Hacker News Reader

Comment by yaroslavvb | Hacker News Reader

Someone commented on that page that leaking user's IP address is a common spam-prevention practice. I just checked gmail and Yahoo Mail, and they both include my IP address in the header of outgoing messages

For instance, Yahoo Mail puts my IP address in a line like this

Received: from [xxx.xxx.xxx.xxx]

View on HN

IMO, Email systems originally have been designed that way to facilitate traceability. When webmail came, it's natural that they followed this practice.

Facebook is a closed system. When you send a message to someone on Facebook, you presume that you are adding that message within Facebook. The notification email that Facebook sends to the recipient is just that, a notification generated by the Facebook system. You, the sender of the message is not part of this notification system, though you your action triggered the notification. There is no reason why the sender's IP should be exposed in this flow under normal circumstances.

How did you send it using gmail? I just sent two via the web interface, one to a gmail account and another to a non-gmail account, the originating ip is 209.85.221.175 (a google ip address) and my current IP doesn't show up anywhere in the headers.

Edit: it doesn't show up base64 encoded, either.

I don't see my IP in the headers of mail sent from GMail, either. I also tried sending via my phone and got the same results.

Been trying to figure that out for ages... if there really is a way that would be huge.

gmail reveals the sender's IP address only when sending mail via (authenticated) SMTP. The IP address is hidden when sending mail via the web interface.

I sent it using gmail's web interface. My IP address shows up in "X-Originating-IP" part of header

Correct - Yahoo and others put the IP address of the client that sent the mail in the SMTP headers.

Example:

Received: from [x.x.x.x] by web113916.mail.gq1.yahoo.com via HTTP; Fri, 07 May 2010 18:59:00 PDT

In this test case, x.x.x.x is my current IP address, not Yahoo!'s. The HTTP indicates that I used a browser, not POP/IMAP.

They've been doing that for years. It's handy as heck when you need to track an e-mail - you don't have to bother Yahoo with a subpoena - you can go right to the client's ISP.

There is no reason Facebook shouldn't do the same thing.

Edit: Comcast does:

X-Originating-IP: [x.x.x.x]

Google is weird:

Received: by 10.216.27.139 with HTTP; Fri, 7 May 2010 19:34:21 -0700 (PDT)

I'm not on a 10.x address. Hmmm....

Headers of http://groups.google.com/ posts reveal IP address

I can see that Yahoo mail adds the originating IP address, but not Gmail.

When I wrote a web-to-email gateway in 1994 it added a Received header with the web client IP address. Back then it was a harassment-prevention practice, because spam was either nonexistent or not a problem.

I thought Gmail doesn't include the sender's IP address in their outgoing mail: http://mail.google.com/support/bin/answer.py?hl=en&answe....

"IP addresses can be considered sensitive information. As such, Gmail may hide sender IP address information from outgoing mail headers in some circumstances."

They only said they may hide it.

Reply on news.ycombinator.com