8 ms·
So could someone explain how an IP address would leak when using an email account? I suppose potentially in the SMTP header, but this would assume he was using
by rufugee 12y ago
So could someone explain how an IP address would leak when using an email account? I suppose potentially in the SMTP header, but this would assume he was using a email server running on his own personal ip, right?
So is the guess here (assuming this is even true) that he had an email server running at home, leaked the ip, and then was attacked when someone found it?
- cataflam 12y agoMany SMTP servers include the IP address of the sender in the headers (usually the Received header). Just look around, you'll be surprised.
- rufugee 12y agoUsing webmail would defeat that, though, right?
- encoderer 12y agoNot if the webmail implementation passes-on your IP, which it should if you believe Spam is a bigger issue than email sender privacy. Basically, if a webmail service doesn't pass along your IP, there would be no way for recipient networks to ever block a flood of unwanted email because they could never blacklist, say, yahoo.com. I read something about this lately... maybe from Paul Buchheit?
- cataflam 12y agoDepends on the webmail. Some do, some don't. Easy enough to test for yourself beforehand though.
- zippergz 12y agox-originating-ip?
- mschuster91 12y agoNo. The first hop in the SMTP via headers will usually have your DSL router IP.
- burnte 12y agoOnly if your DSL router hosts an SMTP relay. You're confusing traceroute with email.
- aidenn0 12y agoMany (most?) SMTP servers will include the client IP in message headers. IIRC it's even required by ope of the RFCs.
- Jgrubb 12y agoThere was a line in that long post on here the other day about Gmail, encryption, and the spam fight that mentioned how what's-his-name explicitly ignored the RFC by scrubbing the IP address out of Gamil headers, so I think you do recall correctly...
- BuildTheRobots 12y agoMany (most) people connecting to an SMTP server will be doing so from behind nat. Finding out the users "real" ip address is 10.x.x.x isn't so exciting.
- cataflam 12y agoActually you will usually find BOTH the private IP address behind the NAT and the public IP address of the router in the headers. Check out a few mails you've received from a few different sources, see for yourself. I just picked the two latest I got (and redacted them) as an example. The first one sent through GMail (SMTP I guess, not webmail) : Return-Path: <xyz@gmail.com> Received: from [192.168.1.18] (123-123-123-123...bbox.fr. [123.123.123.123]) by mx.google.com with ESMTPSA id ... for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); and another one, through OVH this time : Received: from unknown (HELO ?192.168.0.23?) (xyz@abc.fr@123.123.123.123) by ns0.ovh.net with SMTP; Both "123.123.123.123" were the public IP address from their DSL connections. In both cases as you can see, I could know both IP addresses.
- jrochkind1 12y agogmail, for instance, includes the client IP address in mail headers. I learned this myself recently from an article here on HN, https://news.ycombinator.com/item?id=2083798 https://news.ycombinator.com/item?id=2083798 Haven't checked it myself, just reported there by a former gmail engineer in the context of their anti-spammer efforts.
- nly 12y agoThis has been standard practice since the dawn of SMTP.
- verroq 12y agoGmail has NEVER included the IP in headers (you can easily check this yourself). Hotmail/Outlook on the other hand ...
- kijin 12y agoDepends on how you access Gmail. Webmail doesn't include your IP in the headers. SMTP does.
- verroq 12y agoAh ok. I've only ever used webmail, it makes sense SMTP would include the IP.
- mkiehl 12y agoThis is not completly true. When using Gmail together with Google Apps, Gmail will include the sender's IP in the X-Originating-IP header.
- serf 12y agoYou're wrong. Most SMTP requires IP in the header, gmail does not. This causes contempt between certain groups, as while it's a boon for personal privacy, it often hinders investigations. Here's a video with Mike Hearn giving a talk about spam. At the end and middle are mentions about gmail's lack of IP from sent emails, the end specifically from a network admin expressing his grievances about Google's efforts being a hindrance to law enforcement. https://ripe64.ripe.net/archives/video/25/ https://ripe64.ripe.net/archives/video/25/ It is , however, standard practice for most SMTP providers to do this.
- deleted 12y ago[deleted]
- efraim 12y agoIt says "used your email account", so maybe it's the log gmail (and others?) keeps of logins to the account that is visable for a few days back?
- raphman 12y agoAs others have already written, many webmail providers send the user's IP address in the SMTP header. GMX ("satoshin@gmx.com") definitely sends the user's IP address in the header (Source: GMX user myself).