Could email aliasing services ever leak your actual email?

[not-wittingly]

I don’t think this has ever happened and don’t have a reason to believe it will. I’m just thinking for high risk things, like ordering a hardware wallet, if it could be even better practice to have a genuine burner email, rather than your man email hidden by an alias?

How does the infrastructure work on the back end, and is it extremely unlikely this would ever happen?

Thinking mostly for SimpleLogin and addy io

Side question: what’s your favourite email aliasing service and why

[anon64393658]

It absolutely can happen and has to Apple’s alias service:

Apple ‘Hide My Email’ Vulnerability Reveals Peoples’ Real Email Addresses

”Apple Hide My Email is leaking email addresses that are supposed to be hidden. We reported the issue and replication instructions to Apple over a year ago. We don’t know why it hasn’t been fixed, but we don’t feel comfortable waiting any longer. Hide My Email users deserve to know that it may be possible for attackers to discover their hidden email addresses,” Tyler Murphy, the co-founder of EasyOptOuts, which discovered and reported the issue to Apple, told 404 Media.

Alias services like Simple Login are good for basic privacy like preventing spam/corporate surveillance. However, for anything very sensitive (like ordering a hardware wallet) I would recommend a dedicated burner account.

[not-wittingly]

Oh shit I thought that was just the IP address it could leak, not the whole email. Thanks for the source.

[securitybrahh (Sovereign Shadow)]

Forwardemail vanity domains are worth looking into.

[ZenByte]

If you send a password protected email in ProtonMail from a proton pass alias, Proton reveals your actual proton email to the recipient.

The recipient will receive an email from your alias in which the body says:

“You have received an encrypted email from [your actual Proton email address].”

Password protecting a Proton alias email revealed my actual Proton email address

I needed to send sensitive documents to a business. Their system blocks encrypted files so that wasn’t an option and we were struggling to come up with a way they would accept it. I guess I’m the first person they interacted with that cares about encrypting sensitive files. They agreed to accept the password protecting email that Proton offers . I have a free Proton account currently and for this business, I use a Proton Pass alias. Since I’m paranoid and wanted to make sure it worked properly,…

[not-wittingly]

@ZenByte

If you send a password protected email in ProtonMail from a proton pass alias, Proton reveals your actual proton email to the recipient.

Holy shit I just just tested that and you’re right. Is Proton aware of this, if so for how long, and are they doing anything to fix it? That’s really bad.