeping it on a subdomain fixes that problem, to some degree. If the user is named ffjvhtu57325cjdjvg501a2@icloud.com no one is going to think that’s a real address. It’s very obviously a private one. So it’s not like they were “camouflaged.“

It’s a little odd they’re switching the subdomain though.

This doesn't follow. The bounce message used to (effectively) say,

> abc@icloud.com forwards to real@gmail.com

If they switched the new domain and did nothing else, it would say:

> abc@privaterelay.appleid.com forwards to real@gmail.com

That's no better. Fixing that privacy leak is unrelated to whatever the destination domain is.

For the "hide my email" feature, Apple currently and has always used "@icloud.com". This masks you amongst all iCloud users.

They were planning to change it to a custom domain, which would allow sites to easily filter out and reject "Hide my email" users based on the email.

They have now reverted their plans to change this, meaning "hide my email" is still "@icloud.com".

I suspect many people actually feel better about Apple owning this fuckup and reversing it than they would have Apple hadn't fucked up in the first place.

You are 100% correct and yet the masses still prefer it.

World’s a twisted place!

I would guess the average Gmail user doesn’t know that it reports virtually all iCloud as Spam - believing instead that it’s genuinely being filtered by quality engineering at Google.

Marketing turds can't just block registrations from all of @icloud.com.

I suspect many people actually feel better about Apple owning this fuckup and reversing it than they would have Apple hadn't fucked up in the first place.

That doesn’t explain how the user is held “hostage” by Apple

It’s a little odd they’re switching the subdomain though.

This doesn't follow. The bounce message used to (effectively) say,

> abc@icloud.com forwards to real@gmail.com

If they switched the new domain and did nothing else, it would say:

> abc@privaterelay.appleid.com forwards to real@gmail.com

That's no better. Fixing that privacy leak is unrelated to whatever the destination domain is.

> If they were moved to plain old icloud.com, I could absolutely see a bunch of companies starting to filter out all icloud.com email addresses to avoid private relay.

I couldn't. "Uses Apple products" is one of the more reliable signals of willingness and ability to spend money on stuff online.

Hide My Email already uses plain old @iCloud.com as the domain.

They are not changing the subdomain. There isn’t one. The announcement is they are leaving it as-is.

The email addresses for sign-in with Apple do use the @private.iCloud.com subdomain, but again, that’s not a change.

Hide My Email addresses are not just a random string at icloud.com. They use plausibly-human names, probably generated by a language model. There’s no easy-to-check pattern.

They’re not switching the subdomain. They’re keeping it the same. That’s the news.

They’re switching the subdomain for the “Sign in with Apple” sign ups, which is not the same service.

Right, but I'm asking "what bounce issues?"

Like for my usage there are no bounce issues with the ~400 legitimate providers that I have Hide My Email addresses from. The only ones with bounce issues are the spammers who've acquired leaked addresses that I've deactivated.

No, using a different domain makes it easy to across the board add a rule: don’t treat as Apple ID.

That doesn’t explain how the user is held “hostage” by Apple

Hostage may be a bad analogy. More like a game of chicken. Imagine you are a regular @icloud.com email user. Apple is basically saying "I dare you to block all @icloud.com email and lose all these customers"