There’s a similar service Incogni that sponsors a ton of different Youtubers. I found this video helpful in going through exactly how Incogni claims to work and how it’s less useful than it claims to be:
ISTM there’s a useful distinction to be made between:
- This is a purely criminal scam to take your money and do nothing at all for you. Except maybe steal your identity.
and
- This is a practically useless service that really does try to do what they promise, but the actual need for that thing, and your actual benefit from them doing it for you as poorly as they do are negligible. But at least they’re expensive.
and
- This is a service that does what it promises and that confers actual meaningful benefit to you on a regular basis at a commensurate price.
I’d put all these sorts of identity protection services in that second category. At best. Which to me says their scams-lite.
Thanks for the detailed explanation.
Now that Apple has supposedly fixed the problem a bit more information has been revealed about how it worked. As best I can decipher from this article, when an email is sent to the masking address, and that email is refused by Apple’s servers because it is spam, a trace is left in the sending server’s logs that contains the hidden/real email address.
Bad news is that mail server logs may be retained for a period of time, so hidden/real addresses may be sitting on servers until those logs are rotated out. A few pieces of good news, first lots of spammers don’t bother to keep logs, particularly if they’re using a botnet to send the spam. Just firehose it out, ignoring all errors and anything else that might slow down sending the next message. Second good news is that email server logs aren’t public, so the spammers can’t just scrape Reddit for hidden addresses or anything.
Definitely a problem Apple needed to fix, and they should be embarrassed they let it persist for a year, but not terribly useful in unmasking any particular email address.