[Privacy/Security] Agent string and local system hostname in MessageID field of sent e-mails

[krackout]

I've noticed that on e-mails sent by nmail, the content of Message-ID field is:
Message-ID: <nmail.3.62.624368d7.2eb141f2.263@LocalSystemHostName>

Sending from the same account through other MUA,
Message-ID: <da5be6a2-1a3f-a87d-0c10-ae0785653362@Mail_Domain.com>

Privacy and security wise, I suggest to remove the content of this field and substitute it with something generalized or random. Or remove the field completely if possible. It leaks the MUA, its version and the local hostname of the system of the sender.

MUA string is not considered a problem and usually presented, but still it can be hidden as an option on most MUAs (it's an info for a possible attacker). But the local hostname should be removed.

[d99kris]

Ok, will take a look at this. The current Message-ID was based, like a lot of other things, on the alpine email client.

[d99kris]

Btw, short-term you can override sender hostname using the sender_hostname config parameter. The email client name and version will still be visible though.

[krackout]

I tried sender_hostname, it works fine. It's ok for me, you can close this if you like, leaving user agent as is. I'll change the text describing the issue.

[d99kris]

I checked Thunderbird and it generates (as an example) 305687c5-17fa-e4b1-aad8-3832799e8a21@gmail.com when sending from a gmail account. I think nmail could be changed to follow a similar format.

[d99kris]

A fix for this has been implemented now in above commit, so nmail generates a uuid.

Take note that nmail still passes its hostname as part of smtp authentication, unless sender_hostname is configured. The mail service provider may choose to include this hostname in the email headers.

[d99kris]

The option sender_hostname has been deprecated as of ba2a192 and instead a new option send_hostname has been added, to control whether to send client hostname in SMTP authentication (default enabled). One can disable it and then nmail behaves similarly to Thunderbird, sending [local ipaddress] (ex: [192.168.0.12] as hostname during SMTP authentication.

Message-id generation is unaffected and continous to use a uuid.

[d99kris]

The option send_hostname has been deprecated and instead send_ip has been added (enabled by default). Enabling this by default is made possible by incorporating a custom version of the underlying libetpan library with improved support for smtp handshake using IP address (instead of hostname).