Does Claws in TAILS actually accomplish anything for anonymity?

Question

I don't see much chance of persuading non-techie friends and family to use Tor or TAILS. So sending them e-mail from TAILS will identify me for other traffic on the same circuit? Or does SMTP and HTTP use separate paths?

There's even less chance of getting them to use PGP, so perhaps the other question is irrelevant.

Finally, how can they reply without going to my ISP? which would identify me again. I can set up an e-mail server, but without a hostname or IP address, no one can talk to it.

I'm one of thoe fellows who "doesn't have anything to hide," but I like the idea of snubbing the snoops. :-)

Answer 1

Tor and Claws together are not sufficient for anonymous e-mail. Here's why:

Claws mail is included in Tails because many people like the convenience of having a mail client. Tails allows you to save mail from Claws in the persistent volume (on USB sticks) https://tails.boum.org/doc/anonymous_internet/claws_mail/index.en.html which is quite handy.

However a mail client alone does not provide any anonymity.

Tails is supposed to send all traffic over the Tor network by default and because, like HTTP, SMTP can and most often does use TCP on the transport layer it should be fairly simple to send traffic from Claws through the Tor network.

This does not solve the problem of sending anonymous email though.

First of all you would need to create an anonymous email account anonymously (on Tor) and if you want to use Claws on Tails you can link your new email account to Claws.

(If you connect to an email account that is already associated with your real identity or ip address using Claws on Tails the best you can hope to achieve is to hide your location while you are sending emails)

There is no point going to these lengths if you are unable to convince your friends and family to (at the very least) create their own anonymous email accounts and always communicate with your anonymous email account from theirs. This is so that you can't be deanonymized by simply checking who you are talking to (in this case the metadata alone could be enough to reveal your true identity). Of course if the content of your emails could also be enough to reveal your identity, the emails would have to be encrypted too (PGP).

So there is no simple solution to anonymous communication over email and starting down the path of secure/anonymous communications only to get quickly deanonymized will just draw attention to you.

If you do not find it necessary or achievable to go to at least the lengths described above then you really only have one sensible option, which is to use a large, common email provider on the clear net and avoid putting your whole life into an email message. This will give you the best chance of blending in with the masses and getting ignored by snoops. In my honest opinion 'snubbing the snoops' just because doesn't do anyone any favors.

Answer 2

Finally, how can they reply without going to my ISP? which would identify me again. I can set up an e-mail server, but without a hostname or IP address, no one can talk to it.

Even if you ran your own mail server in the basement, your connection to the outside world would still be via an ISP. The big ISPs - or, rather, the telcomms - are the companies that own the wires. Regardless of how you look at it, and how neutral you think the internet should be, it basically comes down to somebody owning the hardware and infrastructure (and having spent lots of money to implement it). This is also what makes traffic correlation attacks possible in the larger autonomous systems: an ISP can own enough of the network to look at both where your traffic enters and exits the Tor network.

If you want to really run without an ISP you're into the realms of becoming your own ISP, obtaining a block of IP addresses from IANA (or from a larger ISP), and doing a host of other complicated things. There's an interesting discussion on ISPs/GSPs here: http://www.techrepublic.com/forums/questions/theoretical-internet-without-isp/.