« Rizler pleads not guilty | Main | SK blog status »

August 30, 2005

Gmail accounts and spammers

Google's Gmail service is still in beta but the company has opened up Gmail to all-comers as of August 29. Which naturally raises the issue of whether spammers will try to sign up for lots of accounts and use them to send spam.

In the past, spammers have used what they call "internal mailers" or "netmailers" to target users of webmail systems like Yahoo and Hotmail via accounts on those systems. Spammers also use these accounts to take advantage of their "whitelisted" status with other networks; there have been occasions when huge blasts of spam emanate from services such as Hotmail. And, of course, spammers like to have lots of Webmail addresses as drop-boxes for their domain registrations, opt-out systems, ordering, etc.

Google has some tricks for preventing spammers from signing up for thousands of Gmail accounts. First, there's a "captcha" image on the sign-up page, to separate the humans from the sign-up robots. Second, when you sign up, Google sends you a unique activation code -- via SMS text message -- to a cellphone number you provide. You must use this code and the phone number to open a new account.

This extra hurdle is likely to make spammers look elsewhere for mass quantities of webmail addresses. But there's still one thing about Gmail that may tempt spammers.

Gmail does not include the sender's Internet protocol (IP) address in outgoing email message headers. The only IP stamped on the email is Google's own (e.g., rproxy.gmail.com, 64.233.170.193). (This is reportedly still an issue with some Hotmail accounts, too.) Fingers crossed that Gmail has some other secret weapons to prevent spammers from abusing their anonymity.

Posted by brian at August 30, 2005 5:13 PM

Comments

Posted by: Spamhuntress at September 4, 2005 7:50 AM

Posted by: douglas pope at January 9, 2006 1:40 AM