3 ms·

Yes, email providers must see sender and recipient email addresses, and corresponding server names (and how to reach them). However, if you and your corresponde

Yes, email providers must see sender and recipient email addresses, and corresponding server names (and how to reach them). However, if you and your correspondents use ~anonymous email accounts, none of that get's tied to meatspace. And if you're really paranoid, you can have multiple accounts, and mix them up. About 30 "activist" email providers exchange messages via Tor onion addresses.[0,1] But you still need to trust your provider, unless you trust your OPSEC enough. Back in the day, we had Mixmaster remailer nyms, with PGP and message delivery to alt.anonymous.messages. You downloaded all messages, and then selected based on public key. But not enough people ever used it, so the anonymity space was tiny. But there is still activity. I recently came across something ~new on Github, but I don't remember exactly what. 0) https://github.com/ehloonion/onionmx/blob/master/sources/map.yml https://github.com/ehloonion/onionmx/blob/master/sources/map... 1) https://riseup.net/en/email#what-is-special-about-riseup-email https://riseup.net/en/email#what-is-special-about-riseup-ema...

bad_user 8y ago
> "But you still need to trust your provider" When it comes to the security or privacy of your messages, if you really, really need it, then you cannot trust your provider and that's the whole point of end-to-end encryption. If you're an activist whose life would be threatened if those messages got out, then you'd better make sure that any information you leak to your email service provider cannot be tied to you, no matter how much you trust that provider. > "if you and your correspondents use ~anonymous email accounts" Note that anonymity is earned by you via the steps you take to open and use that email account. For example, if you're logging in to that email account from your home IP and you're being targeted by some security organization or crime syndicate with enough resources, who your email provider is will be absolutely irrelevant.
- mirimir 8y ago
  OK, you're right. You can't trust anyone. > Note that anonymity is earned by you via the steps you take to open and use that email account. That's what I meant by "unless you trust your OPSEC enough". However, not all of us are " activist[s] whose life would be threatened if ... messages got out". So I think there is some value in providers who will protect you, if your OPSEC is weak. If nothing else, it's failsafe. Like climbing with a rope.
throw0101a 8y ago
> However, if you and your correspondents use ~anonymous email accounts, none of that get's tied to meatspace. Anyone else here remember anon.penent.fi, or am I simply old? :) * https://en.wikipedia.org/wiki/Penet_remailer https://en.wikipedia.org/wiki/Penet_remailer Also, mixmasters: * https://en.wikipedia.org/wiki/Anonymous_remailer https://en.wikipedia.org/wiki/Anonymous_remailer
- mirimir 8y ago
  I think that using anon.penent.fi was one of my first attempts at anonymity. Then I discovered mixmaster remailers and nyms. I used Private Idaho for Windows, and then Quicksilver. Just a few years ago, I got Quicksilver running in Wine in Whonix. There were (maybe still are?) some nymservers, remailers and news servers running as Tor onions.
dane-pgp 8y ago
It's a pity that anonymous remailers aren't more widely used, but I've been thinking of an 80/20 solution that might be easier to adopt. Imagine that alice@protonmail wants to send an encrypted message to bob@tutanota and they both have each other's PGP keys. What these email providers could do is offer a reserved email address (such as remailer@) with its own associated PGP public key. (The address and the public key could be stored in the DNS, or retrieved via some HTTPS .well-known URL). This way alice@protonmail could encrypt a message (including headers) to bob@tutanota using his private key, and then encrypt this inner message as the body of a message sent to remailer@tutanota. ProtonMail would only see that Alice is communicating with a Tutanota user, and Tutanota would only see that Bob is communicating with a ProtonMail user. (For the specific case of webmail providers, you would also want something like SXG [1] combined with Binary Transparency [2] to prevent malicious JavaScript being served). [1] https://developers.google.com/web/updates/2018/11/signed-exchanges https://developers.google.com/web/updates/2018/11/signed-exc... [2] https://wiki.mozilla.org/Security/Binary_Transparency https://wiki.mozilla.org/Security/Binary_Transparency
- mirimir 8y ago
  That is an interesting idea. However, remailers are vulnerable. For example: https://riseup.net/en/about-us/press/fbi-seizes-anonymous-remailer https://riseup.net/en/about-us/press/fbi-seizes-anonymous-re...

bad_user 8y ago

> "But you still need to trust your provider" When it comes to the security or privacy of your messages, if you really, really need it, then you cannot trust your provider and that's the whole point of end-to-end encryption. If you're an activist whose life would be threatened if those messages got out, then you'd better make sure that any information you leak to your email service provider cannot be tied to you, no matter how much you trust that provider. > "if you and your correspondents use ~anonymous email accounts" Note that anonymity is earned by you via the steps you take to open and use that email account. For example, if you're logging in to that email account from your home IP and you're being targeted by some security organization or crime syndicate with enough resources, who your email provider is will be absolutely irrelevant.

mirimir 8y ago
OK, you're right. You can't trust anyone. > Note that anonymity is earned by you via the steps you take to open and use that email account. That's what I meant by "unless you trust your OPSEC enough". However, not all of us are " activist[s] whose life would be threatened if ... messages got out". So I think there is some value in providers who will protect you, if your OPSEC is weak. If nothing else, it's failsafe. Like climbing with a rope.

throw0101a 8y ago

> However, if you and your correspondents use ~anonymous email accounts, none of that get's tied to meatspace. Anyone else here remember anon.penent.fi, or am I simply old? :) * https://en.wikipedia.org/wiki/Penet_remailer https://en.wikipedia.org/wiki/Penet_remailer Also, mixmasters: * https://en.wikipedia.org/wiki/Anonymous_remailer https://en.wikipedia.org/wiki/Anonymous_remailer

mirimir 8y ago
I think that using anon.penent.fi was one of my first attempts at anonymity. Then I discovered mixmaster remailers and nyms. I used Private Idaho for Windows, and then Quicksilver. Just a few years ago, I got Quicksilver running in Wine in Whonix. There were (maybe still are?) some nymservers, remailers and news servers running as Tor onions.

dane-pgp 8y ago

It's a pity that anonymous remailers aren't more widely used, but I've been thinking of an 80/20 solution that might be easier to adopt. Imagine that alice@protonmail wants to send an encrypted message to bob@tutanota and they both have each other's PGP keys. What these email providers could do is offer a reserved email address (such as remailer@) with its own associated PGP public key. (The address and the public key could be stored in the DNS, or retrieved via some HTTPS .well-known URL). This way alice@protonmail could encrypt a message (including headers) to bob@tutanota using his private key, and then encrypt this inner message as the body of a message sent to remailer@tutanota. ProtonMail would only see that Alice is communicating with a Tutanota user, and Tutanota would only see that Bob is communicating with a ProtonMail user. (For the specific case of webmail providers, you would also want something like SXG [1] combined with Binary Transparency [2] to prevent malicious JavaScript being served). [1] https://developers.google.com/web/updates/2018/11/signed-exchanges https://developers.google.com/web/updates/2018/11/signed-exc... [2] https://wiki.mozilla.org/Security/Binary_Transparency https://wiki.mozilla.org/Security/Binary_Transparency

mirimir 8y ago
That is an interesting idea. However, remailers are vulnerable. For example: https://riseup.net/en/about-us/press/fbi-seizes-anonymous-remailer https://riseup.net/en/about-us/press/fbi-seizes-anonymous-re...