Onionmail as introduced there: http://onionmail.info/rulez.html (English language home page http://en.onionmail.info/ ) is a system that aims at providing highly secure private and anonymous email, comprised of federated Tor hidden secure email servers. Pop3 & smtp, with STARTTLS extensions, are used above the Tor transport, and user "pop" maiboxes are encrypted at rest using various keys (see description on their site). The server software is open and auditable. Anyone in capacity of running an "onion" could host an "onionmail" server (including "bad guys"of course.)

Having set up a couple user accounts as well as a couple friends', and played with the system for a few days, I could not fault its principle nor operation (availability appears to be pretty good).

Hence I am surprised that Onionmail has received little to no mention and/or attention, here on Stackexchange or on the Torproject blog even.

My question : assuming (1) onionmail messages always end-to-end encrypted using pgp/gpg for instance (in order to prevent the recipient's onionmail operator, or an evil maid, from snooping), and (2) all messages are exchanged between onionmail addresses (thus not using onionmail's additionnal facilities to send to/ receive from the clearnet SMTP network), then...

is onionmail truly anonymous (even unobservable) and its contents private (from prying eyes) by all but, perhaps, a formidable all-seeing (nation state) adversary - if even that ?

Obviously in the frame of this question it is also to be assumed that the end users are not already under targetted by surveillance, or compromised by trojans and the like.

  • You know, I was writing a big post deconstructing this but honestly it's not worth the time: It's snake oil, it provides no greater protection than any normal mail service with .onion access. Email is terrible, don't trust it for secure comms ever. They make a lot of claims that are clearly false and misleading. Do not trust.
    – cacahuatl
    Oct 12, 2016 at 20:57

2 Answers 2


Original poster here, having lost access to the previous account (stop sniggerring please!). Unfortunately under the new account I am unable to add comments nor edit the question, hence making this an "answer", which it is not. Please Moderators help if you can ! S-o-rr-y !

@Canonicizing ironize : « was writing a big post deconstructing this but honestly it's not worth the time: It's snake oil»

It's a broad statement you are making without substantiation, while it seems to be a principle of Stackexchange that answers should be articulated somewhat. Saying "it's snake oil" is not an answer in that sense. Could you enumerate and discuss the specific vulnerabilities you have in mind against the stated use case, specifying your attack model and whether each attack is concerned with the anonymity of end points and/or privacy of the correspondance ?

  • It's as vulnerable to every kind of attack as email is with the single exception of wiretapping between servers (and it doesn't make clear how it fixes some of the security related issues with that either) and even that doesn't apply for mail coming in from outside of the onion network and mail going to outside of it. Everything else except from that one single point is something that you, and they, have to blindly trust the server operator on. It's a lot of fuss for no real advantage. Also it's a comment, not an answer for that very reason.
    – cacahuatl
    Oct 14, 2016 at 17:26
  • The original question is concerned only with mail sent from and to .onion addresses, the extensions (VMAT) which allow interop with clearnet SMTP servers were excluded from consideration explicitly./ Impmicitly excluded are known general attacks against Tor and especially hidden services "needing love"/ Comment not being an answer understood. Yet you stated you wanted to write a long answer (and changed your mind) ... / If you don't want to develop the attacks and attack model you have in mind, it's OK. Let's hope someone will chime in with more concrete ideas...
    – Noino 667
    Oct 14, 2016 at 17:53
  • And as I stated that's the only advantage it has, and it's probably not hugely advantageous over non-Tor with proper STARTTLS between SMTP servers. Other than that, it has all the same problems as email except with a lot of lies about what it can protect you from.
    – cacahuatl
    Oct 15, 2016 at 1:47
  • Non-Tor SMTP with Starttls, has all the (meta)data potentially snoopable at each relay, + potentially stored, unencrypted, in store-&-forward situations. And in case of relaying, there is nothing to guarantee that EVERY step will be encrypted - Starttls "fails open" ! / In contrast, Onionmail does no SMTP relaying nor storage in transit (no retries). .. to be followed...
    – Noino 667
    Oct 15, 2016 at 10:14
  • ... In Trust-No-One scenarios, AFAIUI, it still guarantees that no data or metadata is exposed in clear at any point in space-time, except standard mail "metadata" potentially snoopable at the onionmail serving the recipient - albeit it's immediately reencrypted for storage in the recipient's mailbox, if you trust the operator, which I concur we must not. Hence apply user-to-user encryption + sanitize headers (subject...)
    – Noino 667
    Oct 15, 2016 at 10:18

If the conditions you've listed are met, then:

  • Yes, they are private with at least 99% probability. Why not 100%? Well, theoretically PGP encryption can be hacked one day, a person can leak/loose/disclose it's key - so all these unlucky cases are giving the remainder of 1%. There's no pure absolute in this world
  • No, it is not 100% unobservable - theoretically some email headers can give some clue or fingerprinting tokens, but it's totally up to the email clients used on both sides.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .