8

I need to send a completely anonymous email, with no trace of myself, my IP and my computer. Can I send it via Tor using an ordinary email server, ie, gmail, yahoo, whatever?

PLEASE, I'm an ordinary mortal and don't understand about programming or anything, so would appreciate a reply that my mom would understand! :D, so things like SOCKS and such, I'm completely ignorant about.

  • Would you like to be anonymous from intended receiver of the email too? – Roya Nov 8 '14 at 14:35
  • Unfortunately, doing this thing right REQUIRES at least some understanding of security concepts. It's unavoidable; you'll have to learn a bit. As @Roya mentioned, we'll need to know from whom you wish to remain anonymous (the email provider, the end recepient, etc.). Also, does the end recepient need to be able to verify that you sent the email (anonymous or no). Eg. if you send another anonymous email to them later, do they need to be albe to know it came from the SAME anonymous person (and not an imposter pretending to be the person who sent them the last email). – Sam Whited Nov 8 '14 at 15:19
  • Read this article before attempting to send an anonymous email. theprivacyblog.com/anonymity/… – Roya Nov 10 '14 at 12:00
  • 1
    This is a related question tor.stackexchange.com/questions/4609/… – Roya Nov 29 '14 at 9:34
4

While there are some great suggestions in the other answers in this thread, we should be careful to answer the question actually being asked.

OP asked for anonymous email. Many of these answers assume he wants encrypted email as well, which may or may not be the case.

As others have said, we need a better idea of the specifics of the poster's use case. From whom do you need to remain anonymous? Just the recipient of the email, the ISP who delivers it, the US government, law enforcement, your boss, or your spouse? Does the content have to be secret as well, our just your sending identity?

Knowing these details will get you better answers.

Let's make some assumptions, and try to get you an answer "your mom would understand." Note that if any if these assumptions are wrong, the advice will be too.

Assume you learned something bad about your work and want to be a whistle blower to the Labor Board, but can't afford having your boss find out, and would rather the labor board not know who you are. You just want to email them the dirt. In this case you don't care if the information in the email is secret, you just want to hide your identity.

In this case, you don't care so much about the government, or law enforcement. You might care about a private investigator after the fact.

One way you could go about this is to go to a library or coffee shop you've never been to before. Use a computer you have never used before. Create a brand new email account with the provider of your choice, but don't provide any real information for your name or contact info. Use that to send your email.

Of course it's up to you to not disclose details about yourself in the message you send. But aside from that, it would take significant government level spy effort to identify you as the sender.

What the recipient could learn easily would be: the address of the coffee house or library you used, and the time you sent the message. But if you don't go back there, and didn't buy anything with a credit card while there, it's extremely unlikely any average adversary could id you from that.

And while you could use the account again to get a response, never access it from your home internet or home computer.

But that's just one scenario, and the details of your specific threat model matter in providing a solid, workable answer.

Maybe you need mixmaster, Tor, a VPN, and pgp. We just don't know.

  • One more thing to check for before sending the email is to verify that there is no surveillance security camera at or at the proximity of the location you decide to send the email. – Roya Nov 29 '14 at 1:14
2

The technology is simply too complicated to boil it all down to one "reply that my mom would understand," unfortunately. There are some things you can do to significantly increase your level of anonymity, however. I believe the questions should be (1) anonymous from who exactly (identify threats), (2) what abilities do each of those particular observers have with which to identify the sender, and (3) how does the sender use tech. to mitigate each of those particular threats? General advice:

  • Connect only via Tor -- Learn how to use the TBB well -- Use a dedicated TorBrowser only for anonymous email
  • Use only webmail
  • Always use VPN > Tor
  • Find an email provider that either does not require Javascript or offers Squirrelmail
  • Don't use any real information at all with your anonymous email account -- Use randomly generated information
  • Don't use a phone with your anonymous email account
  • Find an email provider that hosts a .onion page for increased security -- Mail2Tor, RuggedInbox, SigAint, Lelantos, etc.
  • Encrypt all of your email with PGP
  • Use Tails

Some email providers strip META-data from email headers; that's preferable. Any options for increasing security while connecting to the email provider's .onion page may increase the fingerprint of your browser; that's not preferable. With this being said, and if you're using the TorBrowser to only connect to the mail provider, then a few options for greater security than the default TBB settings could be reasonable depending on your threat model. Suggestions for further research: NoScript settings, Forward Security, OCSP, Mixed Content, Frames, HTTP Referer Headers, Safe SSL Negotiation, SSL Certificate Fingerprinting (not with .onion sites usually), and TLS 1.1+.

If you're really serious about sending an anonymous email, for instance to a journalist, then sending a PGP encrypted, one-way-only email through some series of anonymous Mixmaster or Mixminion remailers, in addition to some or all of the above precautions, is the best option I've heard of at least.

2

StartMail, https://www.startmail.com/ Cost: US$59.95 per year. StartMail never records and never saves your IP address. Your connection is via secure HTTPS encryption. StartMail has built-in PGP encryption.

Yandex Mail, https://mail.yandex.com/ Cost: free. Your legal name, phone number, email address, and personal information not required to register an email account. If you use and configure Tor browser correctly, Yandex Mail cannot identify your IP address, you, or your computer. If you have PGP encryption software on your computer, you can encrypt your messages and attachments.

1

There already exists a solution for anonymous mail services. It is called Mixmaster. You can use it either with special clients (OmniMix for Windows) or with a website (Anonymouse).

In the case of the website you just enter the email address, subject and the text. The mail itself is sent over several servers. Each identifying information of the email will be removed.

So you just need to secure your browsing to the website. If you need to be secure it might be good to use Tails, login to some open Wifi and use the website. However I recommend to get some information about operational security first. This will help you recognize where risks are and how to secure your machines and your behavior.

0

Choose an email provider (doesn't matter which one), create an account using Tor, and when you are going to send an email, encrypt the contents using PGP. Every provider will save your emails and reveal them to third parties if they have to, but the beauty of PGP is that your email will be unreadable gibberish to anyone but the receiver.

  • 1
    PGP encrypt the content of the email but it does not make the sender identity anonymous. – Roya Nov 8 '14 at 14:31
  • If you don't want the receiver to know who you are, how do you persude him/her to use PGP? – WGroleau Sep 5 '15 at 5:03
0

I suggest you to register a new safe mail box that is escaped from prism, like riseup or autistici, their developers will not track you. Well, you should use Tor when you start to visit these mailbox.

  • 1
    This, of course, requires that you trust Riseup or Autistici not to save your email. I haven't used either of those, and know nothing about their reputation, but if you really want to remain anonymous you need end to end encryption. Not just an email provider that claims they won't save any information about you. – Sam Whited Nov 8 '14 at 15:14
  • Riseup and Autistici are in this site:prism-break.org/en/,so I choose to trust them.You are right,safe mailbox with tor and end to end encryption make a man be true anonymous. – Ghost Assassin Nov 9 '14 at 7:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.