For instance, Yahoo Mail puts my IP address in a line like this
Received: from [xxx.xxx.xxx.xxx]
Facebook is a closed system. When you send a message to someone on Facebook, you presume that you are adding that message within Facebook. The notification email that Facebook sends to the recipient is just that, a notification generated by the Facebook system. You, the sender of the message is not part of this notification system, though you your action triggered the notification. There is no reason why the sender's IP should be exposed in this flow under normal circumstances.
Edit: it doesn't show up base64 encoded, either.
Example:
Received: from [x.x.x.x] by web113916.mail.gq1.yahoo.com via HTTP; Fri, 07 May 2010 18:59:00 PDT
In this test case, x.x.x.x is my current IP address, not Yahoo!'s. The HTTP indicates that I used a browser, not POP/IMAP.
They've been doing that for years. It's handy as heck when you need to track an e-mail - you don't have to bother Yahoo with a subpoena - you can go right to the client's ISP.
There is no reason Facebook shouldn't do the same thing.
Edit: Comcast does:
X-Originating-IP: [x.x.x.x]
Google is weird:
Received: by 10.216.27.139 with HTTP; Fri, 7 May 2010 19:34:21 -0700 (PDT)
I'm not on a 10.x address. Hmmm....
They only said they may hide it.
LEFT 90 UP 90
move turtle move!
Are we sure this is the ip address of the user and not just the ip address of one of facebook's servers?
If it is a user's address... is that a problem? This seems like very easy to obtain online information... for example, by sending an email to the person im trying to talk with via facebook...
Take the Base64 string from this line in the headers:
X-Facebook: from zuckmail ([OTguMTgzLjI0Ny4yMTg=])
$ ruby -rbase64 -e "puts Base64::decode64('NzQuMTI1Ljk1LjEwNA==')"
74.125.95.104That's because Facebook-bashing has become fashionable. There is absolutely nothing wrong with the behavior described in the article. It's how email is supposed to work. There is no way to accidentally include the IP address in an email header. They (presumably) do it on purpose.
2) Someone who is not even my friend commented on someone's status, and I got a notification because I made a comment before her. It leaked her IP address to me.
These situations are not comparable to e-mail, and I seriously doubt these people reasonably expected their IP address to be sent to me based on these actions.
Is this the best scenario they could come up with where this is a problem?
And in addition to your secure wireless SSID, you have an open SSID at your house that you maintain just for that reason, right?
Mine's named Free_Porn.
X-Facebook: from zuckmail ([MTI3LjAuMC4x])
(127.0.0.1)
So I guess, nothing else to see here. Move along.
Yes, it works.
Here's a segment of an email header from 2006:
X-Facebook: from zuckmail ([128.208.54.23])
by washington.facebook.com with HTTP (ZuckMail);
Date: Sun, 10 Dec 2006 12:31:27 -0800