Show HN: Test your E-Mail for IP Leaks(emailipleaktest.com)
emailipleaktest.com
Show HN: Test your E-Mail for IP Leaks
http://emailipleaktest.com
17 comments
Office 365 sends your IP-address by default in the X-Originating-IP e-mail header. See here how to remove the IP from you e-mail header http://community.office365.com/en-us/forums/158/t/20470.aspx
Warning: your email is possibly harvested for spam. I tested this yesterday with a newish account and already received unwanted email.
If you are worried about your e-mail, simply create a secondary/throw away e-mail with a similar setup to test.
I first interpreted this as "intellectual property" leaks.
Same. I was rather confused. :)
You know, IPv6...
I'm getting a false "Your email has been received and it doesn't leak your IP", due to the fact that the web site is only available using IPv4 while I'm connecting to my SMTP server over IPv6. As long as the website only captures IPv4 addresses it really might need to display an inconclusive result in the presence of IPv6 received headers.
Oh, and when the web site do become IPv6 reachable you probably will want to make an explicit attempt to also catch a potential IPv4 address, in the case situation above is the reverse.
I'm getting a false "Your email has been received and it doesn't leak your IP", due to the fact that the web site is only available using IPv4 while I'm connecting to my SMTP server over IPv6. As long as the website only captures IPv4 addresses it really might need to display an inconclusive result in the presence of IPv6 received headers.
Oh, and when the web site do become IPv6 reachable you probably will want to make an explicit attempt to also catch a potential IPv4 address, in the case situation above is the reverse.
Me too.
I just tested this out of curiosity to see if it showed me anything else other than what I could already easily find out by myself via just sending myself an email and looking at the headers.
It doesn't. What's the purpose then? Is it for people that don't know how to interpret email headers and instead want a simple yes/no answer?
It doesn't. What's the purpose then? Is it for people that don't know how to interpret email headers and instead want a simple yes/no answer?
I would like to imagine this is more for awareness. Why would exchange server want to include x-originating-ip? Is it for validation and authentication? Do we not trust people who have obviously have authenticated as people with the privilege to send emails from a certain server?
Do we need to include this information in our email headers? Is it not enough to include the IP address of the mail server? Perhaps there is a need to do this?
I was just listening to Douglas Crockford[0] in a podcast where he talks about CR/LF and how we can't decide on whether A is correct or B is correct so we do both A and B which fits neither A's position or B's position so we pick something so neither side feels like they lost. The argument is that this middle-ground is worse than either side of the proposition.
Perhaps I am wrong. However, it is still good to know why we include this information in our emails. Is it simply a case of "we have this information, why not just include it?" or is it something to check against transaction logs? Perhaps a "distributed" way to add audit records of who logged on to the mail server? There had to be some reason why they included it, right?
[0] http://hanselminutes.com/396/bugs-considered-harmful-with-do...
Do we need to include this information in our email headers? Is it not enough to include the IP address of the mail server? Perhaps there is a need to do this?
I was just listening to Douglas Crockford[0] in a podcast where he talks about CR/LF and how we can't decide on whether A is correct or B is correct so we do both A and B which fits neither A's position or B's position so we pick something so neither side feels like they lost. The argument is that this middle-ground is worse than either side of the proposition.
Perhaps I am wrong. However, it is still good to know why we include this information in our emails. Is it simply a case of "we have this information, why not just include it?" or is it something to check against transaction logs? Perhaps a "distributed" way to add audit records of who logged on to the mail server? There had to be some reason why they included it, right?
[0] http://hanselminutes.com/396/bugs-considered-harmful-with-do...
Isn't your email more likely to stay out of spam if it shows your real IP?
I don't know, but it would be illogical if it did.
All SMTP headers can be spoofed with ease. Often a custom header like "X-Real-IP" will be used to send along the client's true IP; a spammer wishing to bypass filters could simply pass a phony X-Real-IP header with whatever they want, so checking against this is futile.
All SMTP headers can be spoofed with ease. Often a custom header like "X-Real-IP" will be used to send along the client's true IP; a spammer wishing to bypass filters could simply pass a phony X-Real-IP header with whatever they want, so checking against this is futile.
I think DKIM and SPF are more important for that sort of thing.
Pardon my ignorance, but I don't get it. Why is it a problem whether email leaks IP addresses?
After all, anytime I visit a web site I "leak" my IP address. Is that also a problem?
After all, anytime I visit a web site I "leak" my IP address. Is that also a problem?
For most people, it's really not a problem. But here's a fun example I recently came across.
I'm looking for an apartment in SF, and I stumble across a few places that seem too good to be true. Pretty sure they're spam, but out of curiosity, I go ahead and email. (Plus the way to make life difficult for spammers is to give them a lot of false positives, playing along for as long as possible, wasting their time, but unfortunately yours too.) The response I get back is clearly a scam—the "pay $200 deposit to schedule a tour" kind of scam. I get a few more emails, pressing me to pay the "deposit." Out of curiosity, I check the email headers. The sender is using Yahoo, and the IP address is being leaked. I do a geo IP lookup, and it turns out the IP is from Ghana.
Naturally, I enter the IP in my browser, and guess what shows up? An authentication dialog for the "EchoLife Home Gateway." Sure enough, entering "admin" for both username and password works fine (first try too), and here I am, connected to some scammer's router, halfway across the globe.
What's more, the router connects to the ISP using PPPoE, so the username for the account is visible in the PPPoE config. And the password is hidden under a password field, but it's being loaded by some sketchy javascript (you know how router software is). Pretty trivial to check out the DOM and find a plaintext password. Next time I'm in Ghana, I get free DSL! Did I mention that the username for the PPPoE account was clearly an actual name? A bit of google-fu and I know quite a bit about the guy who tried to scam me. Turns out it's no secret he's a scammer—in his early days it looked like he'd been using his actual name to run scams, so there were a ton of postings on scam reporting sites.
I stopped there because, as fun as it was, this was just an exercise of intellectual curiosity, I never had the intention of breaking stuff. As much as a scammer might deserve it, vigilantism isn't really the way to do it. I just reported the email to Yahoo/Google and moved on. I doubt there was much anyone could do to stop the guy from scamming anyway. But there's a lot you can do with an open router if you want to harm someone, and that's an understatement. All it would take is something as simple as setting up a VPN connection (I don't think the router I was dealing with actually supported VPN, but I'm sure you could do something malicious, like port forwarding to netbios)
The moral of this should be pretty clear; if you're a scammer don't leak your IP. Also don't use default passwords for routers. Clearly that was the bigger issue here, but how many average people do you think use default passwords? At least if their IP is hidden, there's an extra layer of obscurity. Not a great one, but better than nothing.
I'm looking for an apartment in SF, and I stumble across a few places that seem too good to be true. Pretty sure they're spam, but out of curiosity, I go ahead and email. (Plus the way to make life difficult for spammers is to give them a lot of false positives, playing along for as long as possible, wasting their time, but unfortunately yours too.) The response I get back is clearly a scam—the "pay $200 deposit to schedule a tour" kind of scam. I get a few more emails, pressing me to pay the "deposit." Out of curiosity, I check the email headers. The sender is using Yahoo, and the IP address is being leaked. I do a geo IP lookup, and it turns out the IP is from Ghana.
Naturally, I enter the IP in my browser, and guess what shows up? An authentication dialog for the "EchoLife Home Gateway." Sure enough, entering "admin" for both username and password works fine (first try too), and here I am, connected to some scammer's router, halfway across the globe.
What's more, the router connects to the ISP using PPPoE, so the username for the account is visible in the PPPoE config. And the password is hidden under a password field, but it's being loaded by some sketchy javascript (you know how router software is). Pretty trivial to check out the DOM and find a plaintext password. Next time I'm in Ghana, I get free DSL! Did I mention that the username for the PPPoE account was clearly an actual name? A bit of google-fu and I know quite a bit about the guy who tried to scam me. Turns out it's no secret he's a scammer—in his early days it looked like he'd been using his actual name to run scams, so there were a ton of postings on scam reporting sites.
I stopped there because, as fun as it was, this was just an exercise of intellectual curiosity, I never had the intention of breaking stuff. As much as a scammer might deserve it, vigilantism isn't really the way to do it. I just reported the email to Yahoo/Google and moved on. I doubt there was much anyone could do to stop the guy from scamming anyway. But there's a lot you can do with an open router if you want to harm someone, and that's an understatement. All it would take is something as simple as setting up a VPN connection (I don't think the router I was dealing with actually supported VPN, but I'm sure you could do something malicious, like port forwarding to netbios)
The moral of this should be pretty clear; if you're a scammer don't leak your IP. Also don't use default passwords for routers. Clearly that was the bigger issue here, but how many average people do you think use default passwords? At least if their IP is hidden, there's an extra layer of obscurity. Not a great one, but better than nothing.
Thanks for sharing. This was an awesome read. I'm surprised the router allowed external connections to access the internal configuration. However, some older routers are pretty poorly designed from a security standpoint.
It's all about the linking of one thing to another.
If you browse news.ycombinator.com without ever registering, a site admin viewing access logs doesn't really have any frame of reference for the IP address. It's just a random visitor. They could also see your browser and OS, but that is not even remotely unique or descriptive about you as a person.
On the other hand, if you sign up with a personal e-mail address, a site admin could realize that some "5.5.5.5" IP making unusual requests is also "[email protected]", and infer further things about you based on that.
The same goes for if your emails are leaking your IP address unbeknownst to you. So, for example, someone you are emailing will be able to quickly know your country, region, and potentially your city; you may or may not desire that. If you attend a university or are working at a company's premises, they will know what university or what company. If you sent the email from a coffee shop, they will know the shop's company's name and a rough location, and could infer the precise location based on that.
For a personal email like "[email protected]", this isn't a concern, but if you perhaps have an email you use when you want to remain anonymous or semi-anonymous on the internet, often you won't want that kind of information disclosed.
And from a security perspective: if you are hosting some kind of a server from that IP address, it could be scanned or attacked. And whether you are hosting anything or not, the email recipient could try to launch a DDoS attack against you (typically in the form of pure bandwidth saturation).
If you browse news.ycombinator.com without ever registering, a site admin viewing access logs doesn't really have any frame of reference for the IP address. It's just a random visitor. They could also see your browser and OS, but that is not even remotely unique or descriptive about you as a person.
On the other hand, if you sign up with a personal e-mail address, a site admin could realize that some "5.5.5.5" IP making unusual requests is also "[email protected]", and infer further things about you based on that.
The same goes for if your emails are leaking your IP address unbeknownst to you. So, for example, someone you are emailing will be able to quickly know your country, region, and potentially your city; you may or may not desire that. If you attend a university or are working at a company's premises, they will know what university or what company. If you sent the email from a coffee shop, they will know the shop's company's name and a rough location, and could infer the precise location based on that.
For a personal email like "[email protected]", this isn't a concern, but if you perhaps have an email you use when you want to remain anonymous or semi-anonymous on the internet, often you won't want that kind of information disclosed.
And from a security perspective: if you are hosting some kind of a server from that IP address, it could be scanned or attacked. And whether you are hosting anything or not, the email recipient could try to launch a DDoS attack against you (typically in the form of pure bandwidth saturation).
They could also see your browser and OS, but that is not even remotely unique or descriptive about you as a person.
Well, there is this: https://panopticlick.eff.org/
Well, there is this: https://panopticlick.eff.org/
Yep, quite true; though users of HN would expect admins not to implement such invasive features.
In the event that a site does, though, even if they acquire a completely unique fingerprint for you as a site user, they still don't find anything interesting about you yourself. If you visit the same site with the same IP and never register, they won't be able to put that fingerprint to much use.
Now, if that fingerprint were shared with or collected by other providers in some way (perhaps by a common ad network), much more nefarious things can be done in that regard.
In the event that a site does, though, even if they acquire a completely unique fingerprint for you as a site user, they still don't find anything interesting about you yourself. If you visit the same site with the same IP and never register, they won't be able to put that fingerprint to much use.
Now, if that fingerprint were shared with or collected by other providers in some way (perhaps by a common ad network), much more nefarious things can be done in that regard.
Actually, if you are corresponding with me, it's marginally useful if your email leaks your IP.
It means I can select Show Original in Gmail and see your X-Originating-IP header. Then I can run your IP against, for example, MaxMind† and see if you are (1) at home, (2) at your office, (3) visiting your in-laws in Santa Fe, or (4) somewhere else.
Of course, there's a slight asymmetry: Gmail does not supply the X-Originating-IP header. So you can't, in turn, look me up on MaxMind. But, if you are my Gmail correspondent, you probably don't know about the header, anyway.
†http://www.maxmind.com/en/geoip_demo
It means I can select Show Original in Gmail and see your X-Originating-IP header. Then I can run your IP against, for example, MaxMind† and see if you are (1) at home, (2) at your office, (3) visiting your in-laws in Santa Fe, or (4) somewhere else.
Of course, there's a slight asymmetry: Gmail does not supply the X-Originating-IP header. So you can't, in turn, look me up on MaxMind. But, if you are my Gmail correspondent, you probably don't know about the header, anyway.
†http://www.maxmind.com/en/geoip_demo
Regular Gmail does not send along this header, but Google Apps accounts will send it. Even if you're logged into mail.google.com and have the full Gmail interface, if you're using a Google Apps account it will send the header.
Simply put, it means an email you send could determine you geographic location if it's 'leaking your IP'.
'Leaking your IP' - should probably see a doctor about that.
'Leaking your IP' - should probably see a doctor about that.
Well you're not the only person in the world. Some people need privacy, some people want privacy, and some don't care because they don't need or want it, and most people don't even know about it.
Random note: if you use a regular client (such as desktop, but also including the client on your phone), you are almost certainly leaking your IP. gmail, for instance, won't include your IP when using the webmail interface, but every message sent via SMTP will.
Just tested on iOS 7 default Mail app, definitely leaks. Is there any way to stop this?
I'm guessing Gmail app would. edit: tested, doesn't leak!
I'm guessing Gmail app would. edit: tested, doesn't leak!
I am also using the iOS Mail app. I tested using an outlook.com account -- no leak.
Then I tested using an account on a personal email server that I set up recently using iRedmail on a VPS -- it leaked! It showed both my external ISP IP addres and my internal IP address on wifi!
Then I tested using an account on a personal email server that I set up recently using iRedmail on a VPS -- it leaked! It showed both my external ISP IP addres and my internal IP address on wifi!
Actually it seems the Gmail interface does the same (at-least Google Apps).
Header: X-Originating-IP: [my-ip-address]I'm not seeing this ATM, using the non-Google Apps Gmail interface from the U.S. (and sending, as it happens, to a "foreign" address).
Can anyone provide additional input into whether and when the Gmail web interface may be (and when not) inserting this header? Perhaps it's just in the Google Apps context?
Can anyone provide additional input into whether and when the Gmail web interface may be (and when not) inserting this header? Perhaps it's just in the Google Apps context?
Regular gmail.com accounts do not send this header, but I've recently found out that all Google Apps accounts do, and have for a while.
I assume there's some kind of a rationale for them doing this...but I don't quite know what it is.
I assume there's some kind of a rationale for them doing this...but I don't quite know what it is.
oh, good to know. i thought at one point they were one of the few webmails to not do that, but i didn't check recently. oops.
Well using a Google Apps account using the web interface it included it. So maybe only gmail?
I just tested one from my Google Apps account's web interface and emailipleak.com claims that it didn't include my IP (same sending on that account through Outlook 2013 too). I wonder if there's a setting to control that?
Is this a site that is trying to (inefficiently) harvest IPs <-> emails? :P
Same feel: Copyright (C) 2013 London Trust Media, Inc.
Immediately lost my "Trust".
Added to that, knowing how persuasive and creepily mad London politics is about evading privacy is (even more than the US), this being a blatant double agent maneuver, wouldn't even surprise me. Maybe some now suspect journalist, who thinks, he needs to hide traces would jump into the trap. So this would reduce the IP's to those people, who feel like they need to hide something. Everybody else already knows that this info can be easily found out by sending an email to yourself. It's obvious that gmail doesn't need your IP, they have your social profile and all you web-habits recorded actively (services) and passively (adsense)
In the other case that this is legitimate company not serving as a shell company, not trying to collect IP's or E-Mail addresses. I'm sorry for spreading paranoia, to those who are sensible about it.
Immediately lost my "Trust".
Added to that, knowing how persuasive and creepily mad London politics is about evading privacy is (even more than the US), this being a blatant double agent maneuver, wouldn't even surprise me. Maybe some now suspect journalist, who thinks, he needs to hide traces would jump into the trap. So this would reduce the IP's to those people, who feel like they need to hide something. Everybody else already knows that this info can be easily found out by sending an email to yourself. It's obvious that gmail doesn't need your IP, they have your social profile and all you web-habits recorded actively (services) and passively (adsense)
In the other case that this is legitimate company not serving as a shell company, not trying to collect IP's or E-Mail addresses. I'm sorry for spreading paranoia, to those who are sensible about it.
They're behind a VPN service: https://www.privateinternetaccess.com/
They may know a couple of things about privacy, reputation and trust. I believe they need all three to operate their business, so I would be surprised if they were doing anything fishy when they're disclosing their name.
They may know a couple of things about privacy, reputation and trust. I believe they need all three to operate their business, so I would be surprised if they were doing anything fishy when they're disclosing their name.
I don't know and I can't tell that, so you may be totally right. However, it left a bad aftertaste on me, when I heard that prominent hackers were busted, because their VPN provider outed them.
If you run your own SMTP server and want to anonymize your E-Mail e.g. for mailing lists or whatever it's not that complicated: https://we.riseup.net/riseuplabs+paow/mail
Protip: If you use paid email, ask your email provider how to hide your IP while sending via SMTP. I asked mine and it turned out that they run a separate SMTP port which you can use and then your IP won't be included in message headers. This is a fairly popular provider, but I won't mention their name as they don't advertise this feature and provide it on request.
Why don't they advertise this?
Little "dig"ging showed who your provider is, and Google gives me no results on this feature. Also read related docs too, nothing. Wonder why.
Little "dig"ging showed who your provider is, and Google gives me no results on this feature. Also read related docs too, nothing. Wonder why.
Yup, my provider is quite easy to find, I don't mind. I just didn't want to make this info to be googleable with their name, to respect that they never publicly wrote about it.
No idea why they don't advertise this feature. They wrote that they only tell about it to people that are actually having a problem about it. I guess it might be easier for them or for other email-ops to handle abuse/spam issues when this header is available?
No idea why they don't advertise this feature. They wrote that they only tell about it to people that are actually having a problem about it. I guess it might be easier for them or for other email-ops to handle abuse/spam issues when this header is available?
Looks like a thing to scare you in to buying the VPN service from Private Internet Access (PIA)
Also shows they know what they're doing :)
Neat idea but I (and like 1% of the Internet population so it's clearly of utmost importance!) connect to GMail over IPv6 so you won't catch that even if they leak.
On a related note, I run an exim server and it adds
On a related note, I run an exim server and it adds
Received: from my_unix_username by my.server.hostname with local (Exim 4.80)
You should include a collection of solutions after a positive.
Or is this really only marketing?
Or is this really only marketing?
> You are connecting from IPv4 address: --
Ha! Another site that thinks the x-forwarded-for header is real when it contains only stuff that triggers SQL injections.
Edit:
> The email you've sent has leaked your ip! The IP on your email was 83.161.210.237
No shit, that's the mailserver's IP. Who says it was actually sent from that IP? The headers it cites are merely listing "received from $mailserver ($reversedns [$ip])", not my client's IP address.
Ha! Another site that thinks the x-forwarded-for header is real when it contains only stuff that triggers SQL injections.
Edit:
> The email you've sent has leaked your ip! The IP on your email was 83.161.210.237
No shit, that's the mailserver's IP. Who says it was actually sent from that IP? The headers it cites are merely listing "received from $mailserver ($reversedns [$ip])", not my client's IP address.
After the Snowden leaks, I moved all of my e-mail to a server I own. I use authenticated SMTP with mutt and Thunderbird on my laptops and also occasionally run mutt on the server itself.
The following Postfix configuration addresses this for me:
The following Postfix configuration addresses this for me:
$ grep header_checks /etc/postfix/main.cf
header_checks = pcre:/etc/postfix/db/header_checks.pcre
$ cat /etc/postfix/db/header_checks.pcre
/^Received: .*\(Authenticated sender:.*/ IGNORE
/^Received: by my\.mailserver\.net .*from userid [0-9]+\)/ IGNORE