5 ms·
This is not quite as good as riseup.net's onion support as it doesn't include SMTP services. See: https://riseup.net/en/security/network-security/tor#riseups-t
by mike-cardwell 10y ago
This is not quite as good as riseup.net's onion support as it doesn't include SMTP services. See:
https://riseup.net/en/security/network-security/tor#riseups-tor-hidden-services https://riseup.net/en/security/network-security/tor#riseups-...
mike@snake:~$ torsocks telnet wy6zk3pmcwiyhiao.onion 25
Trying 127.42.42.0…
Connected to wy6zk3pmcwiyhiao.onion.
Escape character is ‘^]’.
220 mx1.riseup.net ESMTP (spam is not appreciated)
So if your mail service supports onion addresses, then you can just replace "@riseup.net" in a users email address with "@wy6zk3pmcwiyhiao.onion".
Alternatively, your mail service could have explicit configuration in place to identify @riseup.net addresses and route them to wy6zk3pmcwiyhiao.onion instead of the normal MX records. I do this with Exim by utilising Tors TransPort+DNSPort functionality and then adding the following Exim router:
riseup:
driver = manualroute
domains = riseup.net
transport = remote_smtp
route_data = ${lookup dnsdb{a=wy6zk3pmcwiyhiao.onion}}
Obviously this would be better if there was a way to dynamically advertise the onion address in the DNS instead of having to hardcode it in Exim.
[edit] - If they co-ordinated, Riseup and Protonmail, and potentially other similar privacy respecting mail services could send all their traffic over each other via Tor. If you work for either of these companies, please consider the possibility of looking into this sort of relationship.
- saycheese 10y agoWhatever happened to the Riseup canary issue? https://riseup.net/canary https://riseup.net/canary https://news.ycombinator.com/item?id=13007234 https://news.ycombinator.com/item?id=13007234
- zie 10y agoObviously they either 1) lost the PGP key(or other internal issue) or 2) got served with something that won't let them post new canary messages. something tells me #2 is probably more likely.
- chainedthreat 10y agoRiseup is all cucked out now, not safe to use, canary issues, etc.
- Pxtl 10y ago> cucked Can we not do that?
- chainedthreat 10y agoI'm glad you don't approve
- 0x0 10y agoShouldn't you also add super enforced SSL certificate validation for such a setup? Since SMTP is usually merely opportunistic SSL, any Tor exit node could very easily strip STARTSSL (or just MITM with a fake certificate that doesn't get validated) and you're worse off than running over the normal internet?
- pfg 10y agoAre we talking about using SMTP via the onion service, or just regular SMTP through an exit node? The onion service comes with its own crypto and would not need TLS on top of it (though you're free to use TLS anyway, like Facebook, if it makes sense because of how your infrastructure is set up). There's no exit node for hidden service connections (or any other node that sees the plaintext other than the hidden service itself).
- 0x0 10y agoAh, of course you are right. I forgot about hidden services not passing through an exit node.
- mike-cardwell 10y agoThere are no exit nodes involved when talking to onion services. The traffic does not leave the Tor network.
- o- 10y agoThis is a great idea [your edit]! And its already being developed by some (not protonmail though). See https://github.com/ehloonion/onionmx https://github.com/ehloonion/onionmx
- mike-cardwell 10y agoThanks for pointing this out to me. I have added suitable onionmx DNS SRV records and reconfigured my mail server to utilise them: mike@snake:~$ dig +short srv _onion-mx._tcp.grepular.com 0 5 25 grepularmmmiatj7.onion. mike@snake:~$
- akerro 10y agoProtonMail won't unite with Tutanota, Roundcube or even GPG over standard for email encryption, why would they setup Tor-Tor messaging?