4 ms·

Someone commented on that page that leaking user's IP address is a common spam-prevention practice. I just checked gmail and Yahoo Mail, and they both include m

Someone commented on that page that leaking user's IP address is a common spam-prevention practice. I just checked gmail and Yahoo Mail, and they both include my IP address in the header of outgoing messages For instance, Yahoo Mail puts my IP address in a line like this Received: from [xxx.xxx.xxx.xxx]

rm-rf 16y ago
Correct - Yahoo and others put the IP address of the client that sent the mail in the SMTP headers. Example: Received: from [x.x.x.x] by web113916.mail.gq1.yahoo.com via HTTP; Fri, 07 May 2010 18:59:00 PDT In this test case, x.x.x.x is my current IP address, not Yahoo!'s. The HTTP indicates that I used a browser, not POP/IMAP. They've been doing that for years. It's handy as heck when you need to track an e-mail - you don't have to bother Yahoo with a subpoena - you can go right to the client's ISP. There is no reason Facebook shouldn't do the same thing. Edit: Comcast does: X-Originating-IP: [x.x.x.x] Google is weird: Received: by 10.216.27.139 with HTTP; Fri, 7 May 2010 19:34:21 -0700 (PDT) I'm not on a 10.x address. Hmmm....
- known 16y ago
  Headers of http://groups.google.com/ http://groups.google.com/ posts reveal IP address
mikexstudios 16y ago
I thought Gmail doesn't include the sender's IP address in their outgoing mail: http://mail.google.com/support/bin/answer.py?hl=en&answer=26903 http://mail.google.com/support/bin/answer.py?hl=en&answe....
- alexyim 16y ago
  "IP addresses can be considered sensitive information. As such, Gmail may hide sender IP address information from outgoing mail headers in some circumstances." They only said they may hide it.
danieldon 16y ago
How did you send it using gmail? I just sent two via the web interface, one to a gmail account and another to a non-gmail account, the originating ip is 209.85.221.175 (a google ip address) and my current IP doesn't show up anywhere in the headers. Edit: it doesn't show up base64 encoded, either.
- yellowbkpk 16y ago
  I don't see my IP in the headers of mail sent from GMail, either. I also tried sending via my phone and got the same results.
- ohashi 16y ago
  Been trying to figure that out for ages... if there really is a way that would be huge.
- mct 16y ago
  gmail reveals the sender's IP address only when sending mail via (authenticated) SMTP. The IP address is hidden when sending mail via the web interface.
- yaroslavvb 16y ago
  I sent it using gmail's web interface. My IP address shows up in "X-Originating-IP" part of header
LiveTheDream 16y ago
I can see that Yahoo mail adds the originating IP address, but not Gmail.
brlewis 16y ago
When I wrote a web-to-email gateway in 1994 it added a Received header with the web client IP address. Back then it was a harassment-prevention practice, because spam was either nonexistent or not a problem.
nebula 16y ago
IMO, Email systems originally have been designed that way to facilitate traceability. When webmail came, it's natural that they followed this practice. Facebook is a closed system. When you send a message to someone on Facebook, you presume that you are adding that message within Facebook. The notification email that Facebook sends to the recipient is just that, a notification generated by the Facebook system. You, the sender of the message is not part of this notification system, though you your action triggered the notification. There is no reason why the sender's IP should be exposed in this flow under normal circumstances.

rm-rf 16y ago

Correct - Yahoo and others put the IP address of the client that sent the mail in the SMTP headers. Example: Received: from [x.x.x.x] by web113916.mail.gq1.yahoo.com via HTTP; Fri, 07 May 2010 18:59:00 PDT In this test case, x.x.x.x is my current IP address, not Yahoo!'s. The HTTP indicates that I used a browser, not POP/IMAP. They've been doing that for years. It's handy as heck when you need to track an e-mail - you don't have to bother Yahoo with a subpoena - you can go right to the client's ISP. There is no reason Facebook shouldn't do the same thing. Edit: Comcast does: X-Originating-IP: [x.x.x.x] Google is weird: Received: by 10.216.27.139 with HTTP; Fri, 7 May 2010 19:34:21 -0700 (PDT) I'm not on a 10.x address. Hmmm....

known 16y ago
Headers of http://groups.google.com/ http://groups.google.com/ posts reveal IP address

mikexstudios 16y ago

I thought Gmail doesn't include the sender's IP address in their outgoing mail: http://mail.google.com/support/bin/answer.py?hl=en&answer=26903 http://mail.google.com/support/bin/answer.py?hl=en&answe....

alexyim 16y ago
"IP addresses can be considered sensitive information. As such, Gmail may hide sender IP address information from outgoing mail headers in some circumstances." They only said they may hide it.

danieldon 16y ago

How did you send it using gmail? I just sent two via the web interface, one to a gmail account and another to a non-gmail account, the originating ip is 209.85.221.175 (a google ip address) and my current IP doesn't show up anywhere in the headers. Edit: it doesn't show up base64 encoded, either.

yellowbkpk 16y ago
I don't see my IP in the headers of mail sent from GMail, either. I also tried sending via my phone and got the same results.
ohashi 16y ago
Been trying to figure that out for ages... if there really is a way that would be huge.
mct 16y ago
gmail reveals the sender's IP address only when sending mail via (authenticated) SMTP. The IP address is hidden when sending mail via the web interface.
yaroslavvb 16y ago
I sent it using gmail's web interface. My IP address shows up in "X-Originating-IP" part of header

LiveTheDream 16y ago

I can see that Yahoo mail adds the originating IP address, but not Gmail.

brlewis 16y ago

When I wrote a web-to-email gateway in 1994 it added a Received header with the web client IP address. Back then it was a harassment-prevention practice, because spam was either nonexistent or not a problem.

nebula 16y ago

IMO, Email systems originally have been designed that way to facilitate traceability. When webmail came, it's natural that they followed this practice. Facebook is a closed system. When you send a message to someone on Facebook, you presume that you are adding that message within Facebook. The notification email that Facebook sends to the recipient is just that, a notification generated by the Facebook system. You, the sender of the message is not part of this notification system, though you your action triggered the notification. There is no reason why the sender's IP should be exposed in this flow under normal circumstances.