8 ms·

Show HN: Test your E-Mail for IP Leaks

50 points by rasengan 13y ago

rasengan 13y ago
If you are worried about your e-mail, simply create a secondary/throw away e-mail with a similar setup to test.
sfrechtling 13y ago
I first interpreted this as "intellectual property" leaks.
- lstamour 13y ago
  Same. I was rather confused. :)
andreaso 13y ago
You know, IPv6... I'm getting a false "Your email has been received and it doesn't leak your IP", due to the fact that the web site is only available using IPv4 while I'm connecting to my SMTP server over IPv6. As long as the website only captures IPv4 addresses it really might need to display an inconclusive result in the presence of IPv6 received headers. Oh, and when the web site do become IPv6 reachable you probably will want to make an explicit attempt to also catch a potential IPv4 address, in the case situation above is the reverse.
- alextingle 13y ago
  Me too.
pallandt 13y ago
I just tested this out of curiosity to see if it showed me anything else other than what I could already easily find out by myself via just sending myself an email and looking at the headers. It doesn't. What's the purpose then? Is it for people that don't know how to interpret email headers and instead want a simple yes/no answer?
- 3825 13y ago
  I would like to imagine this is more for awareness. Why would exchange server want to include x-originating-ip? Is it for validation and authentication? Do we not trust people who have obviously have authenticated as people with the privilege to send emails from a certain server? Do we need to include this information in our email headers? Is it not enough to include the IP address of the mail server? Perhaps there is a need to do this? I was just listening to Douglas Crockford[0] in a podcast where he talks about CR/LF and how we can't decide on whether A is correct or B is correct so we do both A and B which fits neither A's position or B's position so we pick something so neither side feels like they lost. The argument is that this middle-ground is worse than either side of the proposition. Perhaps I am wrong. However, it is still good to know why we include this information in our emails. Is it simply a case of "we have this information, why not just include it?" or is it something to check against transaction logs? Perhaps a "distributed" way to add audit records of who logged on to the mail server? There had to be some reason why they included it, right? [0] http://hanselminutes.com/396/bugs-considered-harmful-with-douglas-crockford http://hanselminutes.com/396/bugs-considered-harmful-with-do...
t0 13y ago
Isn't your email more likely to stay out of spam if it shows your real IP?
- meowface 13y ago
  I don't know, but it would be illogical if it did. All SMTP headers can be spoofed with ease. Often a custom header like "X-Real-IP" will be used to send along the client's true IP; a spammer wishing to bypass filters could simply pass a phony X-Real-IP header with whatever they want, so checking against this is futile.
- fophillips 13y ago
  I think DKIM and SPF are more important for that sort of thing.
skrebbel 13y ago
Pardon my ignorance, but I don't get it. Why is it a problem whether email leaks IP addresses? After all, anytime I visit a web site I "leak" my IP address. Is that also a problem?
- wyck 13y ago
  Well you're not the only person in the world. Some people need privacy, some people want privacy, and some don't care because they don't need or want it, and most people don't even know about it.
- meowface 13y ago
  It's all about the linking of one thing to another. If you browse news.ycombinator.com without ever registering, a site admin viewing access logs doesn't really have any frame of reference for the IP address. It's just a random visitor. They could also see your browser and OS, but that is not even remotely unique or descriptive about you as a person. On the other hand, if you sign up with a personal e-mail address, a site admin could realize that some "5.5.5.5" IP making unusual requests is also "john.smith@gmail.com", and infer further things about you based on that. The same goes for if your emails are leaking your IP address unbeknownst to you. So, for example, someone you are emailing will be able to quickly know your country, region, and potentially your city; you may or may not desire that. If you attend a university or are working at a company's premises, they will know what university or what company. If you sent the email from a coffee shop, they will know the shop's company's name and a rough location, and could infer the precise location based on that. For a personal email like "jim@mit.edu", this isn't a concern, but if you perhaps have an email you use when you want to remain anonymous or semi-anonymous on the internet, often you won't want that kind of information disclosed. And from a security perspective: if you are hosting some kind of a server from that IP address, it could be scanned or attacked. And whether you are hosting anything or not, the email recipient could try to launch a DDoS attack against you (typically in the form of pure bandwidth saturation).
  - nitrogen 13y ago
    They could also see your browser and OS, but that is not even remotely unique or descriptive about you as a person. Well, there is this: https://panopticlick.eff.org/ https://panopticlick.eff.org/
tedunangst 13y ago
Random note: if you use a regular client (such as desktop, but also including the client on your phone), you are almost certainly leaking your IP. gmail, for instance, won't include your IP when using the webmail interface, but every message sent via SMTP will.
- asdfaoeu 13y ago
  Well using a Google Apps account using the web interface it included it. So maybe only gmail?
  - Encosia 13y ago
    I just tested one from my Google Apps account's web interface and emailipleak.com claims that it didn't include my IP (same sending on that account through Outlook 2013 too). I wonder if there's a setting to control that?
- chid 13y ago
  Just tested on iOS 7 default Mail app, definitely leaks. Is there any way to stop this? I'm guessing Gmail app would. edit: tested, doesn't leak!
  - breakall 13y ago
    I am also using the iOS Mail app. I tested using an outlook.com account -- no leak. Then I tested using an account on a personal email server that I set up recently using iRedmail on a VPS -- it leaked! It showed both my external ISP IP addres and my internal IP address on wifi!
- ancarda 13y ago
  Actually it seems the Gmail interface does the same (at-least Google Apps). Header: X-Originating-IP: [my-ip-address]
  - tedunangst 13y ago
    oh, good to know. i thought at one point they were one of the few webmails to not do that, but i didn't check recently. oops.
jey 13y ago
Is this a site that is trying to (inefficiently) harvest IPs <-> emails? :P
- X4 13y ago
  Same feel: Copyright (C) 2013 London Trust Media, Inc. Immediately lost my "Trust". Added to that, knowing how persuasive and creepily mad London politics is about evading privacy is (even more than the US), this being a blatant double agent maneuver, wouldn't even surprise me. Maybe some now suspect journalist, who thinks, he needs to hide traces would jump into the trap. So this would reduce the IP's to those people, who feel like they need to hide something. Everybody else already knows that this info can be easily found out by sending an email to yourself. It's obvious that gmail doesn't need your IP, they have your social profile and all you web-habits recorded actively (services) and passively (adsense) In the other case that this is legitimate company not serving as a shell company, not trying to collect IP's or E-Mail addresses. I'm sorry for spreading paranoia, to those who are sensible about it.
  - reidrac 13y ago
    They're behind a VPN service: https://www.privateinternetaccess.com/ https://www.privateinternetaccess.com/ They may know a couple of things about privacy, reputation and trust. I believe they need all three to operate their business, so I would be surprised if they were doing anything fishy when they're disclosing their name.
    - X4 13y ago
      I don't know and I can't tell that, so you may be totally right. However, it left a bad aftertaste on me, when I heard that prominent hackers were busted, because their VPN provider outed them.
nisa 13y ago
If you run your own SMTP server and want to anonymize your E-Mail e.g. for mailing lists or whatever it's not that complicated: https://we.riseup.net/riseuplabs+paow/mail https://we.riseup.net/riseuplabs+paow/mail
racbart 13y ago
Protip: If you use paid email, ask your email provider how to hide your IP while sending via SMTP. I asked mine and it turned out that they run a separate SMTP port which you can use and then your IP won't be included in message headers. This is a fairly popular provider, but I won't mention their name as they don't advertise this feature and provide it on request.
- batuhanicoz 13y ago
  Why don't they advertise this? Little "dig"ging showed who your provider is, and Google gives me no results on this feature. Also read related docs too, nothing. Wonder why.
  - racbart 13y ago
    Yup, my provider is quite easy to find, I don't mind. I just didn't want to make this info to be googleable with their name, to respect that they never publicly wrote about it. No idea why they don't advertise this feature. They wrote that they only tell about it to people that are actually having a problem about it. I guess it might be easier for them or for other email-ops to handle abuse/spam issues when this header is available?
mingabunga 13y ago
Looks like a thing to scare you in to buying the VPN service from Private Internet Access (PIA)
- wrongc0ntinent 13y ago
  Also shows they know what they're doing :)
spindritf 13y ago
Neat idea but I (and like 1% of the Internet population so it's clearly of utmost importance!) connect to GMail over IPv6 so you won't catch that even if they leak. On a related note, I run an exim server and it adds Received: from my_unix_username by my.server.hostname with local (Exim 4.80) to the headers when I send mail directly from the server with mutt. Is there any reason to hide it? Or not to remove it?
aluhut 13y ago
You should include a collection of solutions after a positive. Or is this really only marketing?
lucb1e 13y ago
> You are connecting from IPv4 address: -- Ha! Another site that thinks the x-forwarded-for header is real when it contains only stuff that triggers SQL injections. Edit: > The email you've sent has leaked your ip! The IP on your email was 83.161.210.237 No shit, that's the mailserver's IP. Who says it was actually sent from that IP? The headers it cites are merely listing "received from $mailserver ($reversedns [$ip])", not my client's IP address.
jlgaddis 13y ago
After the Snowden leaks, I moved all of my e-mail to a server I own. I use authenticated SMTP with mutt and Thunderbird on my laptops and also occasionally run mutt on the server itself. The following Postfix configuration addresses this for me: $ grep header_checks /etc/postfix/main.cf header_checks = pcre:/etc/postfix/db/header_checks.pcre $ cat /etc/postfix/db/header_checks.pcre /^Received: .*$Authenticated sender:.*/ IGNORE /^Received: by my\.mailserver\.net .*from userid [0-9]+$/ IGNORE
pallandt 13y ago
Warning: your email is possibly harvested for spam. I tested this yesterday with a newish account and already received unwanted email.
ihenriksen 13y ago
Office 365 sends your IP-address by default in the X-Originating-IP e-mail header. See here how to remove the IP from you e-mail header http://community.office365.com/en-us/forums/158/t/20470.aspx http://community.office365.com/en-us/forums/158/t/20470.aspx

50 points by rasengan 13y ago

rasengan 13y ago

If you are worried about your e-mail, simply create a secondary/throw away e-mail with a similar setup to test.

sfrechtling 13y ago

I first interpreted this as "intellectual property" leaks.

lstamour 13y ago
Same. I was rather confused. :)

andreaso 13y ago

You know, IPv6... I'm getting a false "Your email has been received and it doesn't leak your IP", due to the fact that the web site is only available using IPv4 while I'm connecting to my SMTP server over IPv6. As long as the website only captures IPv4 addresses it really might need to display an inconclusive result in the presence of IPv6 received headers. Oh, and when the web site do become IPv6 reachable you probably will want to make an explicit attempt to also catch a potential IPv4 address, in the case situation above is the reverse.

alextingle 13y ago
Me too.

pallandt 13y ago

I just tested this out of curiosity to see if it showed me anything else other than what I could already easily find out by myself via just sending myself an email and looking at the headers. It doesn't. What's the purpose then? Is it for people that don't know how to interpret email headers and instead want a simple yes/no answer?

3825 13y ago
I would like to imagine this is more for awareness. Why would exchange server want to include x-originating-ip? Is it for validation and authentication? Do we not trust people who have obviously have authenticated as people with the privilege to send emails from a certain server? Do we need to include this information in our email headers? Is it not enough to include the IP address of the mail server? Perhaps there is a need to do this? I was just listening to Douglas Crockford[0] in a podcast where he talks about CR/LF and how we can't decide on whether A is correct or B is correct so we do both A and B which fits neither A's position or B's position so we pick something so neither side feels like they lost. The argument is that this middle-ground is worse than either side of the proposition. Perhaps I am wrong. However, it is still good to know why we include this information in our emails. Is it simply a case of "we have this information, why not just include it?" or is it something to check against transaction logs? Perhaps a "distributed" way to add audit records of who logged on to the mail server? There had to be some reason why they included it, right? [0] http://hanselminutes.com/396/bugs-considered-harmful-with-douglas-crockford http://hanselminutes.com/396/bugs-considered-harmful-with-do...

t0 13y ago

Isn't your email more likely to stay out of spam if it shows your real IP?

meowface 13y ago
I don't know, but it would be illogical if it did. All SMTP headers can be spoofed with ease. Often a custom header like "X-Real-IP" will be used to send along the client's true IP; a spammer wishing to bypass filters could simply pass a phony X-Real-IP header with whatever they want, so checking against this is futile.
fophillips 13y ago
I think DKIM and SPF are more important for that sort of thing.

skrebbel 13y ago

Pardon my ignorance, but I don't get it. Why is it a problem whether email leaks IP addresses? After all, anytime I visit a web site I "leak" my IP address. Is that also a problem?

wyck 13y ago
Well you're not the only person in the world. Some people need privacy, some people want privacy, and some don't care because they don't need or want it, and most people don't even know about it.
meowface 13y ago
It's all about the linking of one thing to another. If you browse news.ycombinator.com without ever registering, a site admin viewing access logs doesn't really have any frame of reference for the IP address. It's just a random visitor. They could also see your browser and OS, but that is not even remotely unique or descriptive about you as a person. On the other hand, if you sign up with a personal e-mail address, a site admin could realize that some "5.5.5.5" IP making unusual requests is also "john.smith@gmail.com", and infer further things about you based on that. The same goes for if your emails are leaking your IP address unbeknownst to you. So, for example, someone you are emailing will be able to quickly know your country, region, and potentially your city; you may or may not desire that. If you attend a university or are working at a company's premises, they will know what university or what company. If you sent the email from a coffee shop, they will know the shop's company's name and a rough location, and could infer the precise location based on that. For a personal email like "jim@mit.edu", this isn't a concern, but if you perhaps have an email you use when you want to remain anonymous or semi-anonymous on the internet, often you won't want that kind of information disclosed. And from a security perspective: if you are hosting some kind of a server from that IP address, it could be scanned or attacked. And whether you are hosting anything or not, the email recipient could try to launch a DDoS attack against you (typically in the form of pure bandwidth saturation).
- nitrogen 13y ago
  They could also see your browser and OS, but that is not even remotely unique or descriptive about you as a person. Well, there is this: https://panopticlick.eff.org/ https://panopticlick.eff.org/

tedunangst 13y ago

Random note: if you use a regular client (such as desktop, but also including the client on your phone), you are almost certainly leaking your IP. gmail, for instance, won't include your IP when using the webmail interface, but every message sent via SMTP will.

asdfaoeu 13y ago
Well using a Google Apps account using the web interface it included it. So maybe only gmail?
- Encosia 13y ago
  I just tested one from my Google Apps account's web interface and emailipleak.com claims that it didn't include my IP (same sending on that account through Outlook 2013 too). I wonder if there's a setting to control that?
chid 13y ago
Just tested on iOS 7 default Mail app, definitely leaks. Is there any way to stop this? I'm guessing Gmail app would. edit: tested, doesn't leak!
- breakall 13y ago
  I am also using the iOS Mail app. I tested using an outlook.com account -- no leak. Then I tested using an account on a personal email server that I set up recently using iRedmail on a VPS -- it leaked! It showed both my external ISP IP addres and my internal IP address on wifi!
ancarda 13y ago
Actually it seems the Gmail interface does the same (at-least Google Apps). Header: X-Originating-IP: [my-ip-address]
- tedunangst 13y ago
  oh, good to know. i thought at one point they were one of the few webmails to not do that, but i didn't check recently. oops.

jey 13y ago

Is this a site that is trying to (inefficiently) harvest IPs <-> emails? :P

X4 13y ago
Same feel: Copyright (C) 2013 London Trust Media, Inc. Immediately lost my "Trust". Added to that, knowing how persuasive and creepily mad London politics is about evading privacy is (even more than the US), this being a blatant double agent maneuver, wouldn't even surprise me. Maybe some now suspect journalist, who thinks, he needs to hide traces would jump into the trap. So this would reduce the IP's to those people, who feel like they need to hide something. Everybody else already knows that this info can be easily found out by sending an email to yourself. It's obvious that gmail doesn't need your IP, they have your social profile and all you web-habits recorded actively (services) and passively (adsense) In the other case that this is legitimate company not serving as a shell company, not trying to collect IP's or E-Mail addresses. I'm sorry for spreading paranoia, to those who are sensible about it.
- reidrac 13y ago
  They're behind a VPN service: https://www.privateinternetaccess.com/ https://www.privateinternetaccess.com/ They may know a couple of things about privacy, reputation and trust. I believe they need all three to operate their business, so I would be surprised if they were doing anything fishy when they're disclosing their name.
  - X4 13y ago
    I don't know and I can't tell that, so you may be totally right. However, it left a bad aftertaste on me, when I heard that prominent hackers were busted, because their VPN provider outed them.

nisa 13y ago

If you run your own SMTP server and want to anonymize your E-Mail e.g. for mailing lists or whatever it's not that complicated: https://we.riseup.net/riseuplabs+paow/mail https://we.riseup.net/riseuplabs+paow/mail

racbart 13y ago

Protip: If you use paid email, ask your email provider how to hide your IP while sending via SMTP. I asked mine and it turned out that they run a separate SMTP port which you can use and then your IP won't be included in message headers. This is a fairly popular provider, but I won't mention their name as they don't advertise this feature and provide it on request.

batuhanicoz 13y ago
Why don't they advertise this? Little "dig"ging showed who your provider is, and Google gives me no results on this feature. Also read related docs too, nothing. Wonder why.
- racbart 13y ago
  Yup, my provider is quite easy to find, I don't mind. I just didn't want to make this info to be googleable with their name, to respect that they never publicly wrote about it. No idea why they don't advertise this feature. They wrote that they only tell about it to people that are actually having a problem about it. I guess it might be easier for them or for other email-ops to handle abuse/spam issues when this header is available?

mingabunga 13y ago

Looks like a thing to scare you in to buying the VPN service from Private Internet Access (PIA)

wrongc0ntinent 13y ago
Also shows they know what they're doing :)

spindritf 13y ago

Neat idea but I (and like 1% of the Internet population so it's clearly of utmost importance!) connect to GMail over IPv6 so you won't catch that even if they leak. On a related note, I run an exim server and it adds Received: from my_unix_username by my.server.hostname with local (Exim 4.80) to the headers when I send mail directly from the server with mutt. Is there any reason to hide it? Or not to remove it?

aluhut 13y ago

You should include a collection of solutions after a positive. Or is this really only marketing?

lucb1e 13y ago

> You are connecting from IPv4 address: -- Ha! Another site that thinks the x-forwarded-for header is real when it contains only stuff that triggers SQL injections. Edit: > The email you've sent has leaked your ip! The IP on your email was 83.161.210.237 No shit, that's the mailserver's IP. Who says it was actually sent from that IP? The headers it cites are merely listing "received from $mailserver ($reversedns [$ip])", not my client's IP address.

jlgaddis 13y ago

After the Snowden leaks, I moved all of my e-mail to a server I own. I use authenticated SMTP with mutt and Thunderbird on my laptops and also occasionally run mutt on the server itself. The following Postfix configuration addresses this for me: $ grep header_checks /etc/postfix/main.cf header_checks = pcre:/etc/postfix/db/header_checks.pcre $ cat /etc/postfix/db/header_checks.pcre /^Received: .*$Authenticated sender:.*/ IGNORE /^Received: by my\.mailserver\.net .*from userid [0-9]+$/ IGNORE

pallandt 13y ago

Warning: your email is possibly harvested for spam. I tested this yesterday with a newish account and already received unwanted email.

ihenriksen 13y ago

Office 365 sends your IP-address by default in the X-Originating-IP e-mail header. See here how to remove the IP from you e-mail header http://community.office365.com/en-us/forums/158/t/20470.aspx http://community.office365.com/en-us/forums/158/t/20470.aspx