Hello.

When I send out an e-mail using an e-mail client on my computer, my IP
address is listed in the "received" header.

I would like to prevent my IP address from being displayed in the
message headers. I don't mind if my ISP or e-mail provider is listed,
but I just don't want my personal computer's IP address shown.

I am running OS X on a Mac.

---

Request for Question Clarification by ephraim-ga on 11 Aug 2004 22:47 PDT

1) Please post the mail configuration on your machine, such as what
method you use to send outgoing mail, what mail reader you are using,
etc. Please do *not* include personal details such as your name or
e-mail address.

2) Based on the information provided above, what you want may be
impossible. Would you accept an explanation about why this may be
impossible?

/ephraim

---

Clarification of Question by marc10-ga on 12 Aug 2004 01:16 PDT

I suspect the IP address may be inserted by my ISP and not my e-mail
client because I have used a number of different e-mail clients
(including Apple Mail and Microsoft Entourage, among others) with
similar results. The first line of my received header looks something
like this:

Received: from [192.168.0.143]
(adsl-216-142-87-60.dsl.ldwn01.pacbell.net [216.142.87.60]) by
mail.mymailprovider.com (Postfix) with ESMTP id 4C1FED448D1


I don't have one particular mail configuration. I have been trying
various configurations.

I was hoping there was a solution where I could use something like a
proxy or VPN. I don't know enough about those technologies to know if
they would archive my goal.

And, just to clarify, I am not looking for a solution that takes
advantage of a particular feature of an e-mail client. I am looking
for an overall e-mail solution.

Let me explain the problem I have in more detail. That might help...

I have sensitive data on my computer. I am using the same computer to
send out e-mails. The recipient of the e-mails may realize that I have
sensitive data on the computer. Even though I have a firewall setup,
my computer would be a lame duck for a malicious hacker to target.

ephraim-ga, if you think what I want is impossible, I would want an
explanation and I would be willing to pay for it. But how can I be
assured that another researcher might not disagree and be able to
provide a solution?

Would it be appropriate to leave the question open for two weeks and
then if no one has found a solution have you (ephraim-ga) answer it?

---

Request for Question Clarification by ephraim-ga on 12 Aug 2004 06:59 PDT

Marc -- that sounds reasonable to me.

/ephraim

Marc10 --

Any appropriate solution is going to involve either custom code of
your own or the use of an Internet remailer.  You should find this FAQ
useful:
http://www.andrebacard.com/remail.html

Best regards,

Omnivorous-GA

Or just use a webmail product... hotmail, hushmail, yahoo, your ISP's
web interface to your mail...

Crythias --

This is not quite true. Send yourself an e-mail from your Yahoo
account. Now take a really close look at the header... :-)

I haven't confirmed whether this is also true on the other services
you have mentioned, but it would surprise me if a mail service
provider did not add this information.

There *are* ways around this, but they may be more trouble than they're worth.

/ephraim

ephraim-ga, you are correct. I understand completely why it has to be anyway. 

For the Question, though, respectfully, there must be more than just a
few people who have sensitive information on their hard drive who
aren't concerned with their IP attached to email. If this was such a
security risk, hospitals and big businesses would be scrambling to do
what they could to prevent this as well. Furthermore, I'd guess that
the email specification would be changed to prevent originating IP
addresses. This would cause all sorts of problems. You could never
truly be sure that the message came from the host you expected.

If standard practices were in place, and one is behind a firewall,
configured properly, the exploits to do *something* to your machine
are few.

Consider this: *EVERYONE* (who wants to) knows Yahoo!'s IP,
Microsoft's IP, SCO's IP, etc. You could nmap them and find their open
ports, but they are pretty solid.

Also, consider that Marc10 is using a Mac. The latest OS is built on
OpenBSD, a very secure operating system out of the box. A simple shell
prompt netstat -an will tell you what ports are listening on your
system.  If your firewall isn't allowing those ports to reach your PC,
inbound exploits aren't an issue. That leaves trojan horses, programs
that call home. If there is any reason that you may already be
infected by such as this, email IP address is the least of your
problems.

Not to mention, every time you visit a website, the website may log
your IP address in aggregate fashion... You could use an anonymizer
service if you wish, but you're then getting into an area that is
frequented by people that may want to conceal for illegal purposes
(Not everyone, but enough to make the use of such services ... shall
we say .. possibly questionable).