A reported weakness in Hide My Email puts the real security question back on the table: what happens when an alias system can be tied back to the person behind it?