watchOS 8.5 Fixes Mail Privacy Protection Loophole That Could Expose IP Addresses

watchOS 8.5 fixes a security vulnerability in the Mail app that could leak a user's IP address when downloading remote content, security researchers have found.

ios15 mail privacy feature
Last year, it emerged that Apple's Mail Privacy Protection feature was undermined by a lack of Apple Watch support. Mail Privacy Protection was a new feature introduced with iOS 15, iPadOS 15, and macOS Monterey that hides your IP address so senders are not able to determine your location or link email habits to your other online activity. It also prevents senders from tracking whether you opened an email, how many times you viewed an email, and whether you forwarded the email.

The feature works by routing all content downloaded by the Mail app through multiple proxy servers to strip your IP address, and then it assigns a random IP address that corresponds to your general region, making email senders see generic information rather than specific information about you.

Apple's legal documentation on Mail Privacy Protection indicates that the feature is available for iPhone, iPad, and Mac only, but security researchers and developers Talal Haj Bakry and Tommy Mysk discovered that since the Apple Watch does not hide a recipient's IP address, it can compromise the overall security provided by Mail Privacy Protection.

The Apple Watch downloads remote content, such as images, using the recipient's real IP address, both when receiving a Mail notification and when opening an email, meaning that even for users who had enabled Mail Privacy Protection on their ‌iPhone‌, their IP address can be exposed.

While Mail Privacy Protection is a feature exclusive to iOS 15, iPadOS 15, and macOS Monterey, the fact that simply receiving a Mail notification on the Apple Watch could reveal a user's IP address and bypass Mail Privacy Protection on other devices seemed to be an oversight. Now, Bakry and Mysk have found that Apple has fixed the issue in watchOS 8.5.

As of watchOS 8.5, loading remote content is automatically blocked on the Apple Watch, and instead provides an option to "Load Content Directly." Users can also select "Always Load Content Directly" for all new emails or "Ask to Load Content" on a per-email basis. The improvement was not included in watchOS 8.5's release notes.

watchOS 8.5 was released to the public yesterday and the update brings a number of other improvements, including updates to irregular heart rhythm notifications designed to improve atrial fibrillation identification, audio hints in Apple Fitness+ workouts, the ability to authorize Apple TV purchases and subscriptions, and the ability to restore an Apple Watch using an iPhone.

Top Rated Comments

msackey Avatar
16 months ago

The watchOS team really needs a shake-down. I’ve got the newest watch, and it has recently been the glitchiest of all my Apple devices.
Shortcuts on Apple Watch are very glitchy too.

Anytime you have a Prompt with text in which the input is numeric (e.g., “Please input your weight” and the input is numbers only), the Apple Watch will not display the prompt and only ask you to input numbers. When you have a Shortcut with various prompts (e.g., What is your weight? What is your BMI? etc.) you need to see what the prompt is asking otherwise you lose your place and don’t know what the context is for inputting numbers! This doesn’t even need explanining.

This issue has been with us since about the last two Apple WatchOS versions!
Score: 3 Votes (Like | Disagree)
twistedpixel8 Avatar
16 months ago

Security vulnerability is a part of life.

It will always happen.
True, but this one was ridiculous for Apple to miss.
Score: 3 Votes (Like | Disagree)
pdaholic Avatar
16 months ago
The watchOS team really needs a shake-down. I’ve got the newest watch, and it has recently been the glitchiest of all my Apple devices.
Score: 3 Votes (Like | Disagree)
dk001 Avatar
16 months ago
Things like this make you wonder how segregated Apple teams are.
This should not have been missed.
Score: 2 Votes (Like | Disagree)
twistedpixel8 Avatar
16 months ago

The two most egregious glitches for me are the random failure to charge (even with the oem charger) and my inability to turn off screen time downtime. Downtime randomly turns on and I have to reboot the watch to get it to turn off, otherwise the watch is useless. There are other glitches, but those stand out!
I was almost late for work this morning because haptics just completely stopped and my watch alarm is set to vibrate only.
Score: 2 Votes (Like | Disagree)
pdaholic Avatar
16 months ago

Shortcuts on Apple Watch are very glitchy too.

Anytime you have a Prompt with text in which the input is numeric (e.g., “Please input your weight” and the input is numbers only), the Apple Watch will not display the prompt and only ask you to input numbers. When you have a Shortcut with various prompts (e.g., What is your weight? What is your BMI? etc.) you need to see what the prompt is asking otherwise you lose your place and don’t know what the context is for inputting numbers! This doesn’t even need explanining.

This issue has been with us since about the last two Apple WatchOS versions!
The two most egregious glitches for me are the random failure to charge (even with the oem charger) and my inability to turn off screen time downtime. Downtime randomly turns on and I have to reboot the watch to get it to turn off, otherwise the watch is useless. There are other glitches, but those stand out!
Score: 1 Votes (Like | Disagree)

Popular Stories

gradiente iphone white

Brazilian Electronics Company Revives Long-Running iPhone Trademark Dispute

Tuesday May 19, 2020 1:06 pm PDT by
Apple has been involved in a long-running iPhone trademark dispute in Brazil, which was revived today by IGB Electronica, a Brazilian consumer electronics company that originally registered the "iPhone" name in 2000. IGB Electronica fought a multi-year battle with Apple in an attempt to get exclusive rights to the "iPhone" trademark, but ultimately lost, and now the case has been brought to...