Member Avatar for esdel

How can i find out if two emails are in fact from the same person?

What tricks are got up to in an effort to convince me the sender is NOT the same person?

many thanks
esdel

  • 3 Contributors
  • 6 Replies
  • 191 Views
  • 4 Weeks Discussion Span
  • Latest Post Latest Post by Ammohunt

Dani AI

Generated

As correctly pointed out, the raw headers are where you start — but headers alone rarely give absolute proof. Quick reality: you can often detect spoofing and make a strong inference, but definitive proof that two messages came from the same human usually requires cryptographic evidence (PGP/S‑MIME) or access to provider logs.

Practical checks to perform now: in Thunderbird open Message Source (Ctrl+U); in Gmail choose "Show original"; ask anyone you want to verify to forward the message as an attachment so headers stay intact. Compare these header items: Return-Path (envelope sender), Message-ID patterns, Authentication-Results (SPF/DKIM/DMARC), presence and validity of a DKIM-Signature, the earliest Received entries (origin hops), and User-Agent/X-Mailer. Be aware many webmail providers hide the submitter IP, and relays can add or alter Received lines — so treat each field with appropriate caution.

How attackers trick people: forged From/display-name spoofing, changed Reply-To, lookalike domains, or sending from a compromised account. Those are easy to do; cryptographic signing is not. To prove identity, have the sender produce a digitally signed email (PGP or S‑MIME) that you verify locally, or have them sign a short challenge phrase and share the public key fingerprint over a separate channel (phone, verified website).

To : network-layer IPs and clients change all the time, so you "have" many ephemeral addresses but only as many stable identities as email addresses or keys you control. To make yourself recognisable, pick one address, publish a public key/fingerprint, and sign important messages. Never email passwords, private keys, or sensitive personal data; share only public fingerprints or short verification tokens.

Recommended Answers

All 6 Replies

Member Avatar for Ammohunt

everything you need to know is in the message header. depending on your mail client it differs on how to get that information. Outlook is right click->message options cut and paste the contents of the internet headers box into something like

http://www.mxtoolbox.com/EmailHeaders.aspx

Member Avatar for esdel

many thanks "Ammohunt"

I use Mozi;la Firefox. Is this what you mean by "mail client"?

PLease tell be how I can tell if two messages are REALLY from one person, even when the sender is trying to hide this fact.

Many thanks
Esdel

Member Avatar for esdel

Many thanks: I see it depends on IP and ISP (whatever they are)

In the example given in your reference we are told:-
Received: from source ([]) by ([]) with SMTP; Wed, 20 Aug 2003 21:40:05 CDT
From: <>

I am still very conofused!
How MANY IP and ISP do I "have"?
Over the years I have used (and still use)
Outlook Express, Outlook, Mozilla Firefox, GoogleChrome
and the (ISPs?) BT Internet, UK2.net, xtra.co.nz and Googlemail and Gmail
on both dialup and broadband
on a series of different computers but the same BT landline
My portable uses the restaurant over the road by radio

So how many "identities" do I have?
How can I make it clear that this is the same esdel to all my contacts?
(And if I say "This is esdel" will they believe me!
What "private" info can I give without risk?)

Many thanks with your help with what turns out to be such a complex question!
esdel

Member Avatar for hirenmodi

nice concept but really i have no idea about it. if i will get solution then i will reply with proper solution.

Member Avatar for Ammohunt

TCP/IP stands for Transmission control protocol/Internet Protocol that’s what allows computers on the internet to talk to each other think of it as their postal address. Each server that handles mail should have a unique IP Address assigned typically by and ISP(Internet Service Provider) The IP address usually is associated with a name Using DNS(Domain Name System) The other piece of this that relates to what you are asking is SMTP This protocol is the commonly accepted method based on RFC Standards that control how email is transferred from one system to the other. If an email message is valid it will comply to the standards(in a perfect world alot of email doesn't) and contain the required blocks of information within the email message header using the letter analogy this would be the equivalent of the from and to address so my original post naturally centered around that hidden piece of every email message. it Should contain your email address as either the recipient or the sender depending on whether you are sending or recieving naturally. Here is a little better description

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.