{"id":46730282,"user":"tmarice","time":1769159697,"time_ago":"a month ago","type":"comment","content":"

I've been using Fastmail for years now, and I'm completely satisfied. Custom domain + built-in masked email functionality works great.","comments":[{"id":46732425,"user":"chrisjj","time":1769176001,"time_ago":"a month ago","type":"comment","content":"

The FM Masked Email is insecure in that there is a circumstance under which it can leak your real email.","comments":[{"id":46743124,"user":"tmarice","time":1769259006,"time_ago":"a month ago","type":"comment","content":"

Do elaborate.","comments":[{"id":46743393,"user":"chrisjj","time":1769261705,"time_ago":"a month ago","type":"comment","content":"

"WARNING: Fastmail Masked Email insecurity" https://www.emaildiscussions.com/showthread.php?t=81287","comments":[{"id":46744706,"user":"tmarice","time":1769270634,"time_ago":"a month ago","type":"comment","content":"

One concrete vulnerability is mentioned in a linked thread and described here https://news.ycombinator.com/item?id=37791500

I have created a ticket with the Fastmail support asking them more details about the vulnerability you mention in your thread, I’m curious to see their response.","comments":[{"id":46744934,"user":"chrisjj","time":1769272255,"time_ago":"a month ago","type":"comment","content":"

There FM said:

> When forwarding an email as an attachment and later checking the headers of the attached email, I could not find the X-resolved-to header

this is odd, no? This header field should remain.

And regarding that FM Privacy First declaration, this is now 404.","comments":[{"id":46745249,"user":"tmarice","time":1769274147,"time_ago":"a month ago","type":"comment","content":"

Well they still claim it is impossible to connect different masked emails together. If you as a sender can reliably determine the target email\naddress, then that claim\nis untrue as well.","comments":[{"id":46745965,"user":"chrisjj","time":1769278264,"time_ago":"a month ago","type":"comment","content":"

Where are they still claiming that?","comments":[{"id":46752528,"user":"tmarice","time":1769335478,"time_ago":"a month ago","type":"comment","content":"

On their Masked Email feature page https://www.fastmail.com/features/masked-email/

> Companies have no way of linking different Masked Email addresses together to track you.

I have received the Fastmail support response, and since they do not consider this a vulnerability, I'll post it here:

- You have a Masked Email

- You have set up forwarding from your Fastmail account to another email service

- The other email service rejects the mail for some reason

- The bounce message goes back to the original sender, and may include the email addresses along the chain after the Masked Email address.

I'm assuming the bounce message contains the X-Resolved-To header mentioned in the other HN thread linked above.","comments":[{"id":46752902,"user":"chrisjj","time":1769338458,"time_ago":"a month ago","type":"comment","content":"

Thanks. I agree. The privacy claim is contradicted by Support's "may include the email addresses along the chain". I note though that I got the opposite answer from Support.

Did you request escalation?","comments":[],"comments_count":0,"level":8,"url":"item?id=46752902"}],"comments_count":1,"level":7,"url":"item?id=46752528"}],"comments_count":2,"level":6,"url":"item?id=46745965"}],"comments_count":3,"level":5,"url":"item?id=46745249"}],"comments_count":4,"level":4,"url":"item?id=46744934"}],"comments_count":5,"level":3,"url":"item?id=46744706"}],"comments_count":6,"level":2,"url":"item?id=46743393"}],"comments_count":7,"level":1,"url":"item?id=46743124"}],"comments_count":8,"level":0,"url":"item?id=46732425"}],"comments_count":9,"url":"item?id=46730282"}

Comment by tmarice