Earthlink's anonymous e-mail addresses are NOT anonymous...

Question

Level 1

10 points

Earthlink's anonymous e-mail addresses are NOT anonymous...

For those of you who use Earthlink as your service provider -
Earthlink has begun offering so-called anonymous earthlink e-mail addresses to its users for sending out messages. The receiver of that message, they state in their introduction and information material, would not be able to get your real e-mail address.

This is one of things they promise on the Earthlink web-site: "With Anonymous Email Addresses, you get privacy and online anonymity whenever you need to provide your email address online."

Having sent out a message using one of these so-called anonymous e-mail addresses, imagine my surprise when the newspaper it was sent to sent me a reply (it was an opinion I wanted them to have, but didn't want printed) - and that reply was sent to my real e-mail address!

It turns out that these so-called anonymous e-mail addresses are NOT anonymous at all. All the receiving party has to do is select "Raw Source" as the viewing option and there is the sender's original, real e-mail address for all to see, identified not once but several times in the raw source data.

If you are an Earthlink user, and you are contemplating using an anonymous e-mail address for whatever reason, don't. It isn't anonymous, and it isn't safe.

Regards -

Mac OS X (10.4.7)

Posted on Sep 29, 2006 5:43 AM

Reply

Answer 1

Rubel Romero Author

Level 1

10 points

Sep 29, 2006 6:42 AM in response to Rubel Romero

My bad - I don't see those details any longer - I must have been reading the internal receiving stations.

The only external thing it shows now is the originating ISP's IP address, and the IP address of the sender's routing city. It seems doubtful anyone could figure anything out from that.

In future, I won't BCC myself, either - maybe that was it. Or maybe I set it up wrong. At any rate, I won't be using them anymore.

And I'd still like to know how the newspaper managed to get my e-mail address.

Reply

Answer 2

Sep 29, 2006 7:07 AM in response to Rubel Romero

If you Bcc:'d yourself with your real email address and whoever from the Newspaper selected "Reply All" instead of just "Reply" is certainly one way.

Have you contacted Earthlink's customer or technical support regarding this?

Reply

Answer 3

Sep 29, 2006 7:27 AM in response to Allan Sampson

"Reply All" doesn't include addresses that were Bcc'ed in the original email. Those addresses aren't in the message anywhere, thus "blind" carbon copy, and since they're not in the message it is impossible for the email program to include them in a "Reply All".

Reply

Answer 4

Sep 29, 2006 7:40 AM in response to Jeff Hubbach

Hello Jeff.

Addresses included in the Bcc: field are hidden from all recipients but if the email addresses aren't anywhere in the message, how do the Bcc: recipients receive the message?

Are you sure about this?

If so and since I'm always open to learning something new, can you provide a link, etc. that substantiates this?

Reply

Answer 5

Sep 29, 2006 7:50 AM in response to Allan Sampson

Allan,

The Bcc'ed email addresses are supposed to (in the spec) be stripped off by the destination SMTP server. There is a possibility that the destination SMTP server is misconfigured and doesn't strip off the BCC, but the SMTP specification says that they're to be stripped off.

http://www.livinginternet.com/e/ea_bcc.htm

Because of this minor loophole, some SMTP servers send an individual message for each BCC'ed address, thereby removing the BCC list from the outgoing email at the source, not expecting the destination SMTP server to do it. The spec allows for this, and almost even recommends it.

http://www.ietf.org/rfc/rfc2821.txt (search for BCC)

And yes, I'm sure about this.

Reply

Answer 6

Rubel Romero Author

Level 1

10 points

Sep 30, 2006 10:18 AM in response to Allan Sampson

Yes, I contacted Earthlink before I posted the Apple Mail discussion message. It was soon after that point that I stopped seeing my e-mail address. But I doubt that they would have had time to do anything to fix it. I'm assuming I set up something incorrectly, or hit the wrong button, or whatever. And actually I'm also pretty sure that BCC addresses aren't supposed to be viewable to anyone but the sender, unless Earthlink set up this new service incorrectly (and I find that hard to believe). So, it had to be pilot error. Must have been.

Reply