Don't let children receive email messages from Gmail

Gmail offers too much anonymity and thus lets the bad guys hide.

Michael Horowitz

Michael Horowitz wrote his first computer program in 1973 and has been a computer nerd ever since. He spent more than 20 years working in an IBM mainframe (MVS) environment. He has worked in the research and development group of a large Wall Street financial company, and has been a technical writer for a mainframe software company.

He teaches a large range of self-developed classes, the underlying theme being Defensive Computing. Michael is an independent computer consultant, working with small businesses and the self-employed. He can be heard weekly on The Personal Computer Show on WBAI.

Disclosure.

See full bio

Michael Horowitz

Sept. 16, 2008 5:42 p.m. PT

2 min read

When it comes to the question of whether an IP address is personal or not, Google seems to swing both ways.

In February, Google software engineer Alma Whitten wrote Are IP addresses personal? on the Google Public Policy blog. In the posting she said "... in most cases, an IP address without additional information cannot [identify you]."

But someone commenting on the posting pointed out that Gmail goes out of its way to hide the IP address of the sender of a Gmail-originated message. The item User IP addresses from the Gmail help says:

"Protecting our users' privacy is something we take very seriously. Personal information, including someone's exact location, can be gathered from someone's IP address, so Gmail doesn't reveal this information in outgoing mail headers. This prevents recipients from being able to track our users, or uncover what may be potentially sensitive personal information."

I verified this by examining the headers of a Gmail-originated message. The source IP address was 74.125.46.31 which, according to ip-adress.com is Google in Mountain View, California. In other places the email header identified the source computer as yw-out-2324.google.com. Nothing pointed to the actual IP address of the sender.

As someone pointed out, this anonymity makes Gmail a haven for bad guys. Anyone interested in sending threatening email messages or perhaps inappropriate messages to children, can hide behind Gmail.

If I was the parent of a small child, I wouldn't want them to receive any email from Gmail. Period.

Earthlink, my ISP, does let their customers define spam filters that can reject all messages from a domain such as gmail.com or google.com.

Yahoo Mail does not hide the originating IP address. If and when I do, I'll update this posting.

Someone I know in New York City recently said they were going on a trip to Switzerland. After a few days, they sent a Yahoo email message claiming to be from Switzerland. I had no reason to doubt them, but just for fun, I looked into the email header, got the source IP address and ran it through the services I wrote about last time. Sure enough, the message came from Switzerland.

I didn't test if Hotmail hides the true source IP address. If and when I do, I'll update this posting.

Update. September 16, 2008: According to Leo Notenboom Hotmail is inconsistent when it comes to including the source IP address, sometimes it does, sometimes it doesn't. He was nice enough to test it again today (thanks Leo) and reported that the true source IP address did appear in the email header of a message that originated from Hotmail.

Update. September 16, 2008: For more on this topic, see Harassment from a Gmail user.

See a summary of all my Defensive Computing postings.