Is it true that google lets everyone know your ip address and anonymous
surfing programs ill not work with google groups? I hear there are
people that can track every move you make in groups this way? Seems
like a serious security issue if it is true.
On 6 Jan 2006 15:53:08 -0800, josh00@comcast.net wrote:
> Is it true that google lets everyone know your ip address and anonymous
> surfing programs ill not work with google groups? I hear there are
> people that can track every move you make in groups this way? Seems
> like a serious security issue if it is true.
Security through obscurity is no security.
In 48 hours I have dropped 2,242 attempts. Those are from systems
scanning ip ranges hunting for open ports.
> I hear there are people that can track every move you make in
> groups this way? Seems like a serious security issue if it is true.
You cannot connect to any Internet site without showing your IP to the site
host. Period. There you have it. Love it or leave it. No choice.
-Frank
"Notan"
> Frankster wrote:
>>
>> > I hear there are people that can track every move you make in
>> > groups this way? Seems like a serious security issue if it is true.
>>
>> You cannot connect to any Internet site without showing your IP to the
>> site
>> host. Period. There you have it. Love it or leave it. No choice.
>
> And when using an "anonymous" server?
>
> Notan
Then you will show the anonymous server's IP... of course. But you will
show the IP you're using at the time :-) LOL.
-Frank
In article
"Frankster"
> > I hear there are people that can track every move you make in
> > groups this way? Seems like a serious security issue if it is true.
>
> You cannot connect to any Internet site without showing your IP to the site
> host. Period. There you have it. Love it or leave it. No choice.
But the server doesn't have to publish it to the rest of the Internet.
--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***
Frankster wrote:
>
> "Notan"
>> Frankster wrote:
>>>
>>> > I hear there are people that can track every move you make in
>>> > groups this way? Seems like a serious security issue if it is true.
>>>
>>> You cannot connect to any Internet site without showing your IP to the
>>> site
>>> host. Period. There you have it. Love it or leave it. No choice.
>>
>> And when using an "anonymous" server?
>>
>> Notan
>
> Then you will show the anonymous server's IP... of course. But you will
> show the IP you're using at the time :-) LOL.
>
> -Frank
No. Your real IP is the one in your computer's interface. Every NAT, proxy,
and anonymizer along the path will use something different. Google (or any
other server) can only see the last one in the chain.
-- Lassi
>> Then you will show the anonymous server's IP... of course. But you will
>> show the IP you're using at the time :-) LOL.
>
> You'll show *who*, "the IP you're using at the time?"
>
> No one other than the anonymous server.
Each connection will show the administrator of that system the IP you used
to connect. Depending on how you connect, it could be your own machine, or
it could be the IP of an anonymizer. The person running the system can
always see what IPs connect to his system. No way around this, ever. When
you connect to an anonymizer, the admin of the anonymizer can your machine
IP. If you use the anonymizer system to connect to a website, the admin of
the website sees the anonymizer IP.
-Frank
>> You cannot connect to any Internet site without showing your IP to the
>> site
>> host. Period. There you have it. Love it or leave it. No choice.
>
> But the server doesn't have to publish it to the rest of the Internet.
That is right. But that is his choice. He can if he wants to.
-Frank
> That's what I was saying.
Shit! Then we are in violent agreement. Nothing to argue about. Shit!
-Frank
In article <1eCdnWqt0_NidiLenZ2dnUVZ_tSdnZ2d@giganews.com>,
"Frankster"
> >> You cannot connect to any Internet site without showing your IP to the
> >> site
> >> host. Period. There you have it. Love it or leave it. No choice.
> >
> > But the server doesn't have to publish it to the rest of the Internet.
>
> That is right. But that is his choice. He can if he wants to.
Whose choice are you referring to? The person posting doesn't have any
choice (other than going through an anonymizer), it's forced upon him by
the server design.
--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***
josh00@comcast.net wrote:
> Is it true that google lets everyone know your ip address and anonymous
> surfing programs ill not work with google groups? I hear there are
> people that can track every move you make in groups this way? Seems
> like a serious security issue if it is true.
It looks like you are not looking for "security", but for *anonymity*.
If so, you may want to look at mail-to-news gateways, anonymous
remailers and things like that.
If you just want to hide your IP address in News postings, then just
use a NSP (News Service Provider) which does so, and use a normal
newsreader, i.e. the Mozilla one or even Microsoft Outlook Express, but
better something like Xnews.
FYI: Google Groups shows your IP address as:
> NNTP-Posting-Host: 68.50.123.81
You can see that when you're looking at a/your posting and then do:
show options -> Show original
A direct link for the result for your article is:
http://groups.google.com/group/comp.security.misc/msg/7d02b0 3f298a2398?dmode=source&hl=en
(on one line)
"Barry Margolin"
news:barmar-055551.16541507012006@comcast.dca.giganews.com.. .
> In article <1eCdnWqt0_NidiLenZ2dnUVZ_tSdnZ2d@giganews.com>,
> "Frankster"
>
>> >> You cannot connect to any Internet site without showing your IP to the
>> >> site
>> >> host. Period. There you have it. Love it or leave it. No choice.
>> >
>> > But the server doesn't have to publish it to the rest of the Internet.
>>
>> That is right. But that is his choice. He can if he wants to.
>
> Whose choice are you referring to? The person posting doesn't have any
> choice (other than going through an anonymizer), it's forced upon him by
> the server design.
>
The admin of the anonymizer can see your IP address. It is his choice
whether he wants to produce a report of all the sites you visited while on
his anonymizer and publish it for the world. Inlcluding publishing your own
machine's IP along with it.
Also, if you don't use an anonymizer, but hit any server directly, the owner
of the system you hit directly will have your IP and can publsh a report of
all the IPs that hit his system, if he wants to. No one to stop him.
Next, I expect this thread to migrate into "what can you learn from an IP
anyway?" discussion. Well, sometimes not much. Other times a lot. Depends on
the IP, the services you run (if any) and your configuration. An IP is just
the pointer that can hold the rest of the "investigation" together, if
someone is serious about collecting data about your and/or your system.
-Frank
In article
"Frankster"
> "Barry Margolin"
> news:barmar-055551.16541507012006@comcast.dca.giganews.com.. .
> > In article <1eCdnWqt0_NidiLenZ2dnUVZ_tSdnZ2d@giganews.com>,
> > "Frankster"
> >
> >> >> You cannot connect to any Internet site without showing your IP to the
> >> >> site
> >> >> host. Period. There you have it. Love it or leave it. No choice.
> >> >
> >> > But the server doesn't have to publish it to the rest of the Internet.
> >>
> >> That is right. But that is his choice. He can if he wants to.
> >
> > Whose choice are you referring to? The person posting doesn't have any
> > choice (other than going through an anonymizer), it's forced upon him by
> > the server design.
> >
>
> The admin of the anonymizer can see your IP address. It is his choice
> whether he wants to produce a report of all the sites you visited while on
> his anonymizer and publish it for the world. Inlcluding publishing your own
> machine's IP along with it.
If he publishes it, then he's not really an anonymizer, is he?
But the server I thought we were talking about was groups.google.com,
which is not an anonymizer. I was referring to the fact that it
includes the client address in the headers of posts that they submit.
--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***
> But the server I thought we were talking about was groups.google.com,
> which is not an anonymizer. I was referring to the fact that it
> includes the client address in the headers of posts that they submit.
Yes. But the thread sorta took the direction that anybody could do that if
they wanted to. I'm sure google is not unique in this regard. The Internet
is a big place. :)
-Frank
In article
"Frankster"
> > But the server I thought we were talking about was groups.google.com,
> > which is not an anonymizer. I was referring to the fact that it
> > includes the client address in the headers of posts that they submit.
>
> Yes. But the thread sorta took the direction that anybody could do that if
> they wanted to. I'm sure google is not unique in this regard. The Internet
> is a big place. :)
While anyone could, most don't. There are lots of web forums and blogs
that people can post to, and they don't usually publish private
information about the posters. Users typically can select whether they
want information in their profiles to be visible, for instance, and I
doubt many provide low-level details like IP addresses. The forum
operators can certainly get at this stuff (it's in their logs, and is
useful if they need to deal with the poster's ISP because of abuse), but
they would have to go out of their way to make it visible to others.
Google Groups looks to many like another forum site, and it's unusual in
that regard if it publishes the posters' IPs. On the other hand, it's
not really unusual in the context of Usenet -- many news servers include
the NNTP-Posting-Host: header, although some services with more privacy
consideration do not, and instead use the X-Trace: header, which
contains an encoded ID that only the service operator can use to look up
the sender IP in their logs.
--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***
> While anyone could, most don't.
You are at the *complete* and *utter* mercy of the system operator. Period.
Isn't this where I came in? :)
'Course, we all know that the Internet is chocked full of good people that
want to do the right thing. Nothing to worry about..... really.....! :)
-Frank
josh00@comcast.net wrote:
> Is it true that google lets everyone know your ip address and anonymous
> surfing programs ill not work with google groups? I hear there are
> people that can track every move you make in groups this way? Seems
> like a serious security issue if it is true.
Google does put the NNTP-Posting-Host header in message you post
through them, showing the IP address of the host that posted the
message. This is fairly common practice, also typical of e-mail.
It's usually done to discourage abuse: with a timestamp and the IP
address your ISP can nail down your identity easily if there's a
complaint about certain posts, and oddly enough most of the people
out there who abuse Usenet seem to stop when it becomes known they
can be traced and their identity tied to their postings.
Rule of thumb on the Internet: assume that anyone who cares knows or
can determine your IP address, and if you need protective measures
take ones that don't depend on whether your IP address is known or
not.
--
death.net: because for some problems there's only one solution.
Frankster
> > While anyone could, most don't.
>
> You are at the *complete* and *utter* mercy of the system operator. Period.
> Isn't this where I came in? :)
Assuming you have a single system operator to worry about (a single
point of failure, if you will). If you go through a network of
anonymizers, like in Tor, then you are only at the utter mercy of
collaborating system operators -- no single operator can do much. I
have reasonable faith that in the Tor network there is a sufficient
volume of "good operators" that your anonymity is pretty well
protected.
--
Steve Stringer
sillybanter@gmail.com